Valkyrie Tools#

This is an open-source project that being a collection of tools and scripts for making the life of security analysts easier, faster, and more efficient.

The tools are built to be easily usable from the command line and also easily integratable into your codebase. The documentation is still a work-in-progress but the tools are fully functional and ready to be used.

Installation#

To install the Valkyrie tools, you simply need to run the following command:

$ pip install valkyrie-tools

Usage#

Valkyrie#

valkyrie [OPTIONS] COMMAND [ARGS]...

Global Options#

  • --version Show the version information and exit.

  • --help Show the help message and exit.

Sub-commands#

config

Manage configuration values.

valkyrie config [COMMAND] [ARGS]...

Sub-commands:

  • delete - Delete a configuration value.

  • get - Get a configuration value.

  • list - List configuration values.

  • set - Set a configuration value.

URL Check#

Check url(s) for their aliveness and status.

urlcheck [OPTIONS] [URL]...

Global Options#

  • -j, --json Output results as JSON.

  • -I, --interactive Interactive mode.

  • -t, --no-truncate Disable header truncation.

  • -S, --show-headers Disable header truncation.

  • -h, --help Show this message and exit.

Examples#

urlcheck "https://example.com"
-> https://example.com
HTTP/1.1 - 200 - OK

urlcheck "https://example.com" "https://example.org"
-> https://example.com
HTTP/1.1 - 200 - OK

-> https://example.org
HTTP/1.1 - 200 - OK

IP Check#

Get ip address info.

ipcheck [OPTIONS] [IP_ADDR]...

Global Options#

  • -j, --json Output results as JSON.

  • -I, --interactive Interactive mode.

  • -h, --help Show this message and exit.

Examples#

ipcheck 8.8.8.8
> 8.8.8.8
ip       : 8.8.8.8
hostname : dns.google
city     : Mountain View
region   : California
country  : US
loc      : 38.0088,-122.1175
org      : AS15169 Google LLC
postal   : 94043
timezone : America/Los_Angeles
readme   : https://ipinfo.io/missingauth
anycast  : True

DNS Check#

Check DNS records for domains and IP addresses.

dnscheck [OPTIONS] [IP_ADDR]...

Global Options#

  • -j, --json Output results as JSON.

  • -I, --interactive Interactive mode.

  • -t, --rtypes DNS record type to query.

  • -h, --help Show this message and exit.

Examples#

dnscheck google.com
> google.com
A   : 142.251.32.110
AAAA: 2404:6800:4003:c00::8a
AAAA: 2404:6800:4003:c00::71
AAAA: 2404:6800:4003:c00::64
AAAA: 2404:6800:4003:c00::8b
MX  : smtp.google.com.

Whobe#

Check whois on domains and ip addresses.

whobe [OPTIONS] [IP_ADDR]...

Global Options#

  • -j, --json Output results as JSON.

  • -I, --interactive Interactive mode.

  • -h, --help Show this message and exit.

Examples#

whobe google.com
> google.com
Registrar: MarkMonitor Inc. (None)
Emails:
    - abusecomplaints@markmonitor.com
Name: None
Address: None, None, None None, None
Creation Date: 1997-09-15 04:00:00
Expiration Date: 2028-09-14 04:00:00
Updated Date: 2019-09-09 15:39:04
Name Servers:
    - NS1.GOOGLE.COM
    - NS2.GOOGLE.COM
    - NS3.GOOGLE.COM
    - NS4.GOOGLE.COM

JSON Output & Piping#

Every command accepts a -j / --json flag that switches output to a structured JSON array instead of human-readable text. The arrays are designed to be piped directly between commands – each entry carries an "input" key that downstream commands use to extract their targets automatically.

Single-command JSON output#

dnscheck --json google.com
[
  {
    "input": "google.com",
    "records": {
      "A": ["142.251.32.110"],
      "AAAA": ["2404:6800:4003:c00::8a"],
      "MX": ["smtp.google.com."]
    }
  }
]

ipcheck --json 8.8.8.8
[
  {
    "input": "8.8.8.8",
    "ip": "8.8.8.8",
    "hostname": "dns.google",
    "city": "Mountain View",
    "region": "California",
    "country": "US",
    "org": "AS15169 Google LLC"
  }
]

Piping between commands#

Resolve DNS records then look up each IP in one pipeline:

dnscheck --json google.com | ipcheck --json

Resolve DNS then run WHOIS on the domain targets:

dnscheck --json google.com | whobe --json

Check a list of URLs then pipe the targets into WHOIS:

urlcheck --json https://example.com | whobe --json