Every page, tab & feature

The Dashboard is a read-only, at-a-glance summary of the engagement you are currently working in. It does not run anything itself — it reflects the findings and scans you have already gathered.

What each panel shows

• Findings by severity — how many critical / high / medium / low / info findings exist right now.
• Status — the split between open, confirmed, triaged and resolved findings.
• Findings over time — a trend line as findings accumulate during the test.
• Top hosts by risk — the hosts with the heaviest or most severe findings, so you know where to focus.
• Recent findings — the latest discoveries as they land.

How to use

1. Run scans and assessments elsewhere (Port Scan, Network Scan, Auto Assess, Checks, Injection, and so on).
2. Come back here to see the overall shape of the engagement without digging through raw results.
3. Use Top hosts by risk to pick your next target, then jump to Findings for detail.

The numbers follow the active engagement. Switch or start a new engagement on the Engagement page and the Dashboard repopulates from that engagement's data.

An Engagement is the container for one authorized test. It keeps scope, findings, scans and notes together so an assessment is a single, portable project you can save, reopen and hand off.

How to use

1. Fill in Name, Client / target org, Tester and Start date so the engagement and its report are properly labelled.
2. Record your Authorization reference — the statement of work, rules-of-engagement document or ticket that proves you are permitted to test. Keep the written authorization on file.
3. Use Engagement notes for methodology, testing windows, contacts and scope caveats.
4. Define Scope below: list in-scope targets, one per line, as IPs, CIDR ranges, hostnames or wildcards such as *.staging.example.com.
5. Turn on Enforce scope and click Apply scope to host so the native host blocks operations against anything out of scope. Use Test a host to check whether a target is covered.
6. Click Save as you go. Use Export .hydra to produce a single shareable file, and Import .hydra to reopen one.

Tips

• Scope enforcement is a guardrail against testing the wrong thing — set it before you start scanning.
• Generate Report turns the engagement's findings into a formatted deliverable.

Only test systems you are explicitly authorized to test. The authorization reference exists so that proof travels with the work.

Auto Assess chains several tools against a single host in one click: a port scan, then optional TLS audit, security-header grade, CVE lookup, templated checks and a default-credential test. Everything it finds is written straight into Findings with evidence.

How to use

1. Enter a Target host, or click Use discovered hosts to pull one in from a Network Scan.
2. Set the Ports to scan as the first step.
3. Tick the stages you want: TLS, Headers, CVE, Checks and Creds. Each adds time but more coverage.
4. Click Run Assessment. Watch the Progress panel as each stage completes.
5. When done, use View Findings to review results, or Generate Report to export them.

Continuous monitoring

• Monitor current target adds the host to a watch list; enable Continuous Monitoring to re-assess it on a schedule and surface changes over time.

The credential-test stage actively tries default logins. Only run it against systems you are authorized to test.

Templated Checks are active vulnerability checks defined as data rather than code: each template is a request plus one or more matchers (status code, word, regex or header). When a response matches, it becomes a finding with the matching evidence attached.

How to use

1. Enter the Target base URL or host:port the checks should run against.
2. Review the Template library and enable the checks you want to run.
3. Click Run enabled. Matches appear in Results and flow into Findings.

Managing templates

• Add template creates a new check — define the request and the matchers that decide a hit.
• Import JSON / Export all move template sets between engagements or share them with teammates.

Checks send real requests to the target. Keep them in scope and expect them to appear in the target's logs.

Automation Rules react to events during an engagement. When a trigger fires and the conditions match, the rule runs one or more actions. Rules are saved with the engagement and travel with it.

How to use

1. Turn on the master switch at the top to enable the automation engine.
2. Click New Rule (or Add from template for a ready-made one).
3. Choose a Trigger — for example a new finding or a newly discovered host.
4. Add conditions and set Match to all or any, to decide when the rule should fire.
5. Add actions: notify, call a webhook, auto-assess, change a finding's status or severity, create findings, or run any host operation.
6. Set a cooldown so the rule does not fire repeatedly, then Save. Use Test with sample event to dry-run it.

Tips

• Start with a template, then adjust its conditions — it is faster than building from scratch.
• The Activity panel logs every firing so you can see what automation has done.

The TCP Client opens one raw TCP connection and lets you exchange bytes directly — no protocol assumptions, no browser restrictions. It is the lowest-level building block for talking to a service by hand.

How to use

1. Enter a Host and Port (for example 127.0.0.1 and 6379 for a local Redis).
2. Click Connect. The output box shows the live session.
3. Type into Send and click Send. Use \r\n where the protocol needs a CRLF line ending, for example PING\r\n.
4. Click Disconnect when finished.

Good for

• Poking text protocols by hand (Redis, SMTP, HTTP, line-based services).
• Grabbing a banner, checking whether a port really speaks what you expect.
• Reproducing an exact byte sequence a higher-level client would hide from you.

The UDP page binds a local datagram socket so you can send packets to any destination and watch replies arrive. UDP is connectionless — there is no handshake, you simply send and listen.

How to use

1. Under Socket, set a Bind port (use 0 to let the OS pick one) and a Bind address (0.0.0.0 for all interfaces). Tick IPv6 if needed, then click Open.
2. Under Send datagram, enter the Destination host and port, type your Data, and click Send.
3. Replies appear under Received. Click Close to release the socket.

Notes

• Because UDP has no connection, a silent destination simply produces no reply — that is normal, not an error.
• Keep the socket open to catch asynchronous or delayed responses.

Port Scan runs a concurrent TCP-connect scan against a single host: it opens connections to each port in parallel and reports which are open, with optional banner grabbing and deeper service probing.

How to use

1. Enter a Target host.
2. Pick a Port profile, or type a custom Ports range such as 1-1024, 80,443 or 8000-8100.
3. Tune Timeout (how long to wait per port) and Concurrency (how many ports at once). Higher concurrency is faster but noisier.
4. Optionally tick Banner to read the first bytes each open port sends, and Deep for fuller service/version probing.
5. Click Scan. Use the show filter to narrow the results, and Cancel to stop early.

Tips

• Start with a small, fast profile to find live ports, then re-scan those with Deep probing.
• Save current as scheduled stores the settings to re-run later; Import loads results from a file.

A connect scan completes the TCP handshake and will appear in the target's logs. Scan only hosts you are authorized to scan.

Network Scan is a discovery sweep across a whole subnet or address range: it first finds which hosts are alive, then scans each live host's ports. It is how you map an unfamiliar network.

How to use

1. Enter a Target range as CIDR (192.168.1.0/24) or a dash range (10.0.0.1-50).
2. Choose Ports per host from the preset, or set it to custom and fill Custom ports.
3. Set Timeout and Concurrency for the sweep.
4. Pick discovery options: ICMP (ping), a UDP probe, -Pn to skip discovery and treat every address as alive, -O for OS fingerprinting, and -A for the aggressive full set.
5. Click Scan Network. When it finishes you can Auto-Assess alive hosts to chain a full assessment against everything found.

Tips

• -Pn is slower but finds hosts that block ping — useful on hardened networks.
• Results can be saved and restored via the backup selector, and imported/exported to a file.

Sweeping a subnet touches many hosts at once. Confirm the entire range is in scope before you run it.

Service Explorer probes a host's open ports to work out what is actually running behind them — service names, versions, shares and capabilities — rather than just which ports are open.

How to use

1. Enter a Target host.
2. In Ports, paste the open ports from a Port Scan, or type your own (for example 22,80,445,3389).
3. Click Probe to identify the services, or Scan + Probe to discover open ports first and then probe them in one step.

Tip

• Run a quick Port Scan first, then feed those ports here — probing only the open ones is much faster than probing everything.

The TLS / Certificate Inspector connects to a host and reports its full certificate chain, the negotiated protocol and cipher, and which TLS versions the host will accept. It flags expired, self-signed, weak-cipher and obsolete-protocol conditions.

How to use

1. Enter a Host and Port (443 for HTTPS, or the service's TLS port).
2. Optionally set SNI to inspect a specific virtual host; leave it blank to use the host name.
3. Click Inspect. Read the Summary, the TLS versions accepted matrix and the Certificate chain.

How to read it

• The version matrix enumerates TLS 1.0 through 1.3 by pinning each in turn.
• TLS 1.0 / 1.1 shown as "not tested" usually means the inspector's own OpenSSL cannot speak those old versions — it is a client limitation, not proof the server refuses them.
• Chain walking follows each certificate's issuer so you can spot an incomplete or misconfigured chain.

The Raw HTTP Workbench is the most capable page in HydraSocket. It sends the exact bytes you type over raw TCP or TLS, so you control the request line, every header and the body — including things a browser's fetch() refuses to send, such as a spoofed Host, conflicting length headers, or a malformed request line. The row of tabs across the top switches between a dozen related tools that all share the same request and response.

Projects & saving

Everything you do here belongs to a project — its saved requests, history and settings. Name the project and click Save Project, or move it between machines with Export / Import. This is separate from the engagement file and is meant for your request workbench specifically.

Request tab (the repeater)

This is where you craft and resend a single request and study the reply.

1. Paste a full URL and click Apply to fill the Host, Port, TLS flag and request line, or set those fields by hand. Tick Follow redirects to chase 3xx hops and see the whole chain.
2. Pick a starting point from Template and a User-Agent from the dropdown, or use a method button (GET, POST, PUT, DELETE, PATCH, OPTIONS, HEAD) to scaffold the request line.
3. Edit the raw request in the editor. Line feeds are shown as LF but sent as CRLF, so the bytes on the wire are exactly what the protocol expects.
4. Click Send. If you changed the body, click Fix C-L first to recompute Content-Length. Use the inline encode/decode buttons (B64 Enc/Dec, URL Enc/Dec) on a selection without leaving the editor.

Reading the response. Switch views with the tabs over the response pane: Pretty (formatted, JSON pretty-printed), Headers, Cookies, Security (flags missing or weak security headers), Raw and Hex. A timing bar breaks the request into DNS, connect, TLS and time-to-first-byte. Use the search box to find and highlight text in the body.

Pulling values out. JSON Path extracts a value by path (for example data.items[0].name, or . for the whole document). Extract rules capture text with a regex and a capture group (for example token=([a-zA-Z0-9]+)) and name it, so you can reuse it. Diff compares the current response against another.

Taking the request elsewhere. Copy it as a curl, fetch or Python snippet, Save it, send it to Hydra for fuzzing, or to the Comparer. The History list keeps every request you send — filter it, diff two entries, or clear it.

Hydra tab (payload fuzzer / intruder)

Hydra sends the same request many times with a changing payload, so you can brute-force a parameter, enumerate values, or spray a wordlist and spot the responses that stand out.

1. Set the Host, Port and TLS, then write the request in the template and mark the insertion point with §§ (two section signs). Everything else stays fixed; only that marker is replaced each round.
2. Choose a Payload source: a built-in list, a numeric range (From / To / Step), or your own payloads typed one per line. Tick URL-encode to encode each payload before it goes in.
3. Set Concurrency for speed, and a Grep/Match regex (for example admin|error|password) to flag interesting responses.
4. Click Start. Results show status, length and timing per payload. Tick Hide baseline to drop responses identical to the control request, so only anomalies remain, and use the filter box to narrow further. Open any row to resend it in the Request tab.

Sequencer tab (multi-step chains)

The Sequencer runs several requests in order and carries values from one step into the next — the way a real login-then-act flow works.

1. Click Add step for each request and fill in its host, port, TLS and raw request.
2. On a step, define Extractions: a name, which part of the response to read, and a regex with a capture group (for example csrf_token=([a-f0-9]+)). The captured value becomes a variable later steps can reference.
3. Click Run sequence to execute the steps in order and see each response.

Typical use: step 1 fetches a page and extracts a CSRF token or session id, step 2 submits a form using it.

Comparer tab

Send two full requests, A and B (each with its own host/port/TLS), and click Compare to diff the responses side by side. Good for seeing exactly what changes when you flip one header, parameter or cookie.

Auto-scan tab

Point it at a Host, Port, TLS flag and base Path and click Run scan for an automated pass over the endpoint. Findings flow into the Findings page. Use Cancel to stop a long run.

Multi tab (repeat & rate-limit)

Resend one request many times to test idempotency, race conditions or throttling.

1. Set host/port/TLS, paste a request (or click Copy from Request tab), set a Count and a per-send Delay, and click Send Multi.
2. The Rate Limit Test fires a burst at the target and reports how and when the server starts throttling or blocking.

WebSocket tab

Open and drive a WebSocket connection by hand.

1. Set Host, Port, TLS (for wss) and Path. Add subprotocols in Protocols and any handshake headers (such as an Authorization header) in Extra headers, one per line.
2. Click Connect, then send frames: Send text, Send binary (your box content is base64-decoded first), or Ping. The log shows every frame in and out; Clear log empties it.

Encoder tab

A quick scratchpad for transforming data without leaving the workbench. Put text in Input, build a chain with Add step, and the result appears in Output. Swap I/O feeds the output back as input for layered encodings. (The full Encoder / Crypto Toolkit has its own page for heavier work.)

JWT tab

Inspect and manipulate JSON Web Tokens.

1. Paste a token, or pull one with Extract from last response or Paste from clipboard, then Decode to see the header and payload.
2. Edit the Header or Payload JSON, enter a Secret / Key, and Re-sign (HMAC) or Verify the signature.
3. The Attack Tools produce test variants for servers that validate tokens incorrectly: alg:none (unsigned), alg confusion (RS→HS), Remove exp (no expiry), Null signature, and kid / jku header injection.
4. Brute-force a weak HMAC secret by supplying a wordlist, one candidate per line.

Hash tab

Identify Hash guesses a hash's type from its format, and Generate All hashes your input in every algorithm. The Dictionary Crack section tries each line of a wordlist against a target hash of a chosen type.

Macro tab

Record a run of requests and replay them as one unit — handy for re-establishing a session before a test. Record, send your requests, Stop Recording, then Play All. Add Extraction Rules so a value from one step feeds the next. Macros Export and Import to a file.

OpenAPI tab

Turn an API spec into ready-made requests. Fetch a spec by URL, Upload a file, or paste the JSON, then Parse & Import to load every endpoint as a request you can send and fuzz.

Toolbar helpers (shared across tabs)

• Env — define variables you can reference inside requests, so one change updates every request that uses it.
• Cookies — a cookie jar that can auto-inject matching cookies into outgoing requests.
• Auth — build an Authorization header for Basic, Bearer, API-key, Digest or AWS SigV4 and insert it. Vault fills credentials from the shared store on the Config page.
• GraphQL — helpers for crafting GraphQL requests (the GraphQL Explorer page covers introspection).
• Smuggle — insert a request-smuggling template (conflicting Content-Length / Transfer-Encoding) to see how a server resolves an ambiguous request length.
• CORS — probe the target's cross-origin policy with preflight and request-header tests.
• Paraminer — discover hidden parameters an endpoint silently accepts.

This page can send malformed, ambiguous and high-volume requests on purpose. Several tools (smuggling, fuzzing, rate-limit bursts) are intrusive and will show up in the target's logs. Use it only against systems you are explicitly authorized to test.

The DNS Toolkit queries any record type, reverse-resolves IP addresses, targets a specific resolver, queries over DNS-over-HTTPS, sweeps a range of PTR records, and can attempt a zone transfer (AXFR).

How to use

1. Enter a Name / IP — a domain for forward lookups, an IP for a reverse lookup.
2. Pick a record Type (A, AAAA, MX, TXT, NS, CNAME, SOA, and so on).
3. Optionally set a Server (resolver IP) to query a specific server; this is required for a zone transfer.
4. Click Query.

DNS depth

• DoH query runs the lookup through a DNS-over-HTTPS provider — useful when local DNS is filtered.
• Reverse sweep resolves PTR records for every address in a CIDR or dash range, to map names across a subnet.

A zone transfer (AXFR) pulls an entire zone and should only be attempted against servers you are authorized to query.

The Recon page gathers passive and light-touch intelligence about a target: subdomains, security-header grades, LAN multicast discovery, site structure, WHOIS/ASN data, known CVEs, WAF presence and dangling-subdomain takeover risks. Switch tools with the buttons across the top.

Tools

• Subdomains — enter a domain, optionally include Certificate Transparency logs and a brute-force pass, and enumerate names.
• Security headers — fetch a URL and grade its security headers.
• Multicast (LAN) — send SSDP/mDNS/LLMNR probes on the local network and list what answers.
• Spider — crawl a site from a start URL, bounded by max pages, depth and same-origin.
• WHOIS / ASN — registration and network-ownership data for a domain or IP.
• CVE Lookup — search known vulnerabilities by product/version or CVE id.
• WAF Detect — fingerprint any web application firewall in front of a target.
• Takeover — check one or many subdomains for takeover-able dangling records.

Tip

• Certificate Transparency often reveals subdomains that brute force misses — enable both for the widest coverage.

The Intercepting Proxy is a man-in-the-middle for HTTP and HTTPS. Point a browser at it to capture, pause, edit and replay requests and responses, apply match-and-replace rules automatically, and capture WebSocket frames.

Getting started

1. Set a Listen port and Bind address, then click Start proxy.
2. Click Download CA certificate and install/trust it, so HTTPS can be decrypted without browser warnings.
3. Configure your browser to use this host and port as its HTTP(S) proxy. Traffic now appears under HTTP flows.

Intercepting

1. Set a Scope (comma-separated host substrings) to limit which traffic you act on.
2. Tick Intercept (requests) and/or responses to pause matching traffic. Use the breakpoint fields to break only on certain methods, paths, statuses or content types.
3. When a request is held, edit it and click Forward edited, send it unchanged with Forward, or Drop it.

Automation & replay

• Match & Replace rules rewrite traffic on the fly — click Apply rules to host to activate them.
• Select a captured flow to Repeat it, send it to the HTTP tab, or open the built-in Repeater.

Decrypting HTTPS requires installing a CA certificate on the test machine. Do this only on machines and traffic you are authorized to intercept, and remove the certificate afterwards.

Pivot / Tunnel lets tools and browsers reach networks that only the host machine can see. Run a SOCKS5 proxy for dynamic access, or set up static local port-forwards in the style of ssh -L.

SOCKS5 proxy

1. Set a Port and Bind address, then click Start.
2. Point a browser or tool at this host and port as a SOCKS5 proxy; its traffic now exits through the host machine.

Local port-forward

1. Set a Local port to open on this machine.
2. Enter the Remote host and Remote port the forward should reach.
3. Click Forward. Connecting to the local port now tunnels to that remote destination.

Pivoting bridges network segments and is a high-impact capability. Use it only within the boundaries of an authorized engagement.

The Listener binds a local TCP or UDP port and captures whatever connects to it. Use it to test callbacks, verify egress/firewall rules, or run a tiny honeypot. It can send a canned reply to each connection.

How to use

1. Choose a Protocol (TCP or UDP), a Bind port and a Bind address.
2. Click Start. Anything that connects, and any data it sends, appears under Capture.
3. Optionally set a Reply (use \r\n for CRLF), pick a Target connection, and click Send to respond.
4. Click Stop when finished.

Good for

• Confirming an out-of-band callback actually reaches you.
• Checking which outbound ports a host is allowed to use.

The FTP Client connects to an FTP or FTPS server, browses directories and downloads files.

How to use

1. Enter the Host, Port (usually 21), User and Password. Use anonymous as the user for anonymous access.
2. Tick TLS for FTPS, then click Connect.
3. Navigate with the directory view: edit the path and press Enter, or use Up and Refresh.
4. To fetch a file, enter its name in Remote filename and click Download.

The SSH Terminal gives you a real interactive shell over SSH, backed by a persistent PTY on the remote host — not a one-shot command runner. Authenticate with a password or an identity key.

How to use

1. Enter the Host, Port (usually 22) and User.
2. Provide a Password, or leave it blank and set an Identity key path (for example ~/.ssh/id_ed25519).
3. Click Connect, then type in the terminal as you would in any shell.
4. Use ^C to interrupt a running command and Clear to clear the view.

The SMB File Browser connects to Windows network shares over SMB/CIFS and lets you walk their directories.

How to use

1. Enter the Host (\\server or an IP) and the Share name (for example C$).
2. Supply a User (optionally domain\user) and Password, then click Connect.
3. Browse with the path bar: edit and press Enter, or use Up and Refresh.

The Mail page tests mail servers over raw TCP: SMTP open-relay and user enumeration (VRFY / EXPN / RCPT), a STARTTLS check, and IMAP/POP3 banner grabs.

How to use

1. Enter the Host and Port (25/465/587 SMTP, 143/993 IMAP, 110/995 POP3) and choose the Protocol. Tick TLS to connect securely or attempt STARTTLS.
2. Banner / probe connects and reads the server's banner and capabilities.
3. For SMTP, list candidate Users and click Enumerate users to see which exist, or Open-relay test to check whether the server relays mail for an outside sender.

Relay and enumeration tests interact with a live mail server. Only run them against servers you are authorized to test.

The MQTT Client connects to an MQTT 3.1.1 broker to test anonymous access, subscribe to topics and publish messages — useful for IoT exposure testing.

How to use

1. Enter the Broker host and Port (1883 plain, 8883 TLS), and a Username/Password if required.
2. Set a Topic filter (# matches everything) and how long to Listen, then click Connect & Subscribe.
3. Incoming messages appear under Messages. To publish, enter a payload and click Publish.

Tip

• If an anonymous subscribe to # succeeds, the broker is exposing all topics without authentication — a finding worth recording.

The Modbus Client reads data from PLCs and other industrial (ICS) devices over Modbus/TCP. It is read-only — it does not write to devices.

How to use

1. Enter the Host and Port (usually 502) and the Unit ID (slave address).
2. Choose a Function: coils, discrete inputs, holding registers or input registers.
3. Set the Start address and Count, then click Read.

Industrial devices can be fragile. Even read requests should only go to equipment you are authorized to touch.

The LDAP Browser binds to an LDAP or Active Directory server and searches the directory tree.

How to use

1. Enter the Host and Port (389 for plain LDAP, 636 for LDAPS).
2. Set the Bind DN (for example cn=admin,dc=example,dc=com) and its Password; tick TLS for LDAPS. Click Bind.
3. Under Search, set a Base DN, an LDAP Filter (for example (objectClass=user)) and a Scope, then click Search.

Tip

• Scope base reads a single entry, one level reads direct children, and subtree walks everything beneath the base DN.

The SNMP Walker reads management data from network devices by walking OID trees.

How to use

1. Enter the Host and Port (usually 161), a Community string (for example public) and the Version.
2. Set a starting OID (for example 1.3.6.1.2.1 for MIB-2) and a Max results cap.
3. Click GET for a single OID or Walk to read the whole subtree. Use Stop to end a long walk.
4. Filter the results and export them as CSV.

The Databases page connects to SQLite, PostgreSQL, MySQL/MariaDB, SQL Server, MongoDB, Redis and Elasticsearch/OpenSearch, then lets you browse objects, page through rows and run queries. Connections are saved locally for reuse.

How to use

1. Click New, or use a Quick connect shortcut for a common engine.
2. Pick a Driver; the form changes to match it. Fill in host, port, user, password and database — or paste a full Connection URL, which overrides the individual fields.
3. For TLS, tick SSL, and Trust cert if the certificate is self-signed.
4. Click Test connection to validate, then Save & connect.
5. Use the object list to Browse tables/collections, or switch to Query, write SQL (or the engine's own command syntax for Mongo/Redis) in the editor, and click Run query.
6. Page through results with Prev / Next, and filter rows with the row filter boxes.

Tips

• SQLite accepts :memory: for a throwaway in-memory database.
• Redis uses a numeric DB number; Elasticsearch can authenticate with an API key instead of user/password.

The Cloud (S3) page connects to Amazon S3 or any S3-compatible object store — MinIO, Wasabi, Cloudflare R2, DigitalOcean Spaces — and lets you list buckets and objects and preview or export their contents.

How to use

1. Enter the Endpoint (s3.amazonaws.com for AWS, or host:port for a self-hosted store) and a Region.
2. Provide the Access key ID and Secret access key. Add a Session token only for temporary STS credentials.
3. Tick Path-style for stores like MinIO that require it, SSL for HTTPS, and Trust cert for self-signed endpoints.
4. Click Connect & list buckets, then browse into a bucket. Use Load more to page through large listings.
5. Preview an object's content inline, or use CSV to export the listing.

Tips

• If a connection to AWS fails, check the region first — it is the most common mistake.
• Path-style vs. virtual-hosted addressing is the usual culprit when a compatible store will not list.

The Findings Dashboard is the central record of everything the toolkit has discovered — open ports, vulnerabilities, exposed secrets and header issues. From here you triage, enrich and export results.

How to use

1. Use the filter box and the severity and status dropdowns to narrow the list.
2. Enrich CVEs looks up detail for findings that reference a product and version.
3. Generate Report produces a formatted deliverable; the Export buttons output JSON, Markdown, SARIF, Jira CSV or create GitHub Issues.
4. Import External Scans pulls in results from other tools — choose the format and import the file.
5. Kill Chain / Attack Tree builds a chained view from the current findings to show how they combine.

Tip

• SARIF output drops straight into code-scanning dashboards; Jira CSV and GitHub Issues feed ticketing — pick whichever matches the client's workflow.

Network Topology draws a visual map of the hosts you have discovered and the connections between them, built from your scan data.

How to use

1. Run scans so there is data to map.
2. Click Refresh from Scans to (re)build the map.
3. Use Export SVG to save the diagram for a report.

Tip

• The Discovered Hosts list beside the map is a quick index into what the diagram shows.

The Diff Scanner compares two scan runs side by side so you can spot infrastructure changes — new or closed ports, new hosts and changed services — between a baseline and a later scan.

How to use

1. Put the earlier run in Scan A (Baseline) — paste results JSON or click Load from Saved.
2. Put the later run in Scan B (Current) the same way.
3. Click Compare Scans. The Differences panel highlights what changed.

Good for

• Re-tests — showing exactly what moved since the last assessment.
• Change monitoring — catching a newly exposed service.

The PCAP Viewer loads a capture file (or captures live with Npcap) and analyses it: per-protocol statistics, packet detail, hex, reassembled TCP streams, DNS and HTTP views, conversations and a geographic map of traffic.

Loading a capture

1. Click Open .pcap File and choose a .pcap or .pcapng file.
2. Explore with the panels: Protocol Statistics, Packets (filter by ip/port/protocol), Packet Detail, Hex Dump, Conversations, DNS Queries, HTTP Requests and TCP Streams.
3. GeoIP enrich adds location data for the IPs; Export CSV saves the packet list.

Live capture (Npcap)

1. Click Detect interfaces (use the admin variant to see them all) and set the Interface.
2. Set a Duration and Max packets, build a filter with the condition buttons, or edit the Generated filter directly as BPF.
3. Click Start capture (requires admin) and Save capture when done.

Live packet capture needs elevated privileges and records real traffic. Capture only on networks you are authorized to monitor.

The Encoder / Crypto Toolkit encodes, decodes, hashes and encrypts data, and can chain several transforms so the output of one feeds the next.

How to use

1. Type or paste into Input.
2. Pick a Transform and click Apply to run it once, or Chain to add it as the next step in a pipeline.
3. For transforms that need one, supply a Key / Passphrase.
4. Build up the Transform Chain, then click Run Full Chain. Use Swap to move output back to input, and Copy to grab the result.

Tip

• Chaining is ideal for layered encodings — for example URL-decode, then Base64-decode, then pretty-print.

The Credential Tester checks default and common credentials against a discovered service, to find accounts that were never changed from their shipped defaults.

How to use

1. Enter the Host and Port and choose the Protocol / service.
2. Pick a built-in Wordlist, or paste your own user:password pairs (one per line) into the custom list.
3. Click Start Test. Successful logins appear under Results; use Stop to end early.

This tool actively attempts logins and can lock accounts out. Run it only against services you are authorized to test, and mind account-lockout policies.

The GraphQL Explorer introspects a GraphQL endpoint, browses its schema and runs queries with variables.

How to use

1. Enter the endpoint URL and, if needed, an Authorization header (or fill it from the vault).
2. Click Introspect to pull the schema; browse types in the Schema Browser and filter them.
3. Write a query (or insert a Template) in the Query box, add Variables as JSON, and click Run Query.

Tip

• If full introspection is disabled, the templates for listing types and fields can still tease out parts of the schema.

The Injection Scanner actively tests one request for injection flaws: SQL injection (error, boolean-blind and time-blind), reflected XSS, server-side template injection, OS command injection, local file inclusion / path traversal and open redirect. You mark where payloads go with the marker INJECTX.

How to use

1. Choose a Method and enter a URL, placing INJECTX at the point to test, for example https://host/page?id=INJECTX.
2. If testing a body or a header, put INJECTX there too, and add any extra headers (such as a session cookie) one per line.
3. Tick the vulnerability classes to test: SQLi, XSS, SSTI, Cmd, LFI, Redirect.
4. Click Scan. Confirmed issues appear under Results and flow into Findings.

Tip

• You can load a request template captured during attack-log review, so the scan reuses a real, working request rather than one you build by hand.

This is an active scanner that sends real attack payloads. Only run it against applications you are explicitly authorized to test.

The Secrets Scanner fetches a page, crawls the JavaScript it links to, and flags exposed API keys, tokens and credentials by pattern. Matches are redacted (shown as first4***last4) and recorded as findings.

How to use

1. Enter a Target URL.
2. Set Max JS files to cap how many linked scripts it crawls.
3. Click Scan. Anything that looks like a secret appears under Exposed secrets.

Tip

• Front-end bundles are a common place for keys to leak — raising the JS-file cap finds secrets buried in large apps.

Local Attack Surface examines this machine — the one running the host — to show what is exposed and risky: listening ports with their owning process, a secret/sensitive-file scan, file hashing and network configuration.

How to use

• Listening ports — click Scan to list open local ports and the process that owns each one.
• Secret & sensitive-file scan — enter an absolute directory path and click Scan to flag secrets and sensitive files under it.
• File hash — enter a file path and click Hash to compute its hashes.
• Network config — click Load to read this machine's interfaces, routes and DNS.

Good for

• Checking your own testing box before and after an engagement.
• Confirming nothing unexpected is listening on the host.

The Host Log is a live stream of what the native host process is doing. It is the place to watch operations happen and to diagnose errors.

How to use

• Lines stream in as the host works. Tick Auto-scroll to stay pinned to the newest line.
• Click Clear to empty the view.

Tip

• If an operation on another page fails silently, check here first — the underlying error is usually logged.

The Configuration page shows the host settings read when the extension connects, and is where you manage webhooks, stored credentials, updates and the audit log.

Sections

• Paths — the file locations the host uses.
• Webhooks — add endpoints that automation rules and notifications can call.
• Auth Vault — store credentials once and reuse them across the HTTP and GraphQL tools.
• Updates — check for and download a newer version of the host/extension.
• Audit Log — export a record of operations the host has performed.

Tip

• Export the audit log at the end of an engagement — it documents exactly what was run and when.