Drive every server-side tool from your own scripts and pipelines with scoped API keys. Recon, scanning and lookups - fully programmable.
Restrict a key to specific tools; track usage; revoke anytime.
Standard Authorization: Bearer. Works with any HTTP client.
Rate limits, scope rules and SSRF protection apply to API calls too.
A WHOIS lookup with scope enforcement. Same body shape on every tool.
curl -X POST https://arsenly.com/api/v1/tools/whois \
-H "Authorization: Bearer $XOWIA_KEY" \
-H "Content-Type: application/json" \
-d '{"domain":"example.com","project_id":42}'
import os, requests
resp = requests.post(
"https://arsenly.com/api/v1/tools/whois",
headers={"Authorization": f"Bearer {os.environ['XOWIA_KEY']}"},
json={"domain": "example.com", "project_id": 42},
timeout=30,
)
print(resp.json()["signals"])
const res = await fetch("https://arsenly.com/api/v1/tools/whois", {
method: "POST",
headers: {
"Authorization": `Bearer ${process.env.XOWIA_KEY}`,
"Content-Type": "application/json",
},
body: JSON.stringify({ domain: "example.com", project_id: 42 }),
});
console.log(await res.json());
Errors: 401 auth · 402 tokens · 403 plan · 422 scope · 429 rate limit.
Every response carries X-Request-ID for support correlation.
24 server tools are API-callable
Aggregate subdomains from 11 passive sources (crt.sh, OTX, CertSpotter, Anubis, SubdomainCenter, RapidDNS, Wayback, urlscan.io, HackerTarget, Shodan and more) into one ranked list. Batch up to 3 domains, detect wildcard DNS, optionally resolve DNS or probe HTTP alive. Highlights interesting subdomain patterns and exports with handoff to ProbeMaster, DNS Recon Pro, Takeover Scan and Vuln Scanner.
RDAP and port-43 WHOIS combined into one structured record. Batch up to 3 targets, accepts IDN, follows registrar referrals. Surfaces drop-catch and redemption alerts, groups EPP status codes, names the privacy provider, recognises 50+ DNS hosts and badges key signals (DNSSEC, lock, expiry, age). Harvested emails pivot in one click to ViewDNS, WhoXY, Hunter.io, HIBP and IntelX.
Resolve all common DNS records (A, AAAA, CNAME, MX, NS, TXT, CAA, SOA, SRV) for up to 3 domains at once. Follows CNAME chains with NXDOMAIN takeover detection, fingerprints 45+ services, probes 15 DKIM selectors, parses SPF mechanism by mechanism and DMARC tag by tag, and checks DNSSEC, MTA-STS, TLS-RPT and BIMI. Markdown and JSON export.
Full domain intelligence for up to 3 domains. DoH-based DNS records, DNSSEC, CAA, SRV, MTA-STS, TLS-RPT, BIMI, SPF mechanism breakdown, DMARC tag table, 15 DKIM selectors, TXT vendor classification, CNAME-chain takeover detection, per-IP ASN / ports / CVEs (Shodan + Team Cymru), RDAP registration, AXFR test and CT-log hostnames. Findings ranked by severity.
Pull historical URLs from the Internet Archive and AlienVault OTX for up to 3 domains, with date-range filter. Mines parameters with risk tags (open-redirect, SSRF, LFI), groups URLs into endpoint patterns, categorises sensitive files (.env, .bak, .sql), and surfaces a Tokens-in-URLs view (JWT, AWS, Google, Stripe, Slack, GitHub keys). Advanced filters, archive replay, copy-as-ffuf and MD / CSV / TXT export.
Harvest robots.txt (per user-agent), recurse gzipped sitemap indexes, fetch lastmod-sorted URLs, and pull 14 well-known files (security.txt, Asset Links, AASA, OIDC, OAuth metadata, host-meta, JWKS, NodeInfo) plus ads.txt. Classifies disclosed paths into 13 categories with uniqueness scoring, generates probe variants and validates security.txt against RFC 9116. Batch up to 3 domains.
Map every web asset likely owned by the same entity. Scrapes analytics, AdSense, GTM and Pixel IDs from the homepage, computes the favicon hash, does reverse-IP and ASN, then hands you the reverse-WHOIS, PublicWWW, SpyOnWeb and Shodan pivots.
Batch-extract EXIF / IPTC / XMP from uploads, URLs or pasted images. Pulls GPS (reverse-geocoded, GPX / KML export), device serials, owner, embedded thumbnail (hidden-crop) and edit / tamper signals.
Passive open-port and CVE exposure lookup (Shodan InternetDB), plus ready-to-run nmap, naabu and rustscan commands you can run from your own machine.
Bulk-probe hosts in parallel for status, redirects, title, tech stack, server, IP and timing. Flags notable findings (directory listing, phpinfo, API docs) with filtering and export.
Fingerprint the stack (server, CMS, frameworks, JS libs, CDN / WAF) with versions, confidence and inline CVE flags. Deep scan reads assets for exact versions, leaked keys and favicon hash. Bulk mode maps a list of hosts.
Passive GitHub code-search for leaked secrets, internal hostnames and config tied to a target org, domain or keyword. Combines your target with high-signal secret patterns (.env, API keys, private keys, internal URLs), classifies matches by likely credential type and links straight to the offending file. Falls back to ready-to-click GitHub, GitLab and SourceGraph search links when no API token is configured.
All-in-one passive and opt-in active scanner. Feed a URL or a raw HTTP request and surface misconfigurations and vulnerabilities, graded by severity.
Grade a URL's security posture across HSTS, CSP, XFO and cookies. Audits cookie flags (Secure, HttpOnly, SameSite), info-disclosure leaks, CORS exposure and redirect chains, with prioritised findings.
Deep Content-Security-Policy analysis with per-directive source classification and real bypass detection (unsafe-inline, unsafe-eval, wildcards, data:, JSONP and AngularJS whitelist bypasses). Includes a graded score and a hardened-policy generator.
Fire a battery of crafted-Origin probes (reflection, null, sub-domain, prefix/suffix and HTTP-downgrade bypasses) plus a pre-flight check, with a credentials-aware verdict and an auto-generated exploit PoC.
Resolve CNAME chains and match against 30+ takeover-prone services (S3, GitHub, Heroku, Azure, Netlify and more). Detects NXDOMAIN dangling, verifies with a live error-fingerprint, and ranks verdicts with the claim method.
Automated open-redirect scan (rich bypass payloads, external canary), plus an SSRF toolkit with any-IP encoder (decimal, hex, octal, IPv6), localhost / metadata / protocol-smuggling payloads, curl / ffuf / Burp commands and OOB guidance.
Crawl a target URL, harvest its JavaScript bundles, inline scripts and source maps, and scan all of it for ~40 curated secret patterns (AWS, GCP, Stripe, Razorpay, Slack, GitHub, GitLab, SendGrid, Mailgun, Twilio, Discord, Telegram, npm, PyPI, DigitalOcean, Cloudflare, Linear, Square, PEM private keys, JWTs, internal URLs and more) plus a Shannon-entropy heuristic for unclassified high-entropy strings. Findings grouped by severity, masked by default, with snippet context, source-map awareness, JSON / CSV / Markdown export and Burp handoff. Pro tier server-side; hard caps keep scans under 60s and 12MB.
Analyse a GraphQL API from its introspection schema. Paste an introspection response or fetch the endpoint, then surface introspection-in-production, dangerous mutations (delete/update/admin/setRole), sensitive fields exposed in types, deep-query and batching denial-of-service surface, field-suggestion leakage and CSRF-over-GET. Returns severity-graded findings, a full Query / Mutation / Subscription map and ready-to-run aliasing, deep-nesting and batched attack queries for Burp or curl.
Out-of-Band interaction listener (Burp-Collaborator-style canary tokens) for SSRF, blind XSS, XXE, Log4Shell, CSV injection and email-pixel tracking. Generate a unique URL, plant it during testing, then see every inbound hit in real-time with full method, headers, body, IP, UA and referer. 12 ready-to-copy payload templates and cURL reproduction.
CVE detail and product search with prioritisation signals: CVSS, EPSS exploit-probability, CISA KEV (actively-exploited) status, SSVC, CWE and categorised exploit / patch references.
Browse Bugcrowd's Vulnerability Rating Taxonomy with bug-class definitions, severity priorities and CVSS mappings. Searchable and filterable, useful for triaging finds and writing reports.
Pentest scratchpad with a Markdown editor, live preview, YAML frontmatter tags, pinning, full-text search across all notes, 5 templates (Recon log, Bug write-up, Engagement summary, Quick ref, OWASP checklist), 2-second auto-save, multi-format export (MD, HTML, TXT), keyboard shortcuts (Ctrl+S, Ctrl+N), saved to your account.
Full endpoint reference, scope-aware examples and CLI snippets land in your account the moment you upgrade.