Live run status

First-Launch: user target intake open; control running. Watchdog nominal: auto-retry heartbeat active.

570

total

queued

running

560

done

failed

100.0%

complete

New: the profit-oriented Hunt Findings branch is live. The legacy automated findings pipeline is deprecated.

Find real holes on your website — deep wave-based scan.

Enter an authorized domain → get a PDF report with evidence-backed candidates, controls, and a security score. The research pipeline is deliberate and may take longer on large surfaces.

🎯

Canonical research pipeline. subfinder, httpx, naabu, and katana map the surface; controlled experiments cover SQLi, IDOR, SSRF, race, and session lifecycle behavior.

🌊

Evidence before conclusions. Every experiment has a plan, scope permit, controls, observations, and an oracle decision.

🧠

AI assists planning and review. Deterministic checks and negative controls remain the gate for high-confidence output.

💀

Understand how to break it. Next to each finding — a short plain-language explanation of how an attacker could abuse it (sslstrip, clickjacking, XSS). Not a dry CVE — a real breakdown.

📊

0–100 score. Not "you have N vulns" — a concrete security score with penalty breakdown by priority. 100 = safe, <30 = fix now.

⚡

Real-time progress. See which phase the scan is on: passive → recon → auth → research → scoring → report.

📄

PDF + SARIF. Download a professional report (for bug bounty, for the boss, for CI/CD).

How to read the report

Security score: 0–100

100

Safe. All security measures in place. No confirmed issues.

70–99

Good. Minor issues. Fix within a month.

30–69

Risky. Real vulnerabilities confirmed. Fix within a week.

0–29

Critical. Immediate action required. The domain has confirmed exploitable holes.

Tiers: S / A / B

Strong Confirmed. Two different scanners independently found the same hole. Definitely real. Fix NOW.

Likely Confirmed. One scanner + a high-risk indicator (critical severity, KEV list). Very likely real. Prioritize.

Needs Review. Flagged by the scanner but needs a human to check. Could be real, could be noise.

Findings classified as Rejected (R) are auto-filtered — don't even appear in the report.

Ready to test your site?

You need a Preview key. 1 key = up to 5 full scans (each with a PDF report).

No key? Get one from the author: Telegram @project_admin — 1 key = up to 5 scans.
Find your reports by key → · Auto-discovered digest → · See public scans →

Only for domains you own or have permission to test. Scanning others' resources without consent is illegal.