Tool categories
Tools are grouped into seven categories based on their purpose in the testing workflow.Web reconnaissance
Web reconnaissance tools gather information about web targets without testing for vulnerabilities.
These tools generally do not generate findings. Their output is informational: technologies in use, hidden paths, WAF presence, or exposed contact data. The exception is Website Recon, which can also produce findings for detected technologies.
Network & cloud reconnaissance
Network and cloud reconnaissance tools map the infrastructure around your targets: domains, subdomains, virtual hosts, and open ports.
These tools do not generate findings. Their output is informational: lists of discovered domains, subdomains, hosts, and open ports.
Web vulnerability scanning
Web vulnerability scanners actively test web applications, APIs, and CMS platforms for security weaknesses. Most of these tools generate findings.The WordPress and Drupal scanners use version-based detection only. Because they identify vulnerabilities by matching component versions against known CVEs rather than actively confirming them, their findings are capped at high severity.
Network vulnerability scanning
Network vulnerability scanners assess infrastructure-level security, including network services, encryption, cloud configurations, and container orchestration.
Like web scanners, network scanners generate findings.
Offensive
Offensive tools validate and exploit discovered vulnerabilities rather than just detecting them.
Offensive tools do not generate findings. Sniper produces detailed reports with extracted artifacts (system information, users, screenshots, filesystem data). SQLi Exploiter extracts database contents. Subdomain Takeover reports which subdomains are vulnerable to takeover.
Exploit handlers
Exploit handlers are callback endpoints for out-of-band testing. Unlike other tools, they don’t scan a target. They create persistent URLs that listen for incoming requests triggered by payloads you inject during testing.
Exploit handlers do not create scans or generate findings. They create handler endpoints that remain active for 60 days, capturing callbacks from vulnerable targets.
Utilities
Utility tools perform basic network checks and lookups.
Utility tools produce raw output and do not generate findings.
What tools produce
Findings
Only vulnerability scanners generate findings: structured records of discovered security issues with severity ratings, descriptions, and remediation guidance. This includes all network vulnerability scanners and most web vulnerability scanners listed above. The Joomla Scanner is an exception: it returns raw output rather than structured findings. Offensive tools, exploit handlers, and utilities do not generate findings. Among reconnaissance tools, only Website Recon generates findings.Attack surface data
Only four tools populate your attack surface view:
No other tools contribute to the attack surface. To get a complete view of your external-facing infrastructure, run these four tools.
Scans
Most tools create a scan object when you run them: a trackable job with a lifecycle (Waiting, Running, Finished, etc.) and results you can revisit. Three tools are exceptions:- Google Hacking does not create a scan. It runs entirely in your browser by opening Google search tabs with pre-built dorks. No server-side execution happens.
- XSS Exploiter and HTTP Request Logger create persistent handler endpoints, not scans. They have no scan lifecycle. They listen for callbacks until they expire.
Scan types
Many tools support different scan depths that let you control the tradeoff between speed and thoroughness. See Scan types and depth for details on how Light, Deep, and Custom modes work. Not all tools follow this pattern:- Standard Light / Deep / Custom modes are available in tools such as Website Scanner, API Scanner, Network Scanner, Port Scanner, URL Fuzzer, WordPress Scanner, SSL/TLS Scanner, Kubernetes Scanner, Domain Finder, and Subdomain Finder.
- Single-mode tools include Virtual Hosts Finder, Website Recon, WAF Detector, People Hunter, Drupal Scanner, Joomla Scanner, SharePoint Scanner, Cloud Scanner, Subdomain Takeover, ICMP Ping, and WHOIS Lookup.
- Sniper uses Unauthenticated / Authenticated modes instead
- Password Auditor uses Dictionary / Password Spray attack types instead
- SQLi Exploiter uses an Advanced toggle with Level and Risk settings
- Exploit handlers have no scan modes since they don’t create scans