findings.jsonl. One row per confirmed panel, plus a summary.
Target
Put a domain on subfinder. The probe checks at most 80 hosts.
How it works
subfinder lists hosts. httpx probes them. tomcat, databases, platforms, and wordpress request known panel paths. A hit needs a body match, a realm, or a header. The check does not log in.
Overview
An /admin path is not an admin panel. This workflow enumerates hosts and requests known management paths, then keeps a hit only when the page or the auth realm matches the product. Tomcat Manager, Jenkins, phpMyAdmin, and Adminer are in that set. A login wall that names the product still counts as an exposed panel, because the management surface is on the internet. The check does not submit credentials. Point it at a domain you are authorised to test, and track confirmed panels in exposure management.
Pipeline
subfinder enumerates hosts for the domain you set.
tomcat, databases, platforms, and wordpress request known panel paths, on at most 80 hosts. A hit needs a body match, a realm, or a header. The check does not log in.
report writes findings.jsonl, one row per confirmed panel, plus a summary.
Inputs
Domain. Set on the subfinder node. Hosts come from that enumeration.
Outputs
findings.jsonl. One JSON line per confirmed panel, plus a summary.
Integrations
Subfinder. Host enumeration.
httpx. HTTP probe of the enumerated hosts.
Sample output
The row below is from a completed run on webappsecurity.com on 2026-09-24. Five hosts were scanned. One panel was confirmed.
product
url
status
auth_required
evidence
severity
scanned_at
Tomcat Manager
http://zero.webappsecurity.com/manager/html
401
true
auth-challenge realm='Tomcat Manager Application'
high
2026-09-24T10:11:48Z
FAQ
Does a hit mean I am logged in?
No. A hit means the panel is reachable and the page or realm names the product. The check does not submit credentials.
Why confirm the body?
Many sites answer 200 for every path. A marker or realm is what makes the row a panel.
How many hosts are checked?
At most 80 hosts from the subfinder output.
Where should I run it?
On a domain you are authorised to test.
Related workflows
Exposed Database Scanner. Reach for this when the exposure is an open database port rather than a management UI.
Subdomain Takeover Scanner. Reach for this when the host should not exist, rather than when a panel is mounted on it.