Scope an Engagement
Research

Open-Source Tools

Tools built for real engagements and released to the security community. Every tool in this library was developed to solve a problem we encountered during an actual red team or research project.

ReconKit

Reconnaissance
Go

A modular external reconnaissance framework for attack surface enumeration. Combines passive DNS, certificate transparency, port scanning, and screenshot capture into a single, parallelised pipeline.

ReconOSINTAttack Surface

CloudEnum

Cloud Security
Python

Cloud asset enumeration for AWS, Azure, and GCP. Identifies exposed storage buckets, publicly accessible services, and misconfigured IAM roles from an unauthenticated external perspective.

AWSAzureGCPCloud

ADGraph

Active Directory
Python

Active Directory attack path visualisation. Queries BloodHound data and generates prioritised attack path reports highlighting the shortest route to domain compromise.

Active DirectoryRed TeamBloodHound

APIFuzz

API Security
Go

An API security fuzzing framework built for modern REST and GraphQL APIs. Supports OpenAPI specification ingestion, smart payload generation, and BOLA/BFLA detection heuristics.

APIFuzzingGraphQLREST