Web & DNS
Known-pattern tooling reads a web or DNS target you have proven you control. Active modules go further, one explicit consent at a time.
What people come here for
Web Vulnerability Scanning
Nuclei and its community template set against your running application — the broad first pass for known vulnerabilities and exposures.
Full definition →Authorization Testing
Vertical privilege elevation and multi-tenant isolation, tested with roles and tenants you declare rather than ones guessed from the page. An absence measured with a guessed identifier is reported as inconclusive, never as a pass.
Full definition →Authenticated DAST
Access-control test plans derived from real journeys through the logged-in application. A derived case stays disarmed unless a marker is present for the owner and absent for the other identity.
Full definition →TLS Configuration
Cipher suites, protocol versions, chain and expiry — and it still reads the certificate in the cases where the handshake itself would be rejected.
Full definition →External Exposure
Assets of yours facing the internet that nobody meant to publish, and your organization's accounts appearing in known breaches.
Full definition →Everything else in this surface
Each name opens its own one-line definition in the capability catalogue.
- Liveness Verification
- Fuzzing
- Application Crawling
- Browser Security
- IAST / RASP
- Mobile Security
- Service Discovery
- HTTP Headers
- DNS Posture
- Attack Surface Management
- Certificates & PKI
- Segmentation Validation
- Network Intrusion Detection (IDS)
- NDR
- Flow Analysis
- DNS Filtering
- Zero Trust & Access
- Wireless Securityin observation
- WAF / Inline Protectionin observation
- Anti-DDoS & Rate Limitingin observation
- Bot Defensein observation
What this does not do
Nothing here runs until you have proven you control the target. That requirement is what keeps this a security tool instead of an attack service anyone could rent by the hour.
Everything this product does not do →