Features
Organized by what stage of an assessment each one supports — not a flat feature list.
Reconnaissance & attack surface
Lab mode: netdiscover for host discovery, nmap for port/service identification. External mode: bbot for subdomain/asset discovery, httpx to confirm live hosts, naabu for port scanning, katana for web crawling, nuclei for template-based detection.
Enumeration & verification
SMB share enumeration, content/directory discovery via ffuf, and URL verification — each gated behind explicit operator confirmation before it runs.
Investigation
An asset-centric navigator backed by a read-only relationship index. Selecting an asset narrows its services, findings, and evidence into view together.
Exploitation
SearchSploit and Metasploit candidate search, ranked by actual confidence rather than source. Firing requires explicit, multi-step confirmation of the real resolved target — restricted to verified, in-scope lab hosts.
Findings & evidence
Manual and automated finding capture, each categorized (observation, detection, vulnerability) with independent severity, confidence, and verification-status fields. Evidence is tracked as raw or parsed, never one destructively replacing the other.
Cross-finding linking
Operators can explicitly assert that two findings are related. This never happens automatically from text or host similarity, and never changes either finding's severity or verification status.
Scope enforcement
A centralized, default-deny scope engine gates every reconnaissance and exploitation execution boundary — see the security philosophy page for detail.
Reporting
Structured Markdown and HTML report generation, built directly from the same domain objects used throughout the assessment. See a real generated example on the Reports page.