# edgesecurityteam/ehole architecture

> Architecture diagram of the GitHub repository edgesecurityteam/ehole, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-29). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/edgesecurityteam/ehole
- Repository: https://github.com/edgesecurityteam/ehole

## Overview

EHole is a command-line asset fingerprinting tool with two main workflows: collect targets from a local file, a single URL, or FOFA and scan them for web-system fingerprints; or query FOFA and export asset details to XLSX. The scan fetches HTTP responses, follows discovered JavaScript URLs, checks configurable body/header/title and favicon rules, and reports matches and results. The graph reflects sampled command, source, scan, and HTTP code; some supporting modules are included based on the repository tree and documented capabilities, so their internal wiring is left unspecified where not sampled.

Main entry points: [`module/finger/finger.go`](https://github.com/edgesecurityteam/ehole/blob/main/module/finger/finger.go) (Concurrent scanner), [`cmd/finger.go`](https://github.com/edgesecurityteam/ehole/blob/main/cmd/finger.go) (Fingerprint command), [`module/finger/http.go`](https://github.com/edgesecurityteam/ehole/blob/main/module/finger/http.go) (HTTP response fetch), [`module/finger/source/fofa.go`](https://github.com/edgesecurityteam/ehole/blob/main/module/finger/source/fofa.go) (FOFA asset search)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_entry["CLI workflows"]
  node_main["Program entry<br/>[main.go]"]
  node_commands["Command setup<br/>[root.go]"]
  node_finger_cmd["Fingerprint command<br/>[finger.go]"]
  node_fofa_cmd["FOFA export command<br/>[fofaext.go]"]
end

subgraph group_collect["Asset collection"]
  node_local_source["Local target reader<br/>[localfile.go]"]
  node_fofa_source["FOFA asset search<br/>[fofa.go]"]
  node_fofa_service["FOFA API"]
  node_fofa_config["FOFA credentials<br/>[config.ini]"]
end

subgraph group_scan["Fingerprint scan"]
  node_scan["Concurrent scanner<br/>[finger.go]"]
  node_work_queue["URL work queue<br/>[queue.go]"]
  node_http_fetch["HTTP response fetch<br/>[http.go]"]
  node_encoding["Response decoding<br/>[encoding.go]"]
  node_js_discovery["JavaScript discovery<br/>[jsjump.go]"]
  node_favicon_hash["Favicon hashing<br/>[faviconhash.go]"]
  node_finger_rules["Fingerprint matcher<br/>[matchfinger.go]"]
  node_rule_loader["Rule loading<br/>[getfingerfile.go]"]
  node_rules["Fingerprint rules<br/>[finger.json]"]
end

subgraph group_export["Results and export"]
  node_results["Scan results<br/>[finger.go]"]
  node_scan_output["Scan result writer<br/>[output.go]"]
  node_fofa_export["FOFA XLSX writer<br/>[fofaext.go]"]
  node_xlsx["XLSX file"]
end

node_operator(("Operator"))

node_operator -->|"runs"| node_main
node_main -->|"executes"| node_commands
node_operator -->|"selects scan"| node_finger_cmd
node_commands -->|"registers"| node_finger_cmd
node_commands -->|"registers"| node_fofa_cmd
node_finger_cmd -->|"reads targets"| node_local_source
node_finger_cmd -->|"requests targets"| node_fofa_source
node_finger_cmd -->|"starts scan"| node_scan
node_fofa_source -->|"reads credentials"| node_fofa_config
node_fofa_source -->|"queries"| node_fofa_service
node_fofa_cmd -->|"requests assets"| node_fofa_source
node_fofa_cmd -->|"passes results"| node_fofa_export
node_fofa_export -->|"writes"| node_xlsx
node_scan -->|"queues targets"| node_work_queue
node_scan -->|"fetches URL"| node_http_fetch
node_http_fetch -->|"decodes body"| node_encoding
node_http_fetch -->|"extracts JS URLs"| node_js_discovery
node_http_fetch -->|"gets favicon hash"| node_favicon_hash
node_scan -->|"loads rules"| node_rule_loader
node_rule_loader -->|"reads"| node_rules
node_scan -->|"matches response"| node_finger_rules
node_scan -->|"collects findings"| node_results
node_scan -->|"writes results"| node_scan_output
node_scan_output -->|"exports XLSX"| node_xlsx

click node_main "https://github.com/edgesecurityteam/ehole/blob/main/main.go"
click node_commands "https://github.com/edgesecurityteam/ehole/blob/main/cmd/root.go"
click node_finger_cmd "https://github.com/edgesecurityteam/ehole/blob/main/cmd/finger.go"
click node_fofa_cmd "https://github.com/edgesecurityteam/ehole/blob/main/cmd/fofaext.go"
click node_local_source "https://github.com/edgesecurityteam/ehole/blob/main/module/finger/source/localfile.go"
click node_fofa_source "https://github.com/edgesecurityteam/ehole/blob/main/module/finger/source/fofa.go"
click node_fofa_config "https://github.com/edgesecurityteam/ehole/blob/main/config.ini"
click node_scan "https://github.com/edgesecurityteam/ehole/blob/main/module/finger/finger.go"
click node_work_queue "https://github.com/edgesecurityteam/ehole/blob/main/module/queue/queue.go"
click node_http_fetch "https://github.com/edgesecurityteam/ehole/blob/main/module/finger/http.go"
click node_encoding "https://github.com/edgesecurityteam/ehole/blob/main/module/finger/encoding.go"
click node_js_discovery "https://github.com/edgesecurityteam/ehole/blob/main/module/finger/jsjump.go"
click node_favicon_hash "https://github.com/edgesecurityteam/ehole/blob/main/module/finger/faviconhash.go"
click node_finger_rules "https://github.com/edgesecurityteam/ehole/blob/main/module/finger/matchfinger.go"
click node_rule_loader "https://github.com/edgesecurityteam/ehole/blob/main/module/finger/getfingerfile.go"
click node_rules "https://github.com/edgesecurityteam/ehole/blob/main/finger.json"
click node_results "https://github.com/edgesecurityteam/ehole/blob/main/module/finger/finger.go"
click node_scan_output "https://github.com/edgesecurityteam/ehole/blob/main/module/finger/output.go"
click node_fofa_export "https://github.com/edgesecurityteam/ehole/blob/main/module/fofaext/fofaext.go"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_main,node_commands,node_finger_cmd,node_fofa_cmd toneBlue
class node_local_source,node_fofa_source,node_fofa_service,node_fofa_config toneAmber
class node_scan,node_work_queue,node_http_fetch,node_encoding,node_js_discovery,node_favicon_hash,node_finger_rules,node_rule_loader,node_rules toneMint
class node_results,node_scan_output,node_fofa_export,node_xlsx toneRose
class node_operator toneIndigo
```

## Components

### CLI workflows

- [Program entry](https://github.com/edgesecurityteam/ehole/blob/main/main.go): `main.go`
- [Command setup](https://github.com/edgesecurityteam/ehole/blob/main/cmd/root.go): `cmd/root.go`
- [Fingerprint command](https://github.com/edgesecurityteam/ehole/blob/main/cmd/finger.go): `cmd/finger.go`
- [FOFA export command](https://github.com/edgesecurityteam/ehole/blob/main/cmd/fofaext.go): `cmd/fofaext.go`

### Asset collection

- [Local target reader](https://github.com/edgesecurityteam/ehole/blob/main/module/finger/source/localfile.go): `module/finger/source/localfile.go`
- [FOFA asset search](https://github.com/edgesecurityteam/ehole/blob/main/module/finger/source/fofa.go): `module/finger/source/fofa.go`
- **FOFA API**
- [FOFA credentials](https://github.com/edgesecurityteam/ehole/blob/main/config.ini): `config.ini`

### Fingerprint scan

- [Concurrent scanner](https://github.com/edgesecurityteam/ehole/blob/main/module/finger/finger.go): `module/finger/finger.go`
- [URL work queue](https://github.com/edgesecurityteam/ehole/blob/main/module/queue/queue.go): `module/queue/queue.go`
- [HTTP response fetch](https://github.com/edgesecurityteam/ehole/blob/main/module/finger/http.go): `module/finger/http.go`
- [Response decoding](https://github.com/edgesecurityteam/ehole/blob/main/module/finger/encoding.go): `module/finger/encoding.go`
- [JavaScript discovery](https://github.com/edgesecurityteam/ehole/blob/main/module/finger/jsjump.go): `module/finger/jsjump.go`
- [Favicon hashing](https://github.com/edgesecurityteam/ehole/blob/main/module/finger/faviconhash.go): `module/finger/faviconhash.go`
- [Fingerprint matcher](https://github.com/edgesecurityteam/ehole/blob/main/module/finger/matchfinger.go): `module/finger/matchfinger.go`
- [Rule loading](https://github.com/edgesecurityteam/ehole/blob/main/module/finger/getfingerfile.go): `module/finger/getfingerfile.go`
- [Fingerprint rules](https://github.com/edgesecurityteam/ehole/blob/main/finger.json): `finger.json`

### Results and export

- [Scan results](https://github.com/edgesecurityteam/ehole/blob/main/module/finger/finger.go): `module/finger/finger.go`
- [Scan result writer](https://github.com/edgesecurityteam/ehole/blob/main/module/finger/output.go): `module/finger/output.go`
- [FOFA XLSX writer](https://github.com/edgesecurityteam/ehole/blob/main/module/fofaext/fofaext.go): `module/fofaext/fofaext.go`
- **XLSX file**

### Other components

- **Operator**

## Connections

- Operator → Program entry: runs
- Program entry → Command setup: executes
- Operator → Fingerprint command: selects scan
- Command setup → Fingerprint command: registers
- Command setup → FOFA export command: registers
- Fingerprint command → Local target reader: reads targets
- Fingerprint command → FOFA asset search: requests targets
- Fingerprint command → Concurrent scanner: starts scan
- FOFA asset search → FOFA credentials: reads credentials
- FOFA asset search → FOFA API: queries
- FOFA export command → FOFA asset search: requests assets
- FOFA export command → FOFA XLSX writer: passes results
- FOFA XLSX writer → XLSX file: writes
- Concurrent scanner → URL work queue: queues targets
- Concurrent scanner → HTTP response fetch: fetches URL
- HTTP response fetch → Response decoding: decodes body
- HTTP response fetch → JavaScript discovery: extracts JS URLs
- HTTP response fetch → Favicon hashing: gets favicon hash
- Concurrent scanner → Rule loading: loads rules
- Rule loading → Fingerprint rules: reads
- Concurrent scanner → Fingerprint matcher: matches response
- Concurrent scanner → Scan results: collects findings
- Concurrent scanner → Scan result writer: writes results
- Scan result writer → XLSX file: exports XLSX