Explore tools

Network mapper for host discovery, port scans, and service/version detection on in-scope ranges.

Asynchronous Internet-scale port scanner for fast, coarse coverage of large in-scope CIDRs.

Attack-surface mapper for subdomain enumeration, ASN mapping, and OSINT on in-scope domains.

Passive subdomain discovery from OSINT sources for in-scope apex domains.

HTTP probe to confirm live web services, titles, status codes, and tech from a host list.

Internet-wide service search for banners, certs, and known exposures on in-scope IPs and orgs.

Intercepting proxy and scanner for authorized web and API testing, mapping, and manual review.

Open-source intercepting proxy and scanner for web and API assessments.

Modern intercepting proxy for manual web and API testing with a workflow-oriented UI.

Fast web fuzzer for content discovery and parameter enumeration on in-scope applications.

Crawler for JavaScript-heavy web apps and APIs to build an authorized URL inventory.

Template-based vulnerability scanner for known issues on in-scope web, API, and network services.

Automated SQL injection detection and confirmation against in-scope parameters.

Packet capture and protocol analysis for authorized network and wireless assessments.

LLMNR/NBT-NS/mDNS analysis and poisoning for authorized internal identity assessments.

Graph analysis of Active Directory and hybrid identity attack paths from authorized collection.

Python collection of Windows/AD protocol tools for authorized authentication and post-ex proof.

C2 framework for authorized post-exploitation on in-scope hosts when an implant is in the RoE.

Network execution and enumeration suite for SMB, LDAP, WinRM, and related Windows services.

Active Directory Certificate Services enumeration and abuse-path analysis for authorized AD CS reviews.

GPU password recovery against hashes obtained under RoE, run only in the engagement vault.

CPU-oriented password recovery and format conversion for hashes collected under RoE.

Cloud security configuration scanner for AWS, Azure, and GCP against CIS and similar benchmarks.

Multi-cloud audit tool that collects configuration via APIs and highlights risky settings.

AWS exploitation framework for authorized identity and service abuse proofs after config review.

Scanner for container images, filesystems, IaC, and cloud misconfig in authorized build and landing-zone reviews.

Mobile Security Framework for static and basic dynamic analysis of iOS and Android builds.

Dynamic instrumentation toolkit for lab iOS/Android processes during authorized mobile tests.

Runtime mobile exploration toolkit built on Frida, for lab-device assessments.

Self-hosted pentest reporting platform with reusable finding templates and collaborative review.

Pentest reporting suite with finding design, CVSS, and export, community or professional.

Collaboration platform for evidence, notes, and report generation across a pentest team.

Vulnerability management workspace that normalizes scanner output into a single engagement view.