Beta
Sign in
NINE FOCUSED RECON TOOLS

One hostname.
Your next question.

Check the stack, map DNS relationships, explore web services or build search queries. Choose a tool, enter a hostname and confirm your authorization. No all-in-one scan is required first.

Create your account

Individual Full Access membership · 1-day trial for eligible new members · Card required

DNS MAP

See the relationships, not just the records.

Explore hostnames, aliases, mail servers, nameservers and shared IP context in an interactive graph. Zoom, pan, expand the viewer or export the diagram. Enable wildcard scope only when you have permission for the domain and its descendants.

See DNS Map
CHOOSE THE CHECK

A toolkit for the scope you have.

Seven tools support an exact hostname. Subdomain Finder and Virtual Host Finder require wildcard authorization. Each run has its own saved results and coverage status.

Exact hostname supported

Tech Stack

Identify a website’s technologies and exposed versions, with an overview of DNS, HTTP, TLS and security headers.

  • Technologies, reported versions and detection evidence
  • DNS, HTTP and TLS observations
  • Security-header presence and cookie-attribute counts
Wildcard scope required

Subdomain Finder

Expand a root domain into a clearer picture of its public-facing hosts.

  • Discovered hostnames
  • Discovery sources
  • Hostnames ready for review
Exact hostname supported

DNS Map

Connect domains, hosts, and IP addresses in an interactive DNS diagram. Follow aliases, mail servers, and shared infrastructure.

  • An explorable map of DNS relationships
  • Hostnames, aliases, mail servers, and nameservers
  • Shared IP context and an exportable diagram
Exact hostname supported

Domain Finder

Find domains referenced by CNAME, mail and nameserver records, with evidence for each association.

  • DNS-associated domains
  • Association evidence
  • A domain inventory to verify
Exact hostname supported

URL Fuzzer

Look beyond linked pages for directories, files, and application routes.

  • Discovered paths
  • Response codes and sizes
  • Interesting routes for follow-up
Exact hostname supported

WAF Detector

Identify signs of a web application firewall before planning further assessment.

  • Firewall indicators
  • Observed response behavior
  • Evidence to verify the match
Wildcard scope required

Virtual Host Finder

Compare authorized hosts that share an IPv4 address and inspect their web responses.

  • Virtual host candidates
  • Host-specific responses
  • Shared infrastructure context
Exact hostname supported

Port Scanner

Check eight common web-service ports and identify responding HTTP and HTTPS services.

  • Responding web ports
  • HTTP and HTTPS service metadata
  • Ports checked: 443, 80, 8080, 8443, 3000, 8000, 8008, 8888
Exact hostname supported

Google Dorks

Explore 24 focused Google hacking queries for indexed documents, entry points, APIs and configuration clues. Copy a query or open it in Google.

  • 24 independent queries with exact-host or domain scope
  • Categories, copy controls and direct Google links
  • HTTP / HTTPS index selection for exact hosts

Port Scanner checks eight HTTP(S) ports, not a full port range. URL Fuzzer checks 27 fixed paths. Wildcard DNS Map considers up to 40 hosts. Google Dorks prepares queries for you to open in Google; it does not scrape search results. Technology matches are observations to verify.

Just one host?

Enter the hostname in your chosen tool and confirm you are authorized to assess it. Your account keeps that authorization record so you can return to the same scope. Parent, sibling and child hosts remain outside an exact-host check.

Have a wildcard scope?

Use the all-in-one target scan to connect discovery, DNS, web services, URLs, JavaScript and exposure checks in one target workspace.

Compare scan coverage
A FOCUSED START

Bring your scope.
Follow the evidence.

Create your account

Creating an account does not start a scan or begin a paid subscription. See membership and trial details.