Offensive and defensive security, one surface.
Offensive and defensive security tools for recon, validation, and audit, run from the browser with nothing to install. No account, no quota, and nothing retained after your session.
- Offensive and defensive tools behind one input and output contract.
- Chain tools into a workflow that returns one run report instead of a result per page.
- Session-scoped by default - no account, no quota, nothing retained.
Chain WHOIS, DNS, subdomain discovery, reverse IP, geolocation, HTTP, SSL, tech stack, WAF, and security header checks against one domain.
Find the right tool
Tools are grouped by what they do, so you can start from the job in front of you rather than a tool's name.
Browse ToolsHow it works
Every tool and workflow follows the same three steps, from the input you give it to the result you take away.
Enter a target
A domain, URL, IP address or text - whatever the tool asks for. Only test systems you are authorized to assess.
Run it
Run a single tool, or a workflow that chains several into one guided run. Nothing to install and no account.
Read the results
Structured results with severity bands, ready to export. Nothing is kept once you close the page.
Try a Workflow
Pick a workflow and run it straight away - each one chains several tools into a single guided assessment, so you don't have to open and configure tools one by one.
All Workflows| WORKFLOW | TOOL CHAIN | RUNTIME | CATEGORY | Run |
|---|---|---|---|---|
| External Asset Footprintexternal-asset-footprint | 10 steps | 128s | Offensive Security | Run |
| Public Network Service Exposurepublic-network-service-exposure | 8 steps | 43s | Offensive Security | Run |
| Domain OSINT & Leak Reviewdomain-osint-leak-review | 4 steps | 46s | Offensive Security | Run |
| Database Injection Test Packdatabase-injection-test-pack | 5 steps | 52s | Offensive Security | Run |
| Server-Side Injection Test Packserver-side-injection-test-pack | 6 steps | 48s | Offensive Security | Run |
| Browser Request Injection Test Packbrowser-request-injection-test-pack | 6 steps | 60s | Offensive Security | Run |
Free means free - and nothing is retained by default.
Full detail in the Privacy Policy
Nothing you enter is retained
We do not collect, store, or track your target IPs, domains, or any input you enter into a tool. Most run client-side or process temporarily in server memory with no logging.
No account required
No sign-up, no email, no password. Open a tool page and use it - the same access whether it's your first visit or your hundredth.
No tracking cookies
Only functional cookies for display preferences like language. No advertising or third-party tracking cookies, ever.
Free means free
Every tool and workflow on this platform is free with no usage cap, no paywall, and no upsell.
No account. No quota. Just run it.
No account, no quota, nothing installed - pick a tool or a workflow and start.