Zero-Dependency Threat Intelligence, Attack Surface & CVE/EPSS Recon Workbench
This tool gathers passive Open-Source Intelligence (OSINT) using 7 public security APIs directly from your browser. Because it queries public registries (like Google DNS, Certificate Transparency logs, and FIRST.org), it never sends attack traffic to the target server—making it 100% safe and legal for learning, defensive auditing, and reconnaissance.
Beginner: Enter a website domain in Module A to see its servers, subdomains, and email security grade.
Pro: Enumerate CT shadow assets, EPP locks, and BGP AS-path upstreams.
Beginner: Switch to Module B to check if a software library has known security bugs and if hackers actively use them.
Pro: Correlate OSV advisories with FIRST.org 30-day EPSS weaponization scores.
Beginner: Use the k-Anonymity Lab to check if a password was leaked online without ever sending your password over the internet.
Pro: Verify SHA-1 5-byte prefix buckets via Web Crypto API.
Beginner: Go to Module C to download or print a clean summary report of everything you discovered.
Pro: Generate Markdown/PDF pentest deliverables for stakeholders.
For Beginners: Every website on the internet relies on a phonebook called DNS (to find IP addresses), SSL Certificates (for HTTPS padlocks), and Internet Service Providers (ASNs). This module automatically looks up all three and draws a visual map of the company's digital footprint.
For Red/Blue Teams: Automates passive Phase-1 Reconnaissance by chaining dns.google → crt.sh → rdap.org → stat.ripe.net → HIBP to identify shadow dev/staging subdomains, missing DMARC/SPF controls, and upstream BGP transit providers.
Looks up server IPs (A/AAAA), mail servers (MX), & security rules (TXT/CAA).
Finds hidden subdomains by searching public SSL certificate logs.
Modern WHOIS: checks domain registrar, expiry date & transfer locks.
Identifies which cloud or datacenter owns the server's IP range.
Maps how internet traffic routes to this server across global networks.
Checks if this domain has suffered any historical public data breaches.
Click & drag any node to inspect its technical details • Scroll or use buttons to zoom
Can attackers send fake phishing emails pretending to be this domain?
[email protected].
Beginner: Shows where the domain is registered, when it expires, and which datacenter/ISP hosts it.
Pro: Check for clientTransferProhibited locks (prevents domain hijacking) and inspect BGP Autonomous System Numbers (ASNs) & upstream peers for DDoS resilience.
A/AAAA = Server IP addresses • MX = Mail servers • NS = Name servers • TXT = Verification & SPF rules.
Every HTTPS certificate ever created is logged publicly. Attackers & defenders check this list to find forgotten dev., vpn., or staging. servers.
Checks HaveIBeenPwned's public breach registry to see if accounts registered under this domain were exposed in major historical hacks.
Look at the top-right of the screen—each numbered badge lights up (Amber = Fetching, Green = Success, Red = Rate-Limited/Blocked) as data streams in:
AS13335 for Cloudflare) and use BGP to tell the world which IP addresses they route traffic for.
clientTransferProhibited or serverDeleteProhibited act like a deadbolt on a domain name, preventing attackers from transferring or deleting the domain even if they compromise a registrar account.