Reconnaissance & OSINT
Scattershot3 —
Automated multi-phase network reconnaissance engine. Host discovery, port scanning, service enumeration, SSL/TLS analysis, web technology probing, and nuclei vulnerability scanning. 25,000+ lines of Python with checkpoint resume and scope-split output.
OSift —
OSINT gathering platform integrating 20+ APIs. Subdomain enumeration, email harvesting, IP intelligence, DNS analysis, certificate transparency monitoring, breach data correlation, and WHOIS enrichment.
AuthProbe —
Authentication mechanism detection and fingerprinting. Identifies login forms, SSO providers, MFA requirements, and software fingerprints for targeted testing.
Web & API Security
Fracture —
Web application vulnerability testing framework with full OWASP Top 10 2025 coverage. Multi-phase automated scanning (nuclei, nikto, sslscan, gobuster, whatweb) with manual workflow integration and evidence capture.
Siphon —
API security testing platform covering the OWASP API Top 10 2023. Endpoint discovery, OpenAPI/Swagger spec analysis, authentication testing, authorization bypass detection, and API surface mapping.
Wireless & IoT
Aether —
Wi-Fi security analysis platform. WPA/WPA2/WPA3 assessment, evil twin attacks, deauthentication, PMKID capture, and rogue access point detection.
Aether-B —
Bluetooth and BLE security analysis. Device enumeration, GATT service exploration, pairing weakness assessment, and MITM attack tooling.
Aether-Z —
Zigbee protocol security analysis. Network sniffing, key extraction, replay attacks, and device enumeration for smart home and industrial IoT.
Aether-U —
Ultra-Wideband (UWB) security analysis. Ranging manipulation, relay attack assessment, and protocol-level sniffing for proximity-based access systems.
Physical Interface Security
Gearbox —
Physical interface security assessment orchestrator. Tests devices through 20+ interface types: Ethernet (config discovery, traffic capture, DHCP, Nessus, Responder), USB (HID injection, power analysis, mass storage, keyboard/mouse emulation), HDMI/DVI/SDI/DisplayPort (EDID extraction, DDC/CI, HDCP analysis, CEC commands), Zigbee, Bluetooth/BLE, DB9/CAN bus, WiFi, Sub-GHz, UWB, SmartCard, Z-Wave, LoRa, RFID, RCA, and AUX. Photo-documents every physical port assessed.
C2 & Remote Operations
LandNav —
Automated C2 establishment for pentest appliances. Chisel tunnels, DNS tunneling via iodine, Meterpreter, reverse shells, and cascade/parallel connection modes.
Polaris —
C2 server management and monitoring platform. Chisel server orchestration, SSH tunnel management, and appliance registry with health monitoring.
Citadel / Acropolis —
Dual-lane VPN C2 infrastructure. Citadel provides OpenVPN+Cloak over TCP/443; Acropolis provides AmneziaWG over UDP/443. Manages a 56-endpoint pentest fleet.
Mole —
Custom C2 agent/server framework. Go-based agent with Python server for covert communication channels.
Pivot —
Pivoting agent for lateral movement during internal network penetration testing.
Infrastructure & Cloud
Bastion —
Firewall configuration audit engine with YAML-driven rule sets. Analyzes firewall rulesets for misconfigurations, overly permissive rules, and compliance gaps.
Forge —
Cloud infrastructure security auditing for AWS, Azure, and GCP environments.
Auger —
Database security auditing. Configuration assessment, privilege escalation checks, and compliance validation.
Trawler —
Network traffic capture and protocol analysis. Automated pcap-to-findings pipeline with deep packet inspection and anomaly detection.
pAIn —
Payload generation and format testing. Multi-format payload creation for security validation and evasion testing.
Management Platforms
Crucible —
Unified penetration testing platform. Flask/SocketIO web application wrapping 16 tools with real-time findings aggregation, action items, intelligence management, scope tracking, and checkpoint resume. The operational command center for full-scope engagements.
Vantage —
Reconnaissance management platform wrapping Scattershot3, OSift, and Trawler.
Spectre —
Wireless audit management platform wrapping the Aether tool family.
Gauntlet —
Physical interface assessment management platform wrapping Gearbox. Real-time module progress, findings aggregation, and photo evidence management.
Nexus —
Central hub connecting all management platforms. Cross-platform health monitoring, status aggregation, and unified navigation.
Reporting & Analysis
Prometheus —
Multi-tool findings correlation and deduplication engine. Generates compliance-mapped reports across NIST 800-53/171, PCI DSS 4.0, ISO 27001/27002, SOC 2, HITRUST, GDPR, and MITRE ATT&CK. Excel and HTML report output.
Arbiter —
Findings catalogue enrichment engine. Automated CVSS scoring, CWE mapping, and compliance framework cross-referencing for every finding across all tools.
Isotope —
File analysis and metadata extraction for evidence processing.
Quill —
Mobile application security analysis.
Hardware & Fleet Management
Quiver —
Pentest hardware management platform. Manages 55 devices across Hak5, SDR, Bluetooth, Zigbee, UWB, RFID/NFC, LoRa, bus analysis, and microcontroller categories. USB detection, firmware updates, SSH access, payload deployment, and interactive device shells.
Arsenal —
Tool registry, installer, and version management for the entire pr0t31n toolkit. Handles install, update, and health checking across all 40+ tools.
VulnManager —
Curses-based installer and manager for the VulnController test harness — 8 deliberately vulnerable web applications for tool validation.
Shared Infrastructure
All tools share a common infrastructure layer: Universal findings schema (v1.1, 56 fields per finding), standardized tool execution logging with .log transcript siblings, cross-tool correlation engine for host/CVE deduplication, false-positive management with JSON/CSV dual-write, HTTP evidence capture (request/response/log triplets), automated pcap-to-findings pipeline via Trawler integration, and findings catalogue with 33-field entries per finding type including CVSS, CWE, MITRE ATT&CK, and 9 compliance framework mappings.