One-click crawl that saves every page and asset, rewrites links so the mirror opens offline, then scans the whole thing for leaked credentials, admin panels, and misconfigs.
Static pages, JavaScript, paginated listings, product catalogs, sitemaps, CSS-referenced assets — all crawled, saved, and rewritten so the output works offline.
Same-domain. Follows links, forms, sitemaps. Saves HTML, CSS, JS, images, fonts, video, docs. Handles lazy-loaded images and srcset.
Every absolute URL becomes a relative local path. Disconnect Wi-Fi, open index.html, everything still works.
Detects ?page=N, ?offset=N, ?start=N and walks each key up to 500 pages. Search backends crawled to exhaustion.
Reads JSON-LD and OpenGraph from every page. Writes _products.ndjson. Query it with a small filter language built into the app.
23 rules scan the mirror for AWS keys, JWTs, Stripe secrets, .env leaks, .git/ exposures, admin panels, GraphQL endpoints, and more.
Writes crawl state after every batch. Kill the process mid-run, relaunch, it picks up exactly where it left off.
The scan finds credentials, misconfigurations, and admin surfaces. Every match is truncated to first-6 / last-6 characters in the report. Enough to confirm a real hit, not enough to use it.
| Rule | Severity | Detects |
|---|---|---|
| aws_access_key | critical | AKIA-prefixed AWS access key |
| aws_secret | critical | aws_secret_access_key assignment |
| stripe_live_secret | critical | sk_live_ token |
| github_token | critical | ghp_ / gho_ / ghs_ / ghr_ tokens |
| private_key | critical | PEM private key header |
| env_file | critical | Multi-line KEY=VALUE blocks |
| git_exposure | critical | .git/HEAD, .git/config reachable |
| google_api_key | high | AIza-prefixed key |
| slack_token | high | xox[baprs]- token |
| jwt | high | Three-part JWT |
| firebase_config | high | apiKey + authDomain pair |
| phpmyadmin | high | /phpmyadmin, /adminer |
| debug_endpoint | high | /debug, /actuator, /server-status |
| s3_reference | medium | s3:// and *.amazonaws.com |
| graphql_endpoint | medium | /graphql paths |
| wp_login | medium | /wp-login.php, /wp-admin |
| admin_panel | medium | /admin, /cpanel, /webmin |
| stack_trace | medium | Framework stack traces |
| source_map | low | sourceMappingURL=*.map |
| email_address | low | Emails on the page |
| internal_ip | low | 10.x, 172.16-31.x, 192.168.x |
SiteGrabber is free and open to everyone. No account, no paywall, no limits on what you can crawl. If it saves you time, you can buy me a coffee — that's the entire business model.
Download the exe, crawl a site, keep the mirror. Personal or commercial, no license required.
If it works for you, tell one person. Post a finding, link the repo, send it to a friend who runs recon.
Optional. Every donation buys hours of development on the next feature.