Which vulnerabilities and checks does it cover?

Transport/TLS posture, security headers, CSP weaknesses, cookie flags, information disclosure, technology fingerprinting, DNS and email security (SPF/DMARC/DNSSEC/CAA), subdomain enumeration and takeover, archived-URL harvesting, JavaScript secret and endpoint extraction, content and parameter discovery, API/GraphQL exposure, cloud storage exposure, injection probing, CORS misconfiguration, open redirect, host header injection, HTTP methods, and JWT analysis.

Security tooling

Web Vulnerability Scanner & Recon Toolkit

A hunter's console for reconnaissance, passive posture analysis, and authorized active testing. Point it at a target and stream prioritized findings in real time.

Target URL

Scan preset

Customize modules

Active testing authorization. I confirm I own this target or have explicit written authorization to test it. Active modules (injection, CORS, open-redirect, host-header, HTTP methods) send probing traffic and stay disabled until this is checked. Unauthorized scanning is illegal.

Instant tools

Hunter Utilities

Instant helpers for encoding, hashing, token analysis, and search-operator crafting — most run entirely in your browser.

Input

Output

Under the hood

How it works

01 · Recon

Passive intelligence from public records, DNS, historical archives, and the target's own JavaScript — no attack traffic.

02 · Posture

Read-only analysis of TLS enforcement, security headers, CSP, cookies, information disclosure, and exposed sensitive paths.

03 · Active

With authorization, non-destructive probes for injection, CORS, open redirect, host-header injection, and dangerous HTTP methods.

A few honest limits: checks are performed over HTTP/S (no raw port or network-level scanning), there's no large-scale brute-forcing, and transport analysis covers HTTPS enforcement and HSTS rather than full cipher grading — use a dedicated TLS tool for deep certificate inspection. Findings are best-effort indicators, not proof; always verify before reporting.

FAQ

Frequently asked questions

Is this vulnerability scanner free?+

Yes — every recon and analysis module runs free online, with no signup.

What's the difference between passive and active scans?+

Passive and recon modules only send safe, read-only requests and can run against any public site. Active modules send probing traffic (injection, CORS, open-redirect, host-header, HTTP methods) and require you to confirm authorization for the target.

Can I scan any website?+

Passive/recon checks are fine against any public site, like SSL Labs or securityheaders.com. Active testing must only target systems you own or are explicitly authorized to test — unauthorized active scanning is illegal in most jurisdictions.

Which checks does it cover?+

TLS posture, security headers, CSP, cookies, information disclosure, tech fingerprinting, DNS/email (SPF/DMARC/DNSSEC/CAA), subdomain enumeration and takeover, archived-URL harvesting, JS secret/endpoint extraction, content and parameter discovery, API/GraphQL exposure, cloud storage exposure, injection probing, CORS, open redirect, host-header injection, HTTP methods, and JWT analysis.