Submit an authorized domain
Create an account and paste a target you own or that is in scope. Or sync HackerOne and Bugcrowd scope to stay inside the program.
For bug bounty hunters and red teams
Paste a domain. Map the attack surface. See what attackers see.
SquidScan runs 50 recon agents across 8 phases, keeps a CVE only when the installed version matches, diffs the results against the last scan, and writes the report for you.
First scan free No subscription Tokens never expire
Only scan domains you own or are authorized to test. Unauthorized use is prohibited.
Same flow as production. Paste a domain, agents run, the report lands.
50
Specialized recon agents
8
Phases, from OSINT to CVEs
Automatic
Diffs against the previous run
Open a finished job report
What it runs
50 recon tools, in plain language
Every tool below runs as its own agent. Grouped by what it actually finds.
- Subdomain discoverysubfinder
- Certificate transparencycrt.sh
- Historical URLswayback
- Historical URLsgau
- DNS recordsdnsx
- DNS enumerationdnsrecon
- DNS brute forcefierce
- Dangling CNAME detectiontakeover
- Subdomain discoveryfindomain
- Live host probinghttpx
- Reachability checkshost alive
- Host screenshotsgowitness
- Port scanningnaabu
- Web crawlingkatana
- Exposed files and secretssensitive paths
- Directory discoverygobuster
- Directory discoveryferoxbuster
- Fuzzingffuf
- Hidden parametersarjun
- Technology fingerprintingwhatweb
- Security headersheaders
- TLS and certificate audittestssl
- Web server misconfignikto
- Template vulnerability scannuclei
- WordPress checkswordpress
- CORS misconfigurationcors
- JWT and OAuth flawsjwt/oauth
- SSRF testingssrf
- Open redirectsredirect
- Template injectionssti
- XML external entitiesxxe
- File upload handlingupload
- Access control (IDOR)idor
- GraphQL endpointsgraphql
- Web cache poisoningcache
- WAF detection and evasionwaf
- Origin IP discoveryorigin
- Windows and SMB enumerationsmb/ldap
- SNMP enumerationsnmp
- Public cloud storagecloud enum
- GitHub code and reposgithub
- GitHub dorkingdork
- Breach and leak searchleaks
- Email and employee OSINTharvester
- Container image searchdockerhub
- Package registry lookupregistry
- Content scrapingscraper
- WordPress CVE templateswp nuclei
- Version-checked CVE matchingknown exploits
- Windows domain enumerationenum4linux
50 agents · 8 phases See the full breakdown with what each one does
How it works
Three steps. No box to maintain.
Submit a target, let the pipeline run, and get a report you can send.
Agents run the pipeline
50 agents across 8 phases, from passive OSINT to Known Exploits. A CVE counts only when the installed version is in range.
Report, diff, and deliver
Recon Intelligence on the job page, an AI summary in your inbox, a PDF, and a diff against the last run.
Why not DIY
The layer above your toolchain
You already run subfinder and nuclei. SquidScan runs them, filters the output, diffs it against last week, and writes the client-facing document.
A full agentic pipeline
Every tool has its own agent that parses results, drops noise, and feeds the next phase.
Change detection that matters
Schedule weekly recon and wake up to new hosts, technologies, CVEs, and paths.
Validated CVEs and a written report
Exploit research validated against the versions on the target, plus a narrative for clients and bounty write-ups.
How SquidScan differs from the alternatives
| SquidScan | Open-source recon frameworks | Managed attack-surface platforms | Manual pentest | |
|---|---|---|---|---|
| Time to first result | Minutes, after one signup | Days. Install, tune, and maintain the stack | Days to weeks for onboarding and asset setup | Two to six weeks for scoping and delivery |
| Who runs the tooling | Hosted for you, one click per target | You do, on your own VPS | The vendor, on a schedule you may not control | A consultant, in a fixed window |
| Active scanning, not just passive data | Yes. 50 agents across 8 phases | Yes, if you wire it up | Often passive-first; active testing varies | Yes, manually and deeply |
| Attack-surface diffs between runs | Automatic on every re-scan | Manual scripting | Usually included, at platform pricing | Only if you buy a retest |
| Version-checked CVE matching | Built in. Mismatched versions dropped | Raw nuclei output to triage yourself | Varies by vendor | Yes, validated by hand |
| Client-ready report | Generated, emailed, PDF export | You write it | Dashboard and exports, often per seat | Yes, the main deliverable |
| Cost model | Pay per scan. Credits never expire | Free software, your time and hosting | Annual subscription or per-asset licensing | Per engagement, typically five figures |
| Best fit | Bounty hunters, small teams, repeat recon | Operators who want full control | Enterprises with a compliance mandate | High-assurance or regulated systems |
Category comparisons are general and based on how each type of tool typically works. Individual products differ, so verify specifics with each vendor before you buy.
Platform
The parts operators actually open
Recon Intelligence
KPI tiles, charts, and word maps with click-through to the raw evidence behind each number.
Bounty scope sync
HackerOne and Bugcrowd. Pick individual targets, or run everything currently in scope.
Scheduled scans
Daily, weekly, or monthly in your own timezone, running the full pipeline on autopilot.
Active and passive coverage
Subdomains, secrets OSINT, nuclei, GraphQL, CORS, SSRF, and more across the full agent set.
PDF and public shares
Sectioned exports including scan changes, plus share links you can send to stakeholders.
Operator badges
110 achievements for discovery milestones, shareable to LinkedIn and X from your profile.
Proof
Real product, real report
Production screenshots, and a finished job you can open right now.
Coverage
50 tools, one dedicated agent each
wayback
crtsh
github dork
subfinder
dnsx
httpx
nuclei
nikto
katana
ffuf
naabu
graphql
ssrf
cors
testssl
wordpress
cloudenum
known exploits
+ 32 more
The full tool-by-tool breakdown for decision-makers is on the For teams overview.
Pricing
Pay for scans, not a subscription
The first scan is a free preview once you create an account. After that you buy a pack: no monthly bill, no single-scan checkout, and unused scans do not expire.
Paid scans include the full 50-agent pipeline, Recon Intelligence, the AI report, PDF export, and sharing. The free scan shows counts and a report teaser. Need volume for a consultancy? Email us for bulk pricing.
FAQ
Before you hit register
Is the first scan really free?
Yes. Create an account and run one preview scan at no charge. You get totals, a severity mix, and a short report teaser. A pack of 10 scans or more unlocks the full findings, the AI report, the PDF, and a share link. Tokens never expire, and there is no monthly subscription.
What am I allowed to scan?
Only assets you own or are explicitly authorized to test, such as in-scope bug bounty targets. Unauthorized scanning is prohibited. Domain owners can permanently opt out through the opt-out form.
How is this different from running my own tools?
You still get the tools you trust. You also get agents that run them, a visual layer, automatic scan-to-scan diffs, bounty scope sync, and an AI executive report you do not have to write. There is no VPS to keep alive.
What is version-validated CVE research?
The final Known Exploits phase collects the technologies found on the target and keeps a public CVE only when the installed version falls inside the affected range. That removes most of the theoretical noise.
How long does a scan take?
It depends on target size and live surface. Many jobs finish in well under an hour, while large attack surfaces take longer. The dashboard refreshes automatically so you can watch agents complete in real time.
Are HackerOne and Bugcrowd credentials safe?
Credentials are stored on your profile for scope sync so you can pick in-scope assets and run authorized targets. Use API tokens with least privilege wherever the platform allows. You control connecting and disconnecting.
Who sees my targets and findings?
Jobs are private to your account by default. You can optionally share a public report link. See the Terms for data-handling details.
What happens if a scan fails?
If something goes wrong on our side, email support with the job ID. You should not pay for a broken run. Reach us at contact@squidhacker.com.
Evaluating for a team or a non-technical stakeholder?
Send them the plain-language SquidScan 101 overview. It covers cost framing, compliance notes, and the full tool list without the operator deep-dive.
Run a domain you are allowed to test
The first scan is free. After that you pay only for the scans you use.
Create an account and startAlready have an account? Log in