1 · Manifest scan
Upload a dependency file (package-lock.json, requirements.txt, etc). Checks known-vulnerable package versions (OSV-Scanner) and signs of malicious packages (GuardDog). Runs entirely on our server against your uploaded file.
2 · Black-box recon
Give a live URL — checks for exposed source maps and known-vulnerable JS libraries actually served, no manifest needed.
3 · Subdomain takeover
Finds subdomains pointing (via CNAME) at a third-party service that's dangling or unclaimed — the classic setup for an attacker to hijack that subdomain.
4 · Nuclei template scan
Community vulnerability-template scan (ProjectDiscovery Nuclei) — exposed panels, default logins, known CVEs, misconfigurations. Can take a few minutes.
5 · Verify a specific CVE
Runs exactly one named check against a real URL — one explicit action, one result. Most sites correctly show "0 findings" since these target specific enterprise software.
6 · Exploit verification — SQL injection
Confirms a SQL injection is genuinely exploitable using sqlmap, capped to proof-of-impact only — extracts the database engine/version as evidence, never real rows or tables.
7 · Exploit verification — SSRF
Confirms Server-Side Request Forgery is genuinely exploitable by proving the target's own server issues an outbound request to a URL we control — never reads any real internal resource. Enter the target URL with the suspected vulnerable parameter's value replaced by the literal placeholder {{SSRF}}.