One workflow, not six disconnected tools
Hollowpath doesn’t try to out-perform every specialized tool at its own specialty. It gives reconnaissance, investigation, validation, exploitation, and reporting a shared engine and a shared set of data, so nothing gets lost moving from one stage to the next.
How it’s architected
Three interfaces, one engine, one domain model. No interface talks to the underlying data directly.
Full breakdown in the architecture docs.
The assessment lifecycle
Discover
In lab mode, discovery starts with host and service enumeration against a defined IP range — netdiscover to find live hosts, nmap to identify open ports and services. In external mode, discovery starts from a domain — bbot for subdomain and asset discovery, httpx to confirm which hosts are actually live, naabu for fast port scanning, and katana to crawl and map the web surface. Both paths produce the same thing: Asset and Service records the rest of the assessment builds on.
Investigate
Discovery produces a flat list of things. Investigation is where you actually work with them. Hollowpath's investigation workspace is asset-centric: select an asset, and its services, findings, and evidence narrow into view together — backed by a relationship index that answers “what do we already know about this” without re-deriving it from scratch on every click. Nothing about this step touches the network; it's entirely a view over what's already been collected.
Validate
Before anything gets acted on, it gets checked. URL verification confirms a discovered endpoint actually responds the way it appeared to. Service enumeration — SMB shares, content/directory discovery via ffuf — runs under explicit operator confirmation, never silently. Exploit candidates from SearchSploit and Metasploit are confidence-ranked against the detected service banner before they're ever presented as something to act on.
Exploit
Exploitation in Hollowpath only ever targets verified, in-scope lab hosts, and only ever after an explicit, multi-step confirmation — there is no single “fire” button. The scope engine enforces this at the code level: it will refuse to download or execute anything against a target outside the defined scope regardless of what a confirmation dialog shows. This is a deliberate, load-bearing design choice, not a UI nicety.
Document
Findings and evidence accumulate throughout the assessment — not just at the end. Every finding carries a category (observation, detection, or vulnerability), a severity, a confidence level, and a verification status, tracked as separate fields rather than collapsed into one score. When the assessment is ready to hand off, Hollowpath generates a structured Markdown or HTML report directly from that same data — see a real, generated example on the Reports page.
See what it produces
A real report, generated by Hollowpath’s actual reporting engine from a synthetic sample assessment.
View the sample report