NOX-CLI(1)

NAME
nox-cli - Advanced Asynchronous Cyber Threat Intelligence Framework

SYNOPSIS
nox-cli [OPTIONS]

DESCRIPTION
nox-cli is an open-source OSINT and breach intelligence framework supporting 120+ JSON-plugin data sources. It performs asynchronous multi-source lookups against email addresses, domains, IP addresses, usernames, phone numbers, and hashes. Results can be exported in JSON, CSV, HTML, Markdown, or PDF.

On first run, the application creates ~/.nox/ with a default config.ini and seeds the sources directory from the package data.

OPTIONS

-t, --target TARGET
    Target to scan (email, domain, IP, username, phone, or hash).

-i, --interactive
    Launch the interactive REPL shell.

--version
    Print version number and exit.

--autoscan
    Full pipeline: breach scan + recursive identity pivot + dorking + paste/Telegram scraping. Equivalent to running all phases in sequence on the target and every discovered asset.

--fullscan
    Full scan including pivot enrichment, dorking, and scraping (alias for --autoscan).

--no-pivot
    Disable recursive pivot enrichment during a full scan.

--dork TARGET
    Run Google dorking against the specified target.

--scrape TARGET
    Run web scraping and Telegram indexing against the specified target.

--crack HASH
    Attempt to crack the given hash using online rainbow-table APIs and local wordlists. WARNING: submitting hashes to online APIs leaks them to third-party services. Use --no-online-crack to restrict cracking to local wordlists only.

--no-online-crack
    Disable all online rainbow-table API queries during hash cracking. Only local wordlist-based cracking is performed. No hash data is sent to external services. Recommended for sensitive engagements.

--analyze PASSWORD
    Analyze a password for strength and breach exposure.

--apikeys
    Show the API key configuration dashboard. Displays configured and unconfigured keys for all supported services.

--allow-leak
    Bypass the fail-safe OPSEC kill-switch and allow direct connections even when a proxy or Tor circuit is unavailable. Use only in controlled environments.

--tor
    Route all requests through the local Tor SOCKS proxy (port 9050).

--proxy URL
    Use the specified proxy URL for all requests.

--threads N
    Maximum concurrency level (default: 20).

--timeout SECONDS
    Per-request timeout in seconds (default: 15).

-o, --output FILE
    Write results to the specified output file.

--format {json,csv,html,md,pdf}
    Output format (default: json).

--diff
    Compare the current scan results against the last cached scan for the same target and display only new findings. Records already present in the local SQLite cache are suppressed. Useful for recurring exposure monitoring.

FILES

~/.nox/config.ini
    Per-user configuration file. Created automatically on first run. Contains [settings] (concurrency, timeout, stealth, rate limits) and [api_keys] sections.

/etc/nox/config.ini
    System-wide configuration file. Used as fallback when the per-user file does not exist.

~/.nox/sources/
    Directory containing JSON source definition files.

~/.nox/reports/
    Default output directory for generated reports.

~/.nox/logs/nox.log
    Application log file.

BUGS
Report bugs at https://github.com/nox-project/nox-framework/issues

AUTHOR
nox-project