98 of 98 tools
Every tool, one input and output contract.
Every tool takes named fields and answers in one shared shape. This page lists what each one accepts, what it costs against your rate budget, and where to run it.
98Tools
21Workflows
4Error codes
EN / IDLanguages
Run contract
Every tool takes named fields and answers in the same envelope, so what you learn on one tool carries to all of them. A run either succeeds with a data object, or fails with one of four codes.
{ "ok": true, "data": { }, "cached": false }{ "ok": false, "code": "invalid" }Error codes
A failed run never returns an upstream message or a stack trace. It returns one of these four codes, and the page renders the matching sentence.
| Code | What it means |
|---|---|
invalid | Invalid input. Please check your input and try again. |
timeout | The request took too long and timed out. Please try again. |
rate_limited | Too many requests. Please wait a moment before trying again. |
upstream | Something went wrong while processing. Please try again. |
Rate budget
Each tool is metered in one of three shared per-minute budgets, counted per visitor. A run over budget comes back as rate_limited rather than waiting in a queue.
| Rate tier | Budget |
|---|---|
global | 100 runs per 60s |
heavy | 20 runs per 60s |
light | 200 runs per 60s |
Offensive tools
subdomain-finderSubdomain FinderIntermediateAPI
webshell-finderWeb Shell FinderAdvancedAPI
sqli-scannerSQLi Payload GeneratorAdvancedAPI
xss-scannerXSS Payload GeneratorAdvancedAPI
port-scannerPort ScannerBasicAPI
directory-bruteforcerDirectory BruteforcerIntermediateAPI
dns-lookupDNS LookupBasicAPI
whois-lookupWHOIS LookupBasicAPI
waf-detectorWAF DetectorIntermediateAPI
cms-detectorCMS DetectorBasicAPI
tech-stack-analyzerTech Stack AnalyzerIntermediateAPI
header-analyzerHeader AnalyzerBasicAPI
google-dork-generatorGoogle Dork GeneratorIntermediateAPI
shodan-dork-generatorShodan Dork GeneratorIntermediateAPI
ssrf-map-generatorSSRF Map GeneratorAdvancedAPI
reverse-ipReverse IP LookupBasicAPI
lfi-payload-generatorLFI / RFI Payload GeneratorAdvancedAPI
cmd-injection-generatorCmd Injection GeneratorAdvancedAPI
ssti-payload-generatorSSTI Payload GeneratorAdvancedAPI
xxe-payload-generatorXXE Payload GeneratorAdvancedAPI
open-redirect-generatorOpen Redirect GeneratorIntermediateAPI
nosqli-payload-generatorNoSQLi Payload GeneratorAdvancedAPI
ldapi-payload-generatorLDAPi Payload GeneratorAdvancedAPI
xpathi-payload-generatorXPathi Payload GeneratorAdvancedAPI
prototype-pollution-generatorPrototype Pollution GeneratorAdvancedAPI
hpp-generatorHPP GeneratorIntermediateAPI
waf-test-generatorWAF Test Payload GeneratorIntermediateAPI
oauth-testerOAuth 2.0 / OIDC Misconfiguration TesterAdvancedAPI
api-fuzzerAPI FuzzerIntermediateAPI
jwt-attackerJWT Attack ToolkitAdvancedAPI
csrf-poc-generatorCSRF PoC GeneratorIntermediateAPI
cors-scannerCORS Misconfig ScannerIntermediateAPI
graphql-introspectorGraphQL IntrospectorAdvancedAPI
host-header-attackHost Header AttackIntermediateAPI
file-upload-bypassFile Upload BypassAdvancedAPI
polyglot-payload-generatorPolyglot Payload GeneratorAdvancedAPI
deserialization-payloadsDeserialization PayloadsAdvancedAPI
crlf-testerCRLF Injection TesterAdvancedAPI
cache-poisoningWeb Cache PoisoningAdvancedAPI
redos-testerReDoS TesterIntermediateAPI
username-enumerationUsername EnumerationIntermediateAPI
s3-bucket-scannerCloud Storage Bucket ScannerIntermediateAPI
docker-kubernetes-scannerContainer Security ScannerAdvancedAPI
git-exposure-scannerGit & Secrets Exposure ScannerIntermediateAPI
websocket-testerWebSocket Security TesterIntermediateAPI
race-condition-testerRace Condition TesterAdvancedAPI
Defensive tools
url-reputationURL Reputation CheckerBasicAPI
ip-geolocationIP GeolocationBasicAPI
ssl-checkerSSL CheckerBasicAPI
hash-analyzerHash AnalyzerIntermediateAPI
email-header-analyzerEmail Header AnalyzerIntermediateAPI
password-checkerPassword Strength CheckerBasicAPI
base64-toolBase64 Encoder/DecoderBasicClient
jwt-decoderJWT DecoderIntermediateAPI
url-encoderURL Encoder/DecoderBasicClient
ip-calculatorIP Subnet CalculatorBasicClient
http-statusHTTP Status CheckerBasicAPI
security-headersSecurity Headers CheckerBasicAPI
email-securityEmail Security CheckerBasicAPI
magic-detectorMagic DetectorIntermediateAPI
hash-generatorHash GeneratorBasicAPI
timestamp-converterTimestamp ConverterBasicClient
ssh-auditSSH Hardening ChecklistBasicAPI
ftp-scannerFTP Exposure ChecklistBasicAPI
smb-scannerSMB Exposure ChecklistBasicAPI
snmp-scannerSNMP Exposure ChecklistBasicAPI
rdp-vnc-checkerRDP / VNC Exposure ChecklistBasicAPI
metadata-extractorMetadata ExtractorBasicAPI
binary-analysisBinary AnalysisAdvancedAPI
exploit-dev-assistantExploit Development AssistantAdvancedAPI
ioc-extractorIOC ExtractorIntermediateAPI
cvss-calculatorCVSS v3.1 CalculatorBasicAPI
dga-detectorDGA DetectorIntermediateAPI
log-analyzerLog AnalyzerIntermediateAPI
cve-lookupCVE Lookup & EnrichmentBasicAPI
adversary-emulationAdversary Emulation PlannerIntermediateAPI
yara-rule-generatorYARA Rule GeneratorIntermediateAPI
sigma-rule-generatorSigma Rule GeneratorIntermediateAPI
vulnerability-feedVulnerability FeedBasicAPI
sbom-analyzerSBOM Vulnerability AnalyzerIntermediateAPI
cloud-posture-checkerCloud Security Posture CheckerBasicAPI
security-config-generatorSecurity Config GeneratorBasicAPI
cis-benchmark-checkerCIS Benchmark CheckerIntermediateAPI
firewall-auditorFirewall Rule AuditorBasicAPI
network-segmentationNetwork Segmentation ArchitectBasicAPI
zero-trust-assessmentZero Trust Maturity AssessmentBasicAPI
compliance-checkerCompliance CheckerBasicAPI
risk-calculatorRisk Assessment CalculatorIntermediateAPI
policy-generatorSecurity Policy GeneratorBasicAPI
honeypot-config-generatorHoneypot Config GeneratorIntermediateAPI
phishing-analyzerPhishing URL AnalyzerBasicAPI
ir-playbook-generatorIR Playbook GeneratorBasicAPI
forensic-timelineForensic Timeline BuilderIntermediateAPI
siem-query-builderSIEM Query BuilderIntermediateAPI
ids-rule-testerIDS/IPS Rule TesterIntermediateAPI
detection-engineeringDetection Engineering ValidatorBasicAPI
purple-team-exercisePurple Team Exercise GeneratorIntermediateAPI
Workflows
A workflow runs these same tools in a named order against one shared input. Each step calls exactly the tool documented above.