Discover hosts
Collect in-scope names from public certificate sources, then resolve DNS records.
Hostnames · addresses · aliasesYour scope.
Your starting point.
Choose a wildcard scan for an authorized domain and its descendants, or focused tools for one exact hostname. You do not need a wildcard scope or a full scan to use supported individual tools.
Open your workspaceONE SHOT · WILDCARD SCOPE
Your authorized domain is the starting point.
Save a root domain or wildcard target, confirm your authorization, then start a combined scan. Collection moves through the supported stages and saves results in the same target workspace.
*.example.comTHE TARGET SCAN
What the scan collects.
Coverage is bounded by scope, discovered assets, supported checks and source availability.
Map web services
Probe supported HTTP and HTTPS ports and collect status, titles, server and technology clues.
Services · ports · technologiesCollect URLs and paths
Bring together reachable and archived routes, JavaScript assets and API-related paths.
URLs · scripts · route contextInspect JavaScript
Analyze collected scripts for endpoint references, parameters, secret signals and static sink candidates.
API paths · parameters · review leadsCheck exposure signals
Run bounded checks for common exposures, debug configuration, sensitive files and takeover fingerprints.
Evidence · source · coverage statusReview and return
Explore saved results by category, follow their evidence and compare available collections.
History · changes · finding statusINDIVIDUAL TOOLS
A smaller question. A separate result.
Only have permission for app.example.com? Save it as an exact hostname and choose a supported tool. Child, parent and sibling hostnames stay outside that scope. Run availability and limits are shown in your workspace.
Tech Stack
Identify a website’s technologies and exposed versions, with an overview of DNS, HTTP, TLS and security headers.
Exact host supportedSubdomain Finder
Expand a root domain into a clearer picture of its public-facing hosts.
Wildcard scope requiredDNS Map
Connect domains, hosts, and IP addresses in an interactive DNS diagram. Follow aliases, mail servers, and shared infrastructure.
Exact host supportedDomain Finder
Find domains referenced by CNAME, mail and nameserver records, with evidence for each association.
Exact host supportedURL Fuzzer
Look beyond linked pages for directories, files, and application routes.
Exact host supportedWAF Detector
Identify signs of a web application firewall before planning further assessment.
Exact host supportedVirtual Host Finder
Compare authorized hosts that share an IPv4 address and inspect their web responses.
Wildcard scope requiredPort Scanner
Check eight common web-service ports and identify responding HTTP and HTTPS services.
Exact host supportedGoogle Dorks
Explore 24 focused Google hacking queries for indexed documents, entry points, APIs and configuration clues. Copy a query or open it in Google.
Exact host supportedPort Scanner checks eight HTTP(S) service ports. URL Fuzzer uses 27 fixed paths. DNS Map resolves only the selected host for exact-host scope, or up to 40 hosts for wildcard scope. Google Dorks generates 24 focused queries for manual search. Tech Stack reports passive fingerprints, exposed versions and a bounded website overview; it does not certify security.
PAID FULL ACCESS
Explore AI reviewReview the evidence with AI.
Turn selected JavaScript contexts and saved findings into a private review with reasons and visible coverage. Usage limits apply; AI review is not included in the trial.
What a result means.
- A recorded observation, with its source and collection context.
- A complete or incomplete status for the work actually attempted.
- A starting point for validation and prioritization.
Where coverage stops.
No authenticated application crawling, full TCP/UDP port sweep, internal network access, cloud-account connector or automatic exploitation is included. Static JavaScript candidates and takeover signals need manual verification.
A clean result is not a security guarantee. Missing records may reflect source failures, limits or an asset that did not respond.