We build on open source.Here's what we share.
Braintruder runs on tools the security community built and maintains. We publish brainproxy as open source and run a free domain scanner, and we credit the projects both rely on below. Use them on your own systems, with no paid plan to unlock.
Attack Surface Scanner by Braintruder
A free external check of your company domain. You get a graded report, A to F, with a plain-English fix for every finding.
- Email, TLS, web, DNS, exposed services and known vulnerabilities
- Light-touch by default: public DNS and certificate data and a few web requests
- Port and exposure checks once you've shown you control the domain
brainproxy
A free, open-source toolkit for testing your own web apps. It's one of the tools Braintruder runs, published so you can run it too: a guided scan, readable reports and the full toolkit when you want to dig deeper.
- Guided scan: pick Quick, Standard or Thorough and get a report with what to fix first
- Nothing is sent to a target until you set a scope, and every request is checked against it
- Desktop app for macOS, Windows and Linux, plus a full CLI for scripting
None of this started with us. We know that.
Braintruder drives mainstream penetration-testing Linux distributions, including their whole toolset - hundreds of tools, most of them open source and built by the community. brainproxy, the web testing toolkit we built for it, carries scan rules ported from ZAP, vulnerable-library data from Retire.js, checks in ProjectDiscovery's Nuclei template format and wordlists from SecLists and PayloadsAllTheThings. The Attack Surface Scanner by Braintruder runs ProjectDiscovery's subfinder, dnsx, httpx, tlsx, naabu and Nuclei, plus WhatWeb, with takeover fingerprints from can-i-take-over-xyz. People across the community wrote and shared that work, and we want to say so plainly.
The full list, with licences, is in brainproxy's NOTICE file.
When a check isn't enough, Braintruder investigates.
The free tools give you a clear first look. When you need to know what an attacker could actually exploit, Braintruder investigates like one, proves each finding with evidence and grades the results against Cyber Essentials, Cyber Essentials Plus and ISO 27001.