Built-in Tools

TestNet includes 24 built-in security tools, covering reconnaissance, scanning, and vulnerability detection phases.

Categories & Images

The category field in tool DSLs uses these registry values: RECON, SCAN, NETWORK, FUZZ, FINGERPRINT, EXPLOIT. Tools below are grouped by functional phase, with the registry category noted on each.
All Docker-based tool images are hosted in the private registry registry.cn-hangzhou.aliyuncs.com/testnet-tools/; probes pull them automatically on first execution.

Subdomain Discovery

Subfinder

Category: RECON
Description: Passive subdomain enumeration tool that collects subdomains from multiple OSINT sources (DNS, certificates, search engines, etc.) without directly interacting with the target, offering strong stealth
Input: Domain (DOMAIN)
Output: Subdomain (SUBDOMAIN)

Amass

Category: RECON
Description: Powerful subdomain enumeration tool with both active and passive modes and rich data sources
Input: Domain (DOMAIN)
Output: Subdomain (SUBDOMAIN)

OneForAll

Category: RECON
Description: All-in-one subdomain collection tool integrating brute-forcing, certificate transparency, and more
Input: Domain (DOMAIN)
Output: Subdomain (SUBDOMAIN)

DNS Resolution

DNS-Lookup

Category: NETWORK
Description: DNS record lookup tool supporting A/AAAA/CNAME/MX/TXT/NS record types; built-in DNS executor, no Docker required
Input: Subdomain (SUBDOMAIN)
Output: IP (IP)

DNSX

Category: RECON
Description: High-speed bulk DNS resolution tool supporting multiple record types
Input: Subdomain (SUBDOMAIN)
Output: Dual channels — Subdomain (SUBDOMAIN) / IP (IP)

URL Collection

GAU (GetAllUrls)

Category: RECON
Description: Collects historical URLs from Wayback Machine, Common Crawl, and other sources
Input: Subdomain (SUBDOMAIN)
Output: API Endpoint (API)

WaybackUrls

Category: RECON
Description: Extracts historical URLs from the Wayback Machine to uncover retired but potentially live endpoints
Input: Subdomain (SUBDOMAIN)
Output: API Endpoint (API)

HTTP Probing

HTTP Probe

Category: NETWORK
Description: Built-in HTTP probe that checks target liveness and enriches Web assets, no Docker required
Input: Web (WEB) / Subdomain (SUBDOMAIN) / Domain (DOMAIN) / IP (IP) / Port (PORT)
Output: Web Application (WEB)
Runtime: HTTP_PROBE (built-in executor)

HTTPX

Category: SCAN
Description: High-speed HTTP liveness probe capturing titles, status codes, web servers, and tech stacks
Input: Subdomain (SUBDOMAIN) / IP (IP) / Port (PORT) / Web (WEB)
Output: Web Application (WEB) / IP (IP)

HTTPX Screenshot

Category: FINGERPRINT
Description: Httpx-based webpage screenshot tool that batch-captures screenshots and writes them back to Web assets with favicon info
Input: Subdomain (SUBDOMAIN) / IP (IP) / Port (PORT) / Web (WEB)
Output: Web Application (WEB, with screenshot fields)

Port Scanning

Naabu

Category: SCAN
Description: Fast port scanner with SYN/CONNECT modes and high accuracy
Input: IP (IP) / Subdomain (SUBDOMAIN)
Output: Port Service (PORT)

Masscan

Category: SCAN
Description: Ultra-fast port scanner using asynchronous packet transmission, capable of scanning millions of ports per second
Input: IP (IP) / Subdomain (SUBDOMAIN)
Output: Port Service (PORT)

Nmap Service Scan

Category: FINGERPRINT
Description: Network scanner focused on service version identification for open ports
Input: IP (IP) / Subdomain (SUBDOMAIN)
Output: Port Service (PORT) / Vulnerability (VUL)

TCP-Check

Category: NETWORK
Description: Lightweight TCP port probing tool with banner grabbing; built-in executor, no Docker required
Input: Port asset (PORT), with an optional port list to probe
Output: Port Service (PORT)

Web Crawling & Directory Discovery

Katana

Category: RECON
Description: High-speed web crawler that discovers links, forms, and API endpoints in web applications
Input: Web Application (WEB)
Output: API Endpoint (API)

Dirsearch

Category: FUZZ
Description: Web directory and file scanner that enumerates paths using dictionaries
Input: Web Application (WEB)
Output: API Endpoint (API)

FFUF

Category: FUZZ
Description: Versatile web fuzzing tool supporting directory discovery, parameter brute-forcing, and more
Input: Web Application (WEB)
Output: API Endpoint (API)

Fingerprinting

Wappalyzer

Category: FINGERPRINT
Description: Web technology fingerprint tool identifying frameworks, CMS, JavaScript libraries, and more
Input: Web Application (WEB)
Output: Updates the WEB tech-stack field

WhatWeb

Category: FINGERPRINT
Description: Web application identifier supporting a wide range of CMS and web servers
Input: Web Application (WEB)
Output: Updates the WEB tech-stack field

Vulnerability Scanning

Nuclei

Category: SCAN
Description: Fast template-based vulnerability scanner with thousands of built-in detection templates and custom template support
Input: Web (WEB) / Subdomain (SUBDOMAIN) / IP (IP) / Port (PORT)
Output: Vulnerability (VUL)

SQLMap

Category: EXPLOIT
Description: Professional SQL injection detection tool supporting multiple databases and injection techniques
Input: Web Application (WEB) / API Endpoint (API)
Output: Vulnerability (VUL)

Subzy

Category: SCAN
Description: Subdomain takeover detector that checks whether CNAME-pointed services have been deregistered
Input: Subdomain (SUBDOMAIN)
Output: Vulnerability (VUL)

TruffleHog

Category: SCAN
Description: Sensitive information leakage detector scanning web sites and APIs for API keys, passwords, and more
Input: Web Application (WEB) / API Endpoint (API)
Output: Vulnerability (VUL)

Enterprise Attack Surface

0.zone (Zero-Zone)

Category: RECON
Description: 0.zone asset search tool that queries root domains and ICP filing info by company name — an OSINT-style enterprise attack surface tool
Input: Company (COMPANY)
Output: Domain (DOMAIN, with ICP filing fields)
Runtime: HTTP (https://0.zone/api/data/), requires the zoneKey parameter

Tool Config & Sync — install and update tools from the store
Tool Specifications — list fields and detail views
DSL Reference — complete tool DSL field definitions

最近更新

Asset Management Overview2026-09-20 17:34:34
Asset Config Rules2026-09-20 17:34:34
Node Management2026-09-20 17:34:34