All tools

CVSS 4.0 and 3.1 with every metric explained in plain English, contradictory selections flagged, and the justification sentence written for your report.

Pre-written impact, reproduction and remediation for common findings, with CVSS pre-filled. Edit and export instead of starting from a blank page.

Turn a raw request and response into a clean evidence block with credentials, tokens and PII masked automatically.

Generate a complete report structure — scope, methodology, executive summary, findings, appendices — as editable Markdown.

OWASP WSTG, MASTG and PTES as trackable checklists with saved progress, so nothing gets skipped and coverage is provable.

Raw scan output into a filterable table of hosts, ports and service versions, with version-disclosure flags and CSV or Markdown export.

Paste a messy asset list to dedupe and normalise it, then flag anything outside your CIDR or wildcard scope rules before you touch it.

Filter a large URL list by extension, parameter, status or pattern, and extract the parameter names worth testing.

Build and launch dork queries for one target — exposed documents, config and backup files, login portals, verbose errors, cloud storage and code leaks. Every query is a link to open or a string to copy, for Google, Bing and DuckDuckGo.

One target in, every source out — crt.sh, Shodan, Censys, VirusTotal, Wayback, DNS and whois lookups as ready links, plus prepared subfinder, amass, httpx and dnsx commands.

Fingerprint the WAF from a response you already captured. Matches headers, cookies and block-page signatures against the wafw00f reference set of 173 products, then lists the evasion notes that apply to that specific product.

Paste nmap -sV output and get the known CVEs for each product and version, with CVSS score, attack vector and whether a public exploit exists — queried live from the NVD API, which permits direct browser access.

One keyword across every public disclosure source — HackerOne disclosed reports, Bugcrowd, Medium and InfoSec Writeups, pentester.land, GitHub and scoped search-engine queries. Filter by vulnerability class, bounty range or programme.

Decode, inspect, re-sign and attack tokens — alg:none, weak HMAC secrets, kid injection and missing claim validation.

Inflate and decode SAML requests and responses, pretty-print the XML, and flag signature and assertion weaknesses.

Decode an authorization redirect, inspect state and PKCE, and flag open-redirect and CSRF exposure in the flow.

Passwords and passphrases from crypto.getRandomValues, with true entropy in bits and an offline crack-time estimate per hash algorithm. Nothing generated ever leaves the browser.

Payloads for every injection class — XSS, SQLi, SSTI, SSRF, XXE, command injection, LFI and path traversal, NoSQL, LDAP, XPath, CRLF, open redirect, deserialisation. Choose the class and the context the injection lands in, get the payload that works there with the reasoning, plus WAF-bypass encodings.

One-liners by platform and language, with encoding options and listener commands alongside.

Auto-detect and decode whatever you paste — JWT, base64, hex, URL encoding, hash type or timestamp format.

Reference implementations of each known AMSI bypass class, paired with the detection signature and event ID that catches it — so red teams can measure coverage and blue teams can verify they are actually catching it.

Test a leaked Maps key against each Google endpoint to see which are unrestricted, what each call costs, and produce the billing-impact proof of concept a report needs.

Build bucket and hostname permutations from a company name or domain across S3, Azure Blob and Google Cloud Storage naming schemes, then get the aws, az and curl commands to test them.

Pick a track — AppSec, red team, cloud security, SOC and blue team, malware analysis, mobile, OT or GRC — and get a staged plan with prerequisites, labs, certifications and a realistic timeline, exportable as Markdown for your own notes.

Paste a job description and get the questions that role actually attracts, matched from the skills and tools named in it — grouped by topic and difficulty, each with the answer outline an interviewer is listening for.

Drop a file to see the author, GPS coordinates, software versions and internal paths inside it — before it reaches a target.

Reconstruct original sources from an exposed .map file and sweep them for hardcoded secrets, internal endpoints and debug routes.

Parse raw email headers for SPF, DKIM and DMARC results with a readable hop timeline, for phishing triage.