Discovery
Playwright Webserver Capture
Feed a list of web servers to playwright. Each URL opens in Chromium, Firefox, or WebKit in parallel and keeps a screenshot, rendered HTML, and meta.json.
Discovery workflows
27 workflows for mapping what you own and what others can see: subdomain enumeration, company attack surface, passive OSINT, screenshots, sitemaps, and mail posture. Each page is a graph you can open node by node and point at your own domains.
Between them they run httpx, subfinder, amass, gowitness and playwright.
- Discovery
Find exposed API and debug surfaces
Enumerate a domain and confirm exposed OpenAPI specs, Spring Actuator endpoints, and debug paths from response content, not from a bare HTTP 200.
- Discovery
Exposed MCP Server Scanner
Scan a target domain with subfinder and httpx for MCP servers, then write authentication, capability, and poisoning-risk findings to JSONL.
- Discovery
Audit SSH algorithms on port 22
Enumerate a domain and flag weak SSH host keys, key exchange, ciphers, and MACs from an unauthenticated banner. The check does not log in.
- Discovery
Find Origin IPs Behind Cloudflare
Find the origin server behind Cloudflare or another WAF by resolving subdomains, filtering CDN ranges, and confirming which IP serves the site.
- Discovery
Fingerprint front-end JS library versions
Enumerate a domain and read public pages for JavaScript library names and versions, including jQuery, AngularJS, Bootstrap, and Lodash.
- Discovery
Find exposed SAP Commerce surfaces
Enumerate a domain and fingerprint SAP Commerce HAC, Backoffice, and Data Hub from public pages. The check does not sign in.
- Discovery
Playwright Page Capture
Open one URL in Chromium, Firefox, or WebKit with playwright and keep a screenshot, rendered HTML, and meta.json, or a HAR and Playwright trace.
- Discovery
Find exposed admin and management panels
Enumerate a domain and confirm admin panels such as Tomcat Manager, Jenkins, and phpMyAdmin from page markers or auth realms.
- Discovery
Audit TLS certificates on port 443
Enumerate a domain and classify expired, mismatched, self-signed, and untrusted certificates on port 443. The check reads the handshake only.
- Discovery
Find exposed Docker Engine APIs
Enumerate a domain and probe ports 2375 and 2376 for a Docker Engine API that returns version JSON. The check does not run containers.
- Discovery
Find exposed DevOps config files
Enumerate a domain and confirm web-exposed Terraform state, Docker config, npmrc, and netrc files from their content, not from a bare HTTP 200.
- Discovery
Full Network Port & Service Assessment
Point one domain, ASN or CIDR at it and get a graded report of every open port and exposed service, distributed and token-free.
- Discovery
Multi-Cloud Dangling DNS
Bind AWS, GCP, Azure, and Cloudflare vault config into findmytakeover; emit dangling-DNS findings and an evidence report.
- Discovery
PQ Crypto Surface Scanner
Enumerate live hosts from a domain, fingerprint TLS and post-quantum readiness with AC Scanner, and emit CBOM-style evidence plus remediation.
- Discovery
Sitemap URL & Metadata Extractor
Read a site's sitemap, fetch every page it lists, and inventory each URL's title, description, page type and metadata gaps in one table.
- Discovery
SPA Endpoint & Parameter Map
Map the route, API and parameter attack surface of a modern JS app (Next, Nuxt, React) from its JS bundles. No browser, no auth.
- Discovery
Typosquat & Look-alike Domain Scanner
Generate typo, homoglyph, TLD-swap and combosquat variants of a brand domain, probe every candidate, and score the live ones for phishing readiness.
- Discovery
Find Secrets in Wayback Responses
Pull a domain's archived URLs from web archives, fetch the stored response bodies, and scan them for leaked secrets without touching the live site.
- Discovery
Cloud Bucket Finder (S3, GCS, Azure)
Permute a keyword into candidate bucket names and check each anonymously across Amazon S3, Google Cloud, Azure Blob and DigitalOcean.
- Discovery
Passive Port & CVE Scan (Shodan)
Read a target's open ports, product versions and matching CVEs out of Shodan's own data, so nothing you run reaches the target.
- Discovery
Directory & Content Discovery
Confirm which hosts are live, then brute-force paths against each one from a wordlist fetched at run time, and report what answered.
- Discovery
Domain OSINT & Footprinting
Profile a domain without sending it a packet: subdomains, DNS, WHOIS and certificate history, plus which hosts are live and what they run.
- Discovery
Check Email Spoofing (DMARC SPF DKIM)
Check whether an attacker can send mail as your domain by querying SPF, DKIM, DMARC, MTA-STS and BIMI across every subdomain.
- Discovery
Subdomain Enumeration
Find every subdomain of a domain from passive sources and certificate transparency, then resolve and probe the hosts that answer.
- Discovery
Attack Surface Discovery by Company Name
Start from a company's registered name and find the domains it has certified, the networks those resolve into, and the hosts that answer.
- Discovery
Website Screenshot & Visual Recon
Screenshot every live web server across a domain's subdomains, ordered so the forgotten dashboard and the staging copy of production surface first.