Arsenal

Open security tools — PentX, FILEx, CSPy. Run free, read the source, open a pull request.

Recon

Subdomain enumeration via certificate transparency logs (crt.sh). Passive-only — no active scanning.

Web · crt.sh

PentX

Passive recon through active testing — every finding ships with full request/response bytes, reflection offsets, a cURL repro, and OAST callbacks for blind classes.

reconscanningbug-bountyoast

Node.js

FILEx

beta

A self-hosted document toolkit — convert, merge, split and process PDFs without sending a byte to a third party. Built for teams that cannot leak documents.

pdfself-hostedprivacydocuments

Python · FastAPI

CSPy

alpha

A browser extension that audits the CSP and security headers of any site you visit and explains, in plain language, what an attacker could do with the gaps.

cspheadersbrowseraudit

TypeScript

Subdomain Recon

Subdomain finder — certificate transparency