Enter a domain or IP: resolution, subdomains, ports, services and risks — web baseline and probing are opt-in
Own assets only · selectable port range · three opt-in layers · every run stored for comparison
Port range
Common — Common exposure ports, usually done in seconds
All 1–65535 — Full sweep — slower, but nothing is missed
Custom — Use when the port you care about is not in the common list
A full sweep sends roughly 65,000 connection attempts and usually takes 1–3 minutes. Use it only on assets you own.
Subdomain discovery
Standard — Certificate, homepage links and a common-name dictionary — enough for most cases
Deep — Extended dictionary (~200 names), takes longer
Deep mode sends about 200 DNS queries to the target — use it only with confirmed authorization.
Subdomains are discovered by this site itself — the target’s certificate SAN entries, homepage links and DNS dictionary lookups. No third-party data source, no external scanning API.
Scan layers
Ports & services
Web security baseline — Read-only: security headers, cookie flags, CORS policy, exposed files, HTTPS redirect
Web vulnerability probing — Sends probe payloads to page parameters (read-only, no data changes), with evidence and confidence per finding
This layer sends probe payloads to form and link parameters (quotes, XSS markers, traversal strings). It only reads and checks reflections — no writes, no command execution. Use it only on your own assets.
Standard mode takes 15–40 s; full-port or probing runs take minutes — keep this page open
DNS lookup
Subdomains
Port scan
Service detection
Web baseline
Probing
Risk tagging
Findings
Redis without authentication
Database exposed to the internet
RDP exposed
Certificate expired
Cleartext protocol
Git directory exposed
Environment file exposed
HTTPS not enforced
Reflected cross-site scripting (XSS)
SQL injection (error-based)
I confirm this target is mine or I hold the owner’s written authorization
The timestamp, source IP and this exact statement are stored with the task as proof of authorization.
Port range selectable (common, all, custom). Web baseline and probing are optional and read-only. No UDP, no command injection or SSRF testing. Results are a snapshot — rescan after fixing.