Tool categories
Tools are grouped into seven categories based on their purpose in the testing workflow.Web reconnaissance
Web reconnaissance tools gather information about web targets without testing for vulnerabilities.
These tools generally do not generate findings. Their output is informational: technologies in use, hidden paths, WAF presence, or exposed contact data. The exception is Website Recon, which can also produce findings for detected technologies.
Network & cloud reconnaissance
Network and cloud reconnaissance tools map the infrastructure around your targets: domains, subdomains, virtual hosts, and open ports.
These tools do not generate findings. Their output is informational: lists of discovered domains, subdomains, hosts, and open ports.
Web vulnerability scanning
Web vulnerability scanners actively test web applications, APIs, and CMS platforms for security weaknesses. Most of these tools generate findings.The WordPress and Drupal scanners use version-based detection only. Because they identify vulnerabilities by matching component versions against known CVEs rather than actively confirming them, their findings are capped at high severity.
Network vulnerability scanning
Network vulnerability scanners assess infrastructure-level security, including network services, encryption, cloud configurations, and container orchestration.
Like web scanners, network scanners generate findings.
Offensive
Offensive tools validate and exploit discovered vulnerabilities rather than just detecting them.
Offensive tools do not generate findings. Sniper produces detailed reports with extracted artifacts (system information, users, screenshots, filesystem data). SQLi Exploiter extracts database contents.
XSS Exploiter and HTTP Request Logger work differently from the rest: they don’t scan a target. They create persistent callback endpoints for out-of-band testing, which listen for incoming requests triggered by payloads you inject during testing. They do not create scans or generate findings, and their endpoints remain active for 60 days.
What tools produce
Findings
Only vulnerability scanners generate findings: structured records of discovered security issues with severity ratings, descriptions, and remediation guidance. This includes all network vulnerability scanners and most web vulnerability scanners listed above. Offensive tools and utilities do not generate findings. Among reconnaissance tools, only Website Recon generates findings.Attack surface data
Only four tools populate your attack surface view:
No other tools contribute to the attack surface. To get a complete view of your external-facing infrastructure, run these four tools.
Scans
Most tools create a scan object when you run them: a trackable job with a lifecycle (Waiting, Running, Finished, etc.) and results you can revisit. Three tools are exceptions:- Google Hacking does not create a scan. It runs entirely in your browser by opening Google search tabs with pre-built dorks. No server-side execution happens.
- XSS Exploiter and HTTP Request Logger create persistent handler endpoints, not scans. They have no scan lifecycle. They listen for callbacks until they expire.
Scan types
Many tools support different scan depths that let you control the tradeoff between speed and thoroughness. See Scan types and depth for details on how Light, Deep, and Custom modes work. Not all tools follow this pattern:- Standard Light / Deep / Custom modes are available in tools such as Website Scanner, API Scanner, Network Scanner, Port Scanner, URL Fuzzer, WordPress Scanner, SSL/TLS Scanner, Kubernetes Scanner, Domain Finder, and Subdomain Finder.
- Single-mode tools include Virtual Hosts Finder, Website Recon, WAF Detector, People Hunter, Drupal Scanner, and Cloud Scanner.
- Sniper uses Unauthenticated / Authenticated modes instead
- Password Auditor uses Dictionary / Password Spray attack types instead
- SQLi Exploiter uses an Advanced toggle with Level and Risk settings
- XSS Exploiter and HTTP Request Logger have no scan modes since they don’t create scans
Pentest robots
Pentest robots are automation workflows that run multiple tools in sequence, passing data between steps. For example, a robot can run a Subdomain Finder, then feed discovered subdomains into a Website Scanner. Robots can be scheduled, shared with team members, and cloned.How to start a scan
You can start a scan from the app, the API, the MCP server, or theptt command-line tool. In the app, you start from either the New scan page or the Assets page.
In the app
From New scan
1
Click New scan
Go to New scan. The page has tabs: Quick start, Recon tools, Vulnerability scanners, Exploit tools, Utils, and Robots.
2
Find the tool
Open the tab that holds your tool, or use Quick find on the Quick start tab to search by name. The Quick start tab also lists the tools you use most. See the table below for where each tool is.
3
Select the tool
Click the tool’s card to open its page.
4
Configure and start
Enter the target, choose a scan type and any other options the tool offers, then click Start Scan.
XSS Exploiter and HTTP Request Logger used to be on the Handlers page. That page was removed from the sidebar, and you now open both tools from New scan > Exploit tools. They create handlers instead of scans. See Scans.
From the Assets page
Useful when you want to scan multiple assets at once with the same tool.1
Select the targets
On the Assets page, select one or more targets with the checkboxes.
2
Choose Tool
In the bar that appears, under Start new scans with, click Tool and pick a tool from the list. The list groups tools by category: Recon tools, Web vulnerability tools, Network vulnerability tools, Offensive tools, and Utils. You can also click Robot to use any of the existing robots. See Pentest robots for more details.
3
Start the scan
The tool opens with your selected targets filled in. Choose the scan type and options, then click Start Scan.
With the API
Send aPOST /scans request with the tool_id of the tool and your target. You need an API key from My account > API. API access is included in all paid plans. See Start a scan for the parameters and the tool_id of each tool.
With MCP
Connect an AI assistant to the MCP server and ask it to run a scan in plain language. The scanning tools arerun_website_scanner, run_subdomain_finder, and run_network_scanner. The scan tool can also start a scan on an existing target with start_by_targetid. See MCP tools for the parameters.
With the ptt CLI
Install the CLI withpip install pentesttools, then run a scan from your terminal:
website_scanner, subdomain_finder, network_scanner). Use --fail high to make the command fail when it finds vulnerabilities at or above that risk level, for example in a CI pipeline.
The same CLI is available as the pentesttoolscom/ptt-scan Docker image. See Generic CI/CD for a pipeline example.
Other ways to start scans
- Scheduled scans run a tool automatically at set intervals.
- Pentest robots run several tools in sequence.
- GitHub Actions and Generic CI/CD start scans from your pipeline.