Free tools
The offensive toolbox.
The value travels in the URL fragment, after the # sign, which browsers never send to the server. The tool removes it from the address bar as soon as it has read it.
Phase 01
Reconnaissance
Map the scope and structure indicators before touching it: addresses, certificates, domains and digests.
Phase 02
Initial access
The doors tried first: default passwords, SSRF filters and loose Content Security Policies.
Phase 03
Web and API
Read exactly what browsers, proxies and APIs receive: URLs, HTTP messages and OpenAPI contracts.
Phase 04
Shells and privilege escalation
Land a stable shell, then find the binary that leads to root or SYSTEM.
Phase 05
Tokens and federation
Read what the application passes around: JWTs, SAML assertions, signatures and accepted algorithms.
Phase 06
Encoding and hashing
Decode an unknown string, chain transformations, identify a hash and its hashcat mode.
Phase 07
Reporting
Prepare shareable evidence: redaction, HTTP comparison, a security.txt channel and reproducible scoring.
- CVSS Calculator T-17 CVSS 4.0 and 3.1: score, vector and severity, live.
- security.txt Studio T-18 Validate or generate a security.txt file aligned with RFC 9116.
- Evidence Sanitizer T-19 Mask secrets, emails and IPv4 addresses before sharing evidence.
- HTTP Evidence Diff T-20 Compare two sanitised HTTP messages without replaying them.
No tool matches. Try the launcher above with the value itself.
Cybersecurity definitions
Each term links to its definition, examples and the corresponding tool.
- Base64 encoding
- CIDR and subnet
- CSP (Content Security Policy)
- CVSS (Common Vulnerability Scoring System)
- Default credentials
- Evidence redaction
- Hash and hash function
- HTTP message
- HTTP message comparison
- IOC (indicator of compromise)
- JWT (JSON Web Token)
- OAuth 2.0 and OpenID Connect
- OpenAPI specification
- Privilege escalation (privesc)
- Reverse shell
- SAML (Security Assertion Markup Language)
- security.txt
- SSRF (Server-Side Request Forgery)
- URL and web origin
- X.509 certificate
02Method
Tools you can check.
Three rules apply to every tool on this page, and you can check them with your browser’s developer tools.
- (01)
Everything stays local
Nothing you type leaves the page: the Network tab stays empty while you work, and a strict CSP forbids any third-party script or call.
- (02)
Maintained sources
Every computation rests on a public library or a recognised dataset, credited below. Our code wires, filters and explains, and our tests check it against known vectors.
- (03)
Links that do not leak
A shared link carries its parameters in the URL fragment. A CVSS vector or a Forge recipe can be shared without touching our servers.
Under the hood
Technical assessment
Request an application or infrastructure assessment
For an assessment by our team, specify the systems involved, available access and requested tests in your enquiry.