New Case study: Agentic attack-surface recon from 497 production scans Read it
For Business Analysts & IT Decision Makers

SquidScanner 101

The version you can put in front of a budget meeting.

Same product the operators use. Charts a director can read, diffs that answer what changed, and an AI report you can forward. First scan is a free preview.

Start free scan

First scan is a free preview • Packs start at 10 scans • No subscription

EVIDENCE FIRST

Every finding traces back to raw tool output

The AI layer drafts the narrative. It does not invent findings. Each line in the report links to the scanner output that produced it, so a reviewer can check the claim instead of trusting it.

Tools do the finding

Fifty recon tools run across eight phases. Subdomains, live hosts, ports, paths, TLS, and CVEs come from the scanners themselves.

Version checks cut the noise

A CVE is kept only when the installed version falls inside the affected range. Theoretical matches are dropped before they reach the report.

AI writes it up

The executive summary, impact framing, and remediation ordering are drafted from the validated output, then exportable as a sectioned PDF.

What that means for a non-operator

  • • Numbers in the dashboard and the report come from the same run
  • • You can open the raw output behind any finding
  • • Nothing is marked confirmed without a scanner result behind it
THE REALITY TODAY

Manual recon does not scale, and the output does not survive a leadership review.

Security teams spend days or weeks manually enumerating assets
Results vary wildly depending on who runs the tools
Executive stakeholders receive raw technical data instead of clear risk insights
Expensive consultants are often brought in just to do discovery work

This creates real problems for the people recommending tools:

  • • Difficulty proving ROI of security investments
  • • Inconsistent deliverables across projects
  • • Long time-to-value for new security initiatives
  • • Hard to justify budget when outputs are technical and hard to understand
HOW IT WORKS

SquidScanner in four simple steps

An analyst can start it. An engineer can defend the evidence.

1

Enter a Domain

The analyst or engineer simply enters the target domain. No complex configuration needed. Works for any public-facing asset.

2

Autonomous Agents Work

50 agents run the security tools across 8 phases. Passive OSINT and subdomain discovery first, then live hosts and active checks, then a Known Exploits phase that looks up CVEs against the software versions actually found.

3

Recon Intelligence Dashboard

A visual attack-surface summary appears on every job report: KPI tiles, interactive charts, technology and subdomain word maps, and known CVE counts. Click any metric to jump straight to the underlying tool evidence.

4

AI Report, Diffs & Delivery

The AI engine writes the executive report, including CVE matches that survived the version check. If you have scanned this domain before, the diff shows what is new. The report emails itself when the job finishes, and you can export a sectioned PDF.

WHAT YOU GET TODAY

See the attack surface, and what changed since last time

Charts instead of a log dump. CVEs checked against real versions. Scheduled scans that diff themselves. HackerOne and Bugcrowd scope sync, PDFs, and badges for teams that run this every week.

Recon Intelligence Dashboard

Every completed scan includes an at-a-glance dashboard on the job report page:

  • • KPI tiles for subdomains, live hosts, technologies, sensitive paths, and known CVEs
  • • Interactive charts: attack surface funnel, HTTP status breakdown, vulnerability vectors, security grades, scan progress
  • • Subdomain prefix and technology word maps for pattern spotting at a glance
  • • Click a chart or stat and it scrolls to the tool output that produced it

Known CVE & Exploit Research

A dedicated final-phase agent aggregates discovered technologies and searches the web for real-world exploits:

  • • AI-assisted web search across CVE databases, advisories, and public exploit sources
  • • A CVE counts only when it applies to the software version found on the target
  • • Confirmed CVE table with severity breakdown and full, non-truncated research output
  • • Noise-filtered technology fingerprinting so the stack map reflects real services, not scanner artifacts

Scheduled Scans

Continuous monitoring without manual resubmission. Configure recurring scans in Advanced Settings and the full 50-agent pipeline re-runs on autopilot.

  • • One-time, daily, weekly, or monthly cadence
  • • Day-of-week or day-of-month for predictable assessment windows
  • • Local timezone support so runs land during your business hours
  • • Ideal for portfolio monitoring, compliance cadences, and bounty program coverage

Why scheduled scans pay off: automatic diffs

A re-scan by itself is just more data. SquidScanner compares every completed job to the previous completed scan of the same domain and highlights what changed. Teams triage new risk instead of re-reading the whole surface.

  • • New or removed subdomains and live hosts
  • • Technology stack changes and confirmed CVE deltas
  • • Sensitive paths, takeover candidates, open redirects, and header grade shifts
  • • Nuclei severity count deltas for quick risk trend reads
  • • Dedicated Scan Changes view, job-list indicators, PDF section, and email context

Business outcome: schedule weekly recon once, then report “what appeared this week” to executives or clients without a manual before/after analysis.

Bounty Platform Integration

Teams running bug bounty programs can connect HackerOne or Bugcrowd directly:

  • • Link API credentials once. Programs and in-scope assets sync from there
  • • Pick a bounty program and select targets from the live scope list when starting a scan
  • • Run All In Scope queues recon across every eligible domain in a single action

PDF Export, Email & Sharing

Deliver findings without reformatting or copy-paste:

  • • Sectioned PDF: summary, AI analysis, phases, and scan changes
  • • Scan-complete emails with the AI executive report attached
  • • Public shareable reports when you need stakeholder visibility

Operator Badge System

Gamified progress tracking keeps security teams engaged and surfaces expertise:

  • • 110 badges for discoveries, OWASP categories, CVE confirmations, streaks, and milestones
  • • Stackable counts show how often each finding class has been detected across targets
  • • Share badge details on LinkedIn and X. Public profiles show what was earned
SEE IT IN ACTION

Real screenshots from the live platform

Job submission, bounty scope, scheduled recon, diffs, badges, charts, PDF export, and the AI report. One dashboard.

SquidScan dashboard with a target domain field and a list of completed jobs

Submit a domain and track every job in one list

Recon Intelligence summary tiles covering subdomains, live hosts, open ports, and known CVEs

Recon Intelligence: the whole attack surface in one view

AI executive report with an executive summary and asset overview table

Phase-by-phase progress across the full pipeline

Scan changes view listing added live hosts and confirmed CVEs since the previous scan

Scan changes: what is new or fixed since the last run

Operator profile showing badge collection and achievement progress

110 achievements tracked on your operator profile

SquidScan sign-in screen with email, password, and Google sign-in

Sign in with a password or Google

What you are actually buying

The scanners are table stakes. The report, the diff, and the version check are the product.

AI Executive Reports

The AI engine writes a report a non-operator can finish. You are not handing a director a nuclei dump and asking them to care.

Fully Autonomous

Nobody sits on 15 terminals. The pipeline runs from subdomain enumeration through the final report.

Built-in Guardrails

Strong legal and operational controls (including self-service domain opt-out) so you can confidently recommend the tool without compliance concerns.

Rapid Time-to-Insight

Get comprehensive attack surface visibility in hours instead of days. Ideal for security assessments, M&A due diligence, and continuous monitoring programs.

Consistent Quality at Scale

Every assessment follows the same rigorous methodology. No more variance based on who is running the tools or how much time they have.

Modern Attack Surface Coverage

Goes beyond traditional scanning with historical data (Wayback), certificate intelligence, GitHub reconnaissance, and public leak detection.

Visual Recon Intelligence

Interactive charts, KPI tiles, and word maps turn hundreds of tool outputs into a single attack-surface picture. Stakeholders can explore findings without reading raw logs.

Version-Validated CVE Matching

Known CVE counts include only exploits that match the software versions found. Fewer theoretical hits. A shorter remediation list.

Evidence-Linked Drilldowns

Click a metric or chart segment and you land on the tool output behind it. Audits and handoffs do not depend on someone remembering which log mattered.

HackerOne & Bugcrowd Scope Sync

Connect bounty program platforms on the operator profile and pull in-scope assets automatically. Security teams stay within program boundaries without maintaining separate target lists.

Automated Scan Schedules

One-time, daily, weekly, or monthly, in the local timezone. Nobody resubmits the job. The full agent pipeline runs again on that schedule.

Attack-Surface Change Detection

Every completed scan is compared to the prior run of the same domain. New hosts, technologies, CVEs, sensitive paths, and grade shifts show up as changes, not as another full dump.

Operator Achievement Badges

Over 100 earnable badges track discovery milestones, OWASP coverage, and scan streaks. Stackable counts and shareable profiles help demonstrate team expertise and engagement.

PDF Export & Shareable Reports

Export sectioned PDFs (including scan changes), email the AI executive report on completion, and share public report links when stakeholders need visibility without dashboard access.

What matters when you are the one recommending it

✓

Faster Time-to-Value

Teams get meaningful results in hours instead of days or weeks. Great for proof-of-concept, pilot projects, and time-sensitive assessments.

✓

Consistent, High-Quality Deliverables

Every report follows the same method. Quality does not swing with whoever had time to run the tools that week.

✓

Stakeholder-Friendly Output

You can hand the final AI report to executives, risk committees, or clients without heavy editing. Reports are designed to be read, not just filed.

✓

Lower Total Cost of Ownership

Reduces reliance on expensive manual consulting hours for discovery work. One token = one complete, AI-analyzed assessment.

✓

Responsible & Compliant by Design

Built-in domain opt-out, strong audit logging, and clear terms of use make it easier to get legal and procurement approval.

✓

Modern AI Capabilities

The AI engine writes the synthesis. The scanners still do the scanning. The model is there to rank what matters, not to replace subfinder.

✓

Comprehensive Attack Surface Visibility

Combines traditional scanning with modern techniques: historical data from Wayback Machine, certificate transparency logs, GitHub reconnaissance, and public leak detection.

✓

Scalable & Repeatable Process

Perfect for continuous monitoring programs, regular assessments, or scaling security reviews across a large portfolio of assets.

✓

Visual Attack-Surface Summaries

Executives and analysts get charts. Engineers still get the raw tool output one click under those charts.

✓

Actionable CVE Intelligence

Known exploit research ties CVEs to the software versions found on the target. Remediation starts with confirmed risk, not a CVE list that might not apply.

✓

Bug Bounty Program Ready

HackerOne and Bugcrowd scope sync keeps scans on authorized targets. Run All In Scope covers an eligible program in one action, without a spreadsheet of hosts.

✓

Hands-Free Continuous Monitoring

Daily, weekly, or monthly scans run without someone clicking submit, in the timezone you set. Built for programs that need the same method every cycle, not a one-off.

✓

Diff-Based Trend Reporting

Automatic scan-to-scan comparison answers the question stakeholders actually ask: what changed? New hosts, CVEs, and exposures show up as deltas. You do not reprint the full report every cycle.

✓

Export-Ready Deliverables

Sectioned PDF exports (including scan changes), scan-complete email with the AI executive report, and optional public share links make it easy to hand findings to executives, clients, or program managers without reformatting.

✓

Team Engagement & Expertise Tracking

The badge system surfaces who is finding what across your organization. Shareable achievements and public profiles help demonstrate security team maturity to stakeholders.

COMPLETE TOOLKIT

Every Tool Has Its Own AI Agent

Below is the full list of reconnaissance tools SquidScanner runs, along with what each specialized AI agent accomplishes.

Subdomain & Infrastructure Discovery

  • subfinder: Discovers subdomains from dozens of public data sources and APIs.
  • findomain: Fast subdomain enumeration using multiple passive sources.
  • wayback: Analyzes historical web archives to find old or forgotten endpoints and parameters.
  • crtsh: Queries Certificate Transparency logs to reveal additional subdomains and certificates.
  • dnsx: Performs fast DNS resolution and wildcard filtering on discovered domains.
  • dnsrecon: Conducts comprehensive DNS reconnaissance including zone transfers and record enumeration.
  • subdomain takeover: Detects dangling CNAME records and vulnerable subdomain takeover conditions via fingerprint matching.

Network & Service Scanning

  • host alive: Probes discovered subdomains to identify reachable HTTP/S hosts before active scanning.
  • sensitive paths: Checks for exposed .git, .env, backups, and other sensitive configuration files.
  • naabu: Fast port scanning to identify open services and potential entry points.
  • httpx: Probes discovered hosts to determine live web services and technologies.
  • katana: Crawls websites to discover hidden paths, endpoints, and JavaScript files.
  • feroxbuster: Directory and file brute-forcing to find hidden resources.
  • gobuster: Directory, DNS, and virtual host enumeration.
  • ffuf: Flexible fuzzing for directories, parameters, and virtual hosts.

Vulnerability & Web Security

  • nuclei: Template-based scanning for known vulnerabilities and misconfigurations.
  • nikto: Web server scanner for outdated software and common vulnerabilities.
  • arjun: Parameter discovery to find hidden input fields.
  • ssrf scanner: Detects potential Server-Side Request Forgery vectors.
  • open redirect scanner: Detects open redirect vulnerabilities that can lead to phishing and account takeover.
  • ssti detector: Identifies Server-Side Template Injection opportunities.
  • xxe scanner: Tests for XML External Entity vulnerabilities.
  • cache poisoning: Detects web cache poisoning risks via unkeyed headers and parameters.
  • graphql scanner: Discovers GraphQL endpoints and tests for introspection, auth bypass, and injection flaws.
  • web scraper: Deep content scraping to uncover hidden data, secrets, and sensitive information.

Specialized & Intelligence Gathering

  • github dork: Searches public GitHub repositories and code for secrets and internal references.
  • public leak: Scans paste sites and gists for leaked credentials or infrastructure details.
  • theharvester: Gathers emails, subdomains, and employee names from public sources.
  • cloudenum: Enumerates cloud storage buckets and resources.
  • package registry: Searches public package registries (npm, PyPI) for related projects.
  • dockerhub: Looks for publicly available Docker images related to the target.
  • jwt oauth analyzer: Extracts and analyzes JWT tokens and OAuth configurations.
  • cors scanner: Detects misconfigured Cross-Origin Resource Sharing policies.
  • firewall evasion: Advanced WAF bypass testing using header manipulation, method tampering, and behavioral analysis.
  • origin ip sniffer: Discovers real origin server IPs behind CDNs/WAFs via historical DNS, certificate transparency, favicon hashing, and targeted probing.
  • snmp enumerator: Performs SNMP community string checks on network devices.
  • ldap smb nfs: Enumerates LDAP, SMB, and NFS services where exposed.
  • waf whatweb: Identifies web application firewalls and underlying technologies.
  • security headers: Grades HSTS, CSP, and cookie security flags across live web services.
  • enum4linux ng: Performs SMB and Windows enumeration on exposed services.
  • testssl: Analyzes SSL/TLS configurations for weaknesses.
  • wordpress: Specialized scanning for WordPress installations and vulnerabilities.

Known Exploits Phase (phase 8, last stage)

  • known exploits: Aggregates all discovered technologies from prior phases, then uses the configured AI model with live web search to find known CVEs and public exploits. Matches are checked against the software version detected on the target. Only confirmed hits appear in the Known CVEs metric and the executive report. Research output is kept in full.

50 tools across 8 phases. Each tool runs in its own agent. The agent parses the output and feeds the AI report.

Run it on a domain you own.

The free preview is a real scan, not a slideshow. If the report is useful, buy a pack. Scans do not expire.

Start free scan

Questions? Email us at contact@squidhacker.com