Assets

Assets and targets

Pentest-Tools.com uses two related concepts for organizing what you scan:

Concept	Description	Example
Asset	A top-level resource you add to the platform. Assets are the unit for subscription limits.	`example.com`, `192.168.1.1`
Target	A specific scannable item associated with an asset. Tools run scans against targets.	`https://example.com/app`, `https://example.com/api/v1`

Your subscription limits how many assets you can add and how many assets you can scan each month. One asset can have multiple targets, all counted under that single asset. See How targets count toward your limits.

When you add a target, the platform automatically creates or associates it with the appropriate asset:

You provide a target: For example, https://example.com/app
The system extracts the asset: The hostname example.com becomes the asset
Target links to asset: The URL target is associated with the example.com asset
Scans run on the target: Tools scan the specific URL you provided

Example: One asset, multiple targets

For the asset example.com, you might have these targets:

Target	Type
`example.com`	Hostname
`https://example.com/`	URL
`https://example.com/app`	URL
`https://example.com/api/v1`	URL

All of these targets belong to the single example.com asset, counting as one asset toward your subscription limit.

Adding a single target

Navigate to Assets

Go to Assets from the main navigation.

Click Add target

Click the Add target button in the top right.

Enter target details

Provide the target (domain, IP address, or URL) and an optional description.

Configure alive check (optional)

Enable Include only alive targets to verify the target is reachable before adding it. See Check alive for details.

Add the target

Click Add to create the target. The asset is created automatically.

Supported target formats

Format	Example	Asset created
Domain	`example.com`	`example.com`
Subdomain	`api.example.com`	`api.example.com`
`www` hostname	`www.example.com`	`example.com`
IP address	`192.168.1.1`	`192.168.1.1`
URL	`https://example.com/app`	`example.com`
URL with port	`https://example.com:8443/admin`	`example.com`
IP range (CIDR)	`192.168.1.0/24`	Individual IPs
IP range (dash)	`192.168.1.1-100`	Individual IPs

CIDR notation supports masks from /24 to /30. Masks outside this range are rejected.

Different tools accept different target types. For example, the Website Scanner requires a URL, while the Port Scanner accepts hostnames or IP addresses.

Importing multiple targets

You can import targets from a file or from AWS.

Import from file

Import targets from a .txt file with one target per line. Optionally include descriptions after a comma.

Open import dialog

Click the Import button and select From file.

Prepare your file

Create a text file with targets and optional descriptions:

www.example.com, Production website
dev.example.com, Development server
staging.example.com, Pre-prod environment
192.168.1.0/24, Production network range
10.10.0.1-255, Internal servers

Upload and configure

Select your file and optionally enable Include only alive targets to filter unreachable hosts. See Check alive for details.

Import

Click Import. You’ll receive a notification when the import completes.

For IP ranges, enable the alive check to avoid adding offline hosts. This takes longer but keeps your asset list cleaner.

Import from AWS

If you have an AWS integration configured, you can import targets from your AWS infrastructure.

Click Import and select From AWS
Choose your AWS integration
Select the resource types to import
Click Import

AWS import requires a configured AWS integration. See AWS integration for setup instructions.

Managing assets and targets

Editing targets

You can update the description of existing targets:

Find the target in your asset list
Click the Edit description button
Update the description
Click Save

Moving targets between workspaces

Move targets to a different workspace to reorganize your work:

Select one or more targets
Click Move
Choose the destination workspace
Confirm the move

Moving a target also moves its associated scan history and findings to the new workspace.

Exporting assets

Export your assets and targets to a CSV, XLSX, or JSON file whenever you need it. You can export from both the grouped and ungrouped views of the Assets page.

Select the targets

On the Assets page, select the targets you want to export. The checkbox in the table header selects only the targets on the current page. To include all targets across every page, click the select-all button that appears above the table, Select all x targets in the current workspace.

Click Export selected

Click Export selected above the table. The button shows how many targets are selected.

Choose fields and format

In the Export assets dialog, choose the fields to include and the file format. See Export fields and formats.

Export and download

Click Export. The file is generated in the background, and you get a toast when it’s ready. Click Download export in the toast, or download the file later from the Reports page.

The Assets page shows the current workspace by default, so select-all covers only that workspace. To export targets from every workspace, first open the three-dots menu at the top right of the table and turn on Show all workspaces (Show all owned workspaces if your account has team members). Then select all.

Exports are stored on the Reports page for 30 days. After that, they are deleted and you need to export again.

Export fields and formats

Field	What it contains
Target name	The target, for example `example.com` or `https://example.com/app`
Target description	The description you added to the target
Target type	The type of the target, such as hostname, IP address, or URL
Workspace	The workspace the target belongs to
Risk level	The target’s current risk level
Scans	The number of scans run on the target

By default, the dialog pre-selects the fields that match the columns currently shown in the table. Select at least one field to export.

Format	Description
CSV	Comma-separated values, with a header row (default)
XLSX	Excel spreadsheet, with a header row
JSON	A `data` list with one entry per target, plus a `metadata` section with the export time, the total number of targets, and counts by target type and risk level

You can also export your scheduled scans the same way.

Deleting assets and targets

Deleting an asset removes all associated targets, scans, findings, and attack surface data permanently. This action cannot be undone.

Use Group by asset to see assets as top-level rows and act on them directly.

To delete targets (keeping the asset)

Select the specific targets you want to remove
Click Delete
Confirm the deletion

To delete an entire asset

Select the asset
Click Delete
Confirm that you want to delete the asset and all its targets

Asset discovery

Some tools find new items as a side effect of scanning:

Subdomain Finder discovers subdomains under your domain asset
Website Recon identifies web technologies, CMS platforms, and frameworks
Port Scanner finds services that may expose web interfaces

Discovered items appear in the scan results. Results from Website Recon and Port Scanner are also merged into the attack surface view automatically. To add discovered subdomains or hosts as targets, add them manually from the scan results.

Use the attack surface view to see all discovered hosts, ports, and technologies across your scans.

After a Subdomain Finder, Domain Finder, or Virtual Hosts Finder scan, you can add discovered items directly to your asset inventory. Select the rows you want in the results table and click Add to assets. Optionally enable Include only alive targets to filter out unreachable hosts before adding them.

Check alive

When adding or importing targets, you can enable the Include only alive targets option to filter out unreachable hosts before they’re added to your workspace.

When to use it

The alive check is useful when:

You’re importing an IP range and want to skip offline hosts
You’re scanning an internal network with unused IP addresses in a CIDR block
You want to confirm hosts are reachable before adding them

The alive check takes longer than adding targets directly, but results in a cleaner asset list with only reachable hosts.

How it works

The platform uses a customized version of Nmap’s host discovery to determine if a target is alive. Multiple probe types are sent to maximize detection accuracy, as different network configurations and firewalls may block certain traffic.

ICMP probes

Echo request: Sends ICMP type 8 packets expecting echo replies. Often blocked by firewalls but reliable on internal networks.
Timestamp request: Sends ICMP queries expecting reply code 14. Useful when echo requests are blocked.
Netmask request: Sends ICMP queries expecting reply code 18. Another alternative when echo requests are blocked.

TCP probes

SYN probes: Sends empty TCP packets with the SYN flag to the top 100 ports.
ACK probes: Sends TCP packets with ACK flags, expecting RST responses.

UDP probes

Sends UDP packets to common ports (53, 113, 161, 162, 497, 40125). An ICMP “port unreachable” response indicates the host is alive. This bypasses firewalls that only filter TCP traffic.

IP protocol ping

Sends IP packets with various protocol numbers (ICMP, IGMP, IP-in-IP, TCP, SCTP) to detect hosts that respond to specific protocols.

Source port spoofing

Uses port 53 (DNS) as the source port to bypass poorly configured firewalls that permit traffic based on source port.

Asset limits

Your subscription includes limits for both added assets and scanned assets. These limits apply across all your workspaces and are shared among all team members on your account. For detailed information about how asset limits work, see Assets and limits.

Best practices

Use descriptive names

Add meaningful descriptions to targets so you and your team can quickly identify what each one represents.

Organize with workspaces

Group related assets in workspaces by project, client, or environment. This makes it easier to manage large inventories.

Clean up regularly

Remove decommissioned targets and assets to keep your inventory current and make room for new additions.

Use alive checks for imports

When importing large lists (especially IP ranges), enable the alive check to filter out unreachable hosts automatically.

Assets and limits: How assets affect your subscription
Workspaces: Group assets by project or client
Attack surface overview: View all discovered targets
AWS integration: Import targets from AWS

Intro

Core

Tools reference

Capabilities

AI

Account & billing

Assets and targets

Example: One asset, multiple targets

Adding a single target

Supported target formats

Importing multiple targets

Import from file

Import from AWS

Managing assets and targets

Editing targets

Moving targets between workspaces

Exporting assets

Export fields and formats

Deleting assets and targets

To delete targets (keeping the asset)

To delete an entire asset

Asset discovery

Check alive

When to use it

How it works

Asset limits

Best practices

​Assets and targets

​Example: One asset, multiple targets

​Adding a single target

​Supported target formats

​Importing multiple targets

​Import from file

​Import from AWS

​Managing assets and targets

​Editing targets

​Moving targets between workspaces

​Exporting assets

​Export fields and formats

​Deleting assets and targets

​To delete targets (keeping the asset)

​To delete an entire asset

​Asset discovery

​Check alive

​When to use it

​How it works

​Asset limits

​Best practices

​Related topics

Assets and targets

Example: One asset, multiple targets

Adding a single target

Supported target formats

Importing multiple targets

Import from file

Import from AWS

Managing assets and targets

Editing targets

Moving targets between workspaces

Exporting assets

Export fields and formats

Deleting assets and targets

To delete targets (keeping the asset)

To delete an entire asset

Asset discovery

Check alive

When to use it

How it works

Asset limits

Best practices

Related topics