New Case study: Agentic attack-surface recon from 497 production scans Read it
For Business Analysts & IT Decision Makers

SquidScanner 101

The version you can put in front of a budget meeting.

Same product the operators use. Charts a director can read, diffs that answer what changed, and a Grok report you can forward. First scan is a free preview.

Start free scan

First scan is a free preview • Packs start at 10 scans • No subscription

AI ENGINE

Zero data retention on the models

Every model SquidScan uses is ZDR. Providers do not keep scan prompts or outputs, and they do not train on them. The list below is what is configured right now.

Active model

grok-4.6

Executive reports, known-exploit research, and recon analysis all go through the configured ZDR models. The active model handles the current job. The others stay available if we switch.

coding agentic tasks knowledge work tool calling web search code execution
Provider
xAI
API model ID
grok-4.6
Retention
ZDR

All models we use

    Zero Data Retention. Providers do not store prompts or outputs and do not use them for training.

    How SquidScan uses it

    • • Synthesizes multi-agent recon output into executive-ready findings
    • • Powers Known Exploits research with version-aware CVE context
    • • Prioritizes risk and narrative so operators spend less time on raw logs
    xAI model docs Vercel DeepsecBench (best cost)
    THE REALITY TODAY

    Manual recon does not scale, and the output does not survive a leadership review.

    Security teams spend days or weeks manually enumerating assets
    Results vary wildly depending on who runs the tools
    Executive stakeholders receive raw technical data instead of clear risk insights
    Expensive consultants are often brought in just to do discovery work

    This creates real problems for the people recommending tools:

    • • Difficulty proving ROI of security investments
    • • Inconsistent deliverables across projects
    • • Long time-to-value for new security initiatives
    • • Hard to justify budget when outputs are technical and hard to understand
    HOW IT WORKS

    SquidScanner in four simple steps

    An analyst can start it. An engineer can defend the evidence.

    1

    Enter a Domain

    The analyst or engineer simply enters the target domain. No complex configuration needed. Works for any public-facing asset.

    2

    Autonomous Agents Work

    45 agents run the security tools across 8 phases. Passive OSINT and subdomain discovery first, then live hosts and active checks, then a Known Exploits phase that looks up CVEs against the software versions actually found.

    3

    Recon Intelligence Dashboard

    A visual attack-surface summary appears on every job report: KPI tiles, interactive charts, technology and subdomain word maps, and known CVE counts. Click any metric to jump straight to the underlying tool evidence.

    4

    AI Report, Diffs & Delivery

    Grok writes the executive report, including CVE matches that survived the version check. If you have scanned this domain before, the diff shows what is new. The report emails itself when the job finishes, and you can export a sectioned PDF.

    WHAT YOU GET TODAY

    See the attack surface, and what changed since last time

    Charts instead of a log dump. CVEs checked against real versions. Scheduled scans that diff themselves. HackerOne and Bugcrowd scope sync, PDFs, and badges for teams that run this every week.

    Recon Intelligence Dashboard

    Every completed scan includes an at-a-glance dashboard on the job report page:

    • • KPI tiles for subdomains, live hosts, technologies, sensitive paths, and known CVEs
    • • Interactive charts: attack surface funnel, HTTP status breakdown, vulnerability vectors, security grades, scan progress
    • • Subdomain prefix and technology word maps for pattern spotting at a glance
    • • Click a chart or stat and it scrolls to the tool output that produced it

    Known CVE & Exploit Research

    A dedicated final-phase agent aggregates discovered technologies and searches the web for real-world exploits:

    • • Grok-powered web search across CVE databases, advisories, and public exploit sources
    • • A CVE counts only when it applies to the software version found on the target
    • • Confirmed CVE table with severity breakdown and full, non-truncated research output
    • • Noise-filtered technology fingerprinting so the stack map reflects real services, not scanner artifacts

    Scheduled Scans

    Continuous monitoring without manual resubmission. Configure recurring scans in Advanced Settings and the full 45-agent pipeline re-runs on autopilot.

    • • One-time, daily, weekly, or monthly cadence
    • • Day-of-week or day-of-month for predictable assessment windows
    • • Local timezone support so runs land during your business hours
    • • Ideal for portfolio monitoring, compliance cadences, and bounty program coverage

    Why scheduled scans pay off: automatic diffs

    A re-scan by itself is just more data. SquidScanner compares every completed job to the previous completed scan of the same domain and highlights what changed. Teams triage new risk instead of re-reading the whole surface.

    • • New or removed subdomains and live hosts
    • • Technology stack changes and confirmed CVE deltas
    • • Sensitive paths, takeover candidates, open redirects, and header grade shifts
    • • Nuclei severity count deltas for quick risk trend reads
    • • Dedicated Scan Changes view, job-list indicators, PDF section, and email context

    Business outcome: schedule weekly recon once, then report “what appeared this week” to executives or clients without a manual before/after analysis.

    Bounty Platform Integration

    Teams running bug bounty programs can connect HackerOne or Bugcrowd directly:

    • • Link API credentials once. Programs and in-scope assets sync from there
    • • Pick a bounty program and select targets from the live scope list when starting a scan
    • • Run All In Scope queues recon across every eligible domain in a single action

    PDF Export, Email & Sharing

    Deliver findings without reformatting or copy-paste:

    • • Sectioned PDF: summary, AI analysis, phases, and scan changes
    • • Scan-complete emails with Grok executive report delivery
    • • Public shareable reports when you need stakeholder visibility

    Operator Badge System

    Gamified progress tracking keeps security teams engaged and surfaces expertise:

    • • 100+ badges for discoveries, OWASP categories, CVE confirmations, streaks, and milestones
    • • Stackable counts show how often each finding class has been detected across targets
    • • Share badge details on LinkedIn and X. Public profiles show what was earned
    SEE IT IN ACTION

    Real screenshots from the live platform

    Job submission, bounty scope, scheduled recon, diffs, badges, charts, PDF export, and the Grok report. One dashboard.

    SquidScan jobs dashboard: scan starter and job list

    Submit a domain and track all 45 agents across your jobs

    SquidScan Recon Intelligence Dashboard with charts and KPIs

    Recon Intelligence: KPI tiles, charts, and word maps

    SquidScan Technology Stack Map and Grok AI Report

    Technology fingerprinting and Grok-powered executive analysis

    SquidScan badge system: earned badges with stackable counts and share options

    Badge system: discovery milestones you can share

    SquidScan HackerOne integration: bounty program picker and scope target selection

    HackerOne: sync programs and pick in-scope targets

    SquidScan scheduled scans: recurring weekly scan configuration in Advanced Settings

    Scheduled scans: recurring recon that diffs against the last run

    What you are actually buying

    The scanners are table stakes. The report, the diff, and the version check are the product.

    AI Executive Reports

    Grok writes a report a non-operator can finish. You are not handing a director a nuclei dump and asking them to care.

    Fully Autonomous

    Nobody sits on 15 terminals. The pipeline runs from subdomain enumeration through the final report.

    Built-in Guardrails

    Strong legal and operational controls (including self-service domain opt-out) so you can confidently recommend the tool without compliance concerns.

    Rapid Time-to-Insight

    Get comprehensive attack surface visibility in hours instead of days. Ideal for security assessments, M&A due diligence, and continuous monitoring programs.

    Consistent Quality at Scale

    Every assessment follows the same rigorous methodology. No more variance based on who is running the tools or how much time they have.

    Modern Attack Surface Coverage

    Goes beyond traditional scanning with historical data (Wayback), certificate intelligence, GitHub reconnaissance, and public leak detection.

    Visual Recon Intelligence

    Interactive charts, KPI tiles, and word maps turn hundreds of tool outputs into a single attack-surface picture. Stakeholders can explore findings without reading raw logs.

    Version-Validated CVE Matching

    Known CVE counts include only exploits that match the software versions found. Fewer theoretical hits. A shorter remediation list.

    Evidence-Linked Drilldowns

    Click a metric or chart segment and you land on the tool output behind it. Audits and handoffs do not depend on someone remembering which log mattered.

    HackerOne & Bugcrowd Scope Sync

    Connect bounty program platforms on the operator profile and pull in-scope assets automatically. Security teams stay within program boundaries without maintaining separate target lists.

    Automated Scan Schedules

    One-time, daily, weekly, or monthly, in the local timezone. Nobody resubmits the job. The full agent pipeline runs again on that schedule.

    Attack-Surface Change Detection

    Every completed scan is compared to the prior run of the same domain. New hosts, technologies, CVEs, sensitive paths, and grade shifts show up as changes, not as another full dump.

    Operator Achievement Badges

    Over 100 earnable badges track discovery milestones, OWASP coverage, and scan streaks. Stackable counts and shareable profiles help demonstrate team expertise and engagement.

    PDF Export & Shareable Reports

    Export sectioned PDFs (including scan changes), email Grok executive reports on completion, and share public report links when stakeholders need visibility without dashboard access.

    What matters when you are the one recommending it

    ✓

    Faster Time-to-Value

    Teams get meaningful results in hours instead of days or weeks. Great for proof-of-concept, pilot projects, and time-sensitive assessments.

    ✓

    Consistent, High-Quality Deliverables

    Every report follows the same method. Quality does not swing with whoever had time to run the tools that week.

    ✓

    Stakeholder-Friendly Output

    You can hand the final AI report to executives, risk committees, or clients without heavy editing. Reports are designed to be read, not just filed.

    ✓

    Lower Total Cost of Ownership

    Reduces reliance on expensive manual consulting hours for discovery work. One token = one complete, AI-analyzed assessment.

    ✓

    Responsible & Compliant by Design

    Built-in domain opt-out, strong audit logging, and clear terms of use make it easier to get legal and procurement approval.

    ✓

    Modern AI Capabilities

    Grok writes the synthesis. The scanners still do the scanning. The model is there to rank what matters, not to replace subfinder.

    ✓

    Comprehensive Attack Surface Visibility

    Combines traditional scanning with modern techniques: historical data from Wayback Machine, certificate transparency logs, GitHub reconnaissance, and public leak detection.

    ✓

    Scalable & Repeatable Process

    Perfect for continuous monitoring programs, regular assessments, or scaling security reviews across a large portfolio of assets.

    ✓

    Visual Attack-Surface Summaries

    Executives and analysts get charts. Engineers still get the raw tool output one click under those charts.

    ✓

    Actionable CVE Intelligence

    Known exploit research ties CVEs to the software versions found on the target. Remediation starts with confirmed risk, not a CVE list that might not apply.

    ✓

    Bug Bounty Program Ready

    HackerOne and Bugcrowd scope sync keeps scans on authorized targets. Run All In Scope covers an eligible program in one action, without a spreadsheet of hosts.

    ✓

    Hands-Free Continuous Monitoring

    Daily, weekly, or monthly scans run without someone clicking submit, in the timezone you set. Built for programs that need the same method every cycle, not a one-off.

    ✓

    Diff-Based Trend Reporting

    Automatic scan-to-scan comparison answers the question stakeholders actually ask: what changed? New hosts, CVEs, and exposures show up as deltas. You do not reprint the full report every cycle.

    ✓

    Export-Ready Deliverables

    Sectioned PDF exports (including scan changes), scan-complete email with Grok executive reports, and optional public share links make it easy to hand findings to executives, clients, or program managers without reformatting.

    ✓

    Team Engagement & Expertise Tracking

    The badge system surfaces who is finding what across your organization. Shareable achievements and public profiles help demonstrate security team maturity to stakeholders.

    COMPLETE TOOLKIT

    Every Tool Has Its Own AI Agent

    Below is the full list of reconnaissance tools SquidScanner runs, along with what each specialized AI agent accomplishes.

    Subdomain & Infrastructure Discovery

    • subfinder: Discovers subdomains from dozens of public data sources and APIs.
    • findomain: Fast subdomain enumeration using multiple passive sources.
    • wayback: Analyzes historical web archives to find old or forgotten endpoints and parameters.
    • crtsh: Queries Certificate Transparency logs to reveal additional subdomains and certificates.
    • dnsx: Performs fast DNS resolution and wildcard filtering on discovered domains.
    • dnsrecon: Conducts comprehensive DNS reconnaissance including zone transfers and record enumeration.
    • subdomain takeover: Detects dangling CNAME records and vulnerable subdomain takeover conditions via fingerprint matching.

    Network & Service Scanning

    • host alive: Probes discovered subdomains to identify reachable HTTP/S hosts before active scanning.
    • sensitive paths: Checks for exposed .git, .env, backups, and other sensitive configuration files.
    • naabu: Fast port scanning to identify open services and potential entry points.
    • httpx: Probes discovered hosts to determine live web services and technologies.
    • katana: Crawls websites to discover hidden paths, endpoints, and JavaScript files.
    • feroxbuster: Directory and file brute-forcing to find hidden resources.
    • gobuster: Directory, DNS, and virtual host enumeration.
    • ffuf: Flexible fuzzing for directories, parameters, and virtual hosts.

    Vulnerability & Web Security

    • nuclei: Template-based scanning for known vulnerabilities and misconfigurations.
    • nikto: Web server scanner for outdated software and common vulnerabilities.
    • arjun: Parameter discovery to find hidden input fields.
    • ssrf scanner: Detects potential Server-Side Request Forgery vectors.
    • open redirect scanner: Detects open redirect vulnerabilities that can lead to phishing and account takeover.
    • ssti detector: Identifies Server-Side Template Injection opportunities.
    • xxe scanner: Tests for XML External Entity vulnerabilities.
    • cache poisoning: Detects web cache poisoning risks via unkeyed headers and parameters.
    • graphql scanner: Discovers GraphQL endpoints and tests for introspection, auth bypass, and injection flaws.
    • web scraper: Deep content scraping to uncover hidden data, secrets, and sensitive information.

    Specialized & Intelligence Gathering

    • github dork: Searches public GitHub repositories and code for secrets and internal references.
    • public leak: Scans paste sites and gists for leaked credentials or infrastructure details.
    • theharvester: Gathers emails, subdomains, and employee names from public sources.
    • cloudenum: Enumerates cloud storage buckets and resources.
    • package registry: Searches public package registries (npm, PyPI) for related projects.
    • dockerhub: Looks for publicly available Docker images related to the target.
    • jwt oauth analyzer: Extracts and analyzes JWT tokens and OAuth configurations.
    • cors scanner: Detects misconfigured Cross-Origin Resource Sharing policies.
    • firewall evasion: Advanced WAF bypass testing using header manipulation, method tampering, and behavioral analysis.
    • origin ip sniffer: Discovers real origin server IPs behind CDNs/WAFs via historical DNS, certificate transparency, favicon hashing, and targeted probing.
    • snmp enumerator: Performs SNMP community string checks on network devices.
    • ldap smb nfs: Enumerates LDAP, SMB, and NFS services where exposed.
    • waf whatweb: Identifies web application firewalls and underlying technologies.
    • security headers: Grades HSTS, CSP, and cookie security flags across live web services.
    • enum4linux ng: Performs SMB and Windows enumeration on exposed services.
    • testssl: Analyzes SSL/TLS configurations for weaknesses.
    • wordpress: Specialized scanning for WordPress installations and vulnerabilities.

    Known Exploits Phase (phase 8, last stage)

    • known exploits: Aggregates all discovered technologies from prior phases, then uses Grok with live web search to find known CVEs and public exploits. Matches are checked against the software version detected on the target. Only confirmed hits appear in the Known CVEs metric and the executive report. Research output is kept in full.

    45 tools across 8 phases. Each tool runs in its own agent. The agent parses the output and feeds the Grok report.

    Run it on a domain you own.

    The free preview is a real scan, not a slideshow. If the report is useful, buy a pack. Scans do not expire.

    Start free scan

    Questions? Email us at contact@squidhacker.com