Simplifying offensive security at any scale.
Recon, authenticated scanning, API authorization testing and mobile capture, on opsec-safe nodes you own. One node or a hundred.
- 48/48 on the limeyard benchmark, with zero false positives
- 15/15 traps on the decoy target held
- 25 advisories filed in other people's software
The lab, the traps and the answer keys are public. Run it and mark our homework.
The stack
Offensive security at scale is an infrastructure problem. So we built the infrastructure.
Nine layers, from enrolling a bare Linux box to ranking what came back. The engines in the middle are Rust down to the raw socket, and you can read the source.
- 01
Node runtime
It has to survive a reboot and a dropped connection without losing the scan. A run that restarts from zero is a run nobody starts twice.
- 02
Provisioning
This is where the trust boundary is drawn. A node key that can be replayed undoes every layer above it.
- 03
Packages
Every binary is checked against a signed manifest before it runs. A scanner that updates itself is a supply chain pointed at your network.
- 04
Networking
Scan traffic leaves from your address, never ours. Shared egress means someone else's mistake becomes your block.
- 05
Engines the layer you already have
This is the only layer most tools are, which is why they stop working the moment you want a second machine.
- 06
Workflows
Composition, not scripting. One stage's output has to arrive as typed targets, not as text the next stage re-parses.
- 07
Orchestration
Work is reserved then reconciled, so a node dying mid-operation cannot drop it silently or bill for it twice.
- 08
Control plane
Every route is authorization-gated and the gate is enforced on commit. One missed route is the whole product.
- 09
Results
Deciding what to read first. Most scanners hand you a queue and call it a report.
Running one across a fleet makes you these eight.
How it works
Your machines, your pace, and a finding you can check.
01 Enrol a machine, start a scan.
Nodes are yours and they dial out, so nothing needs a way in. The control plane hands out work and never touches a target itself.
02 The target sets the pace.
Each node probes from its own proxy and reads what comes back. Push back and it slows down, then finds its way up again. A fixed rate you typed in is its own giveaway.
03 Authorization, asked three ways.
The anonymous column is what turns this from a guess into a finding. It proves the endpoint does check who you are, and answers the middle one anyway.
Mobile
A pinned app, on a phone you did not root.
Capture on a phone stops dead at certificate pinning, which is what the apps worth testing use. Crossfyre repackages the app instead. No root, no laptop, no Frida.
01 Attach the tracer.
Every request goes through it, and a copy reaches crossfyre. The app pins its certificate, so that copy is noise.
02 Rebuild the app.
The pinning check is rewritten and your certificate goes inside the build. Nothing is installed on the phone afterwards, and nothing is rooted.
03 Read the traffic.
Same phone, same backend, same tracer. The copy reaching crossfyre is now a request you can read, hold, edit and send again.
Both columns, same weight.
What it does
What it will not do
Rewrites the pinning check, embeds your certificate
arm64 only
No root, nothing to install afterwards
Loses to Play Integrity and to an app's own tamper checks
Reaches Flutter, which ignores the system trust store
Reinstalling replaces the app, so its data goes with it
Read, hold, edit and replay every request
Change the certificate later and every patched build stops working
None of those are settled. All four are open work here, and the list gets shorter when that lands rather than when the wording improves.
We are not claiming to be alone. LSPatch does rootless patching and apk-mitm handles split APKs. What we could not find is a commercial vendor documenting it from the phone itself.
Pricing
Pay for how much you scan.
- Free $0 Try it.
- Pro $29 One operator.
- Reaper $79 Running flat out.
- Syndicate $149 A crew of three.
Per month. The free tier takes no card, and every paid plan opens on a free trial. Syndicate includes three seats; more are $39 each. Billed in INR, so the figures above are indicative. Full pricing.
Questions
The ones worth answering.
Bring up a node. Run a scan.
Free tier, no card. Or read the code first, which is the better order.