LOCAL · AUTHORIZED ASSESSMENTS

Signal room

Recon, observed browser evidence, and a ranked queue for the scope you saved.

No scope saved
API connection

The token is restored automatically on this browser and is never saved with assessment data. Clear the field and save to remove it.

01 / CONTROL

Authorized scope

Import and review the program CSV before any target requests.

No CSV preview yet. Bare domains are exact hosts; only explicit *.domain entries include subdomains. Unsupported rows are skipped and never authorized by this dashboard.

02 / DISCOVER

Inventory, paths, and ranking

Subfinder → HTTPX → bounded FFUF → explainable rank → your selection.

Analyst brief

Run the pipeline to build a ranked queue.

How target scores work

Scores are a local evidence heuristic, capped at 100. They prioritize where to review next; they do not estimate vulnerability likelihood.

Observed API/schema +18; account/auth +15; admin, file handling, or billing +12 each; at least three technologies +6; reachable response +4. Observed endpoints and FFUF paths add up to +12 each, JavaScript assets up to +8, parameter names up to +10, and selected object/tenant/file/redirect parameter names +12. A keyword is a lead to verify, not proof of a feature or flaw.

Scores update after FFUF and traffic imports. Open a target’s details to review every signal, path, technology, and next question.

ReviewTargetHTTPScoreTop reason
No inventory yet.

Selected target export

Choose the domains you want to assess after their path runs. The export contains scope, ranked reasons, and observed endpoints for review in a separate project.

Download selected targets

Run history

WhenScopeHostsReachableModel
No runs yet.

03 / OBSERVE

JavaScript and API map

Use Firefox HAR exports from your normal testing session. The optional Interceptor spider requires Chrome, Brave, or Edge.

Firefox HAR import

In Firefox DevTools → Network, enable Persist Logs, browse the authorized workflow, then choose Save All as HAR. Import it here to map observed scripts, endpoints, methods, and parameter names. HAR files may contain credentials; keep the original private.

Optional Interceptor spider · Chrome / Brave / Edge

This automated click crawler does not connect to Firefox. Use a separate testing profile if you choose to run it.

Mapping mode attempts to block form and JavaScript write requests. GET links, startup code, and other browser behavior can still change server state; review program rules and use a dedicated test account.

04 / KEEP

Evidence vault

Hashes identify saved notes without storing credentials.

05 / COMPARE

Authentication-state comparison

Offline analysis of two saved, permitted captures.