First visit · operator briefing

Free vs Pro

Codename Sonar is defensive reconnaissance. Free is enough to ping a host you own — guests get two sweeps a day, signed-in Free gets five. Pro unlocks the full VPC network: Apps menu (Zenmap, Lynis, Zeek, Maltego, GSA, Wireshark, ZAP…), optical / infrared / thermal lock, unlimited sweeps, and operator exports — $9.99/month or $99.99/year through PayPal, with a 7-day free trial first.

Free

5 scans / day

Pro month

$9.99

after 7-day trial

Pro year

$99.99

after 7-day trial

7-day free trialno card · one per account

Try Pro free for 7 days

Every Pro feature for 7 days. When it ends the account drops back to Free on its own — no charge. Then Pro is $9.99/month or $99.99/year.

Included

Free

Default

$0forever

Sign in, run five scans a day (guests two), keep the last three results. Satellite optical / infrared / thermal and quick profiles stay open.

Daily scansGuest 2/day · signed-in 5/day
Scan profilesPing + Quick
Kali Applications menuMenu + ping/quick analogs
Timing templatesT1–T3
Ping / host discoveryIncluded
Forward and reverse DNSA/AAAA, CNAME, PTR, FCrDNS
Geo / ASN / ISP / RDAPIncluded
Satellite lockOptical · infrared · thermal
Port errata (what each port does)Included
Share to X / Instagram / FacebookIncluded
Custom ports—
Traceroute world-mapMain scan and DNS desk
Version / OS / TLS / UDP—
OAuth 2.0 RFC 8414—
OpenVAS-style NVTs—
CIS / NIST / CISA scorecard—
Analyst briefing—
SIEM + CSV/PDF + STIX 2.1—
Packet capture (Wire)Scan rebuild + 2 MB PCAP
Scan archiveLast 3
Watchlist + asset inventory—
Certificate expiry watch—
Mail auth (SPF / DMARC / MX)Included
Email address checkSyntax + MX / SPF / DMARC
Email origin traceReceived hop parse
DKIM / BIMI / MTA-STS—
DNSSEC + CAAIncluded
WAF / CDN / tech stack—
security.txt + CT names—
HTTP header observatory—
Nikto / nuclei path checks—
WPScan / CMS surface—
Gobuster / dirb paths—
Cookie · CORS · TRACE audit—
theHarvester emails—
Wayback URL count—
Zero Trust scorecard—
CISA KEV + exploit likelihood—
Ransomware readiness—
Detection pack—
IR playbooks (NIST 800-61)—
Threat hunts + purple tests—
Telemetry + segmentation plan—
Governance mapping—
CISA BOD 22-01 patch queue—
FAIR-lite residual loss—
Cyber insurance questionnaire—
CIS Benchmarks (inferred)—
SBOM-lite + attack path—
ACL as code—
Kali Cloud Desktop—

Full VPC Network

Pro

Recommended

Unlimited recon, Apps menu (Kali + Parrot + Blue Team), every profile including Kali recon, OSS toolkit, governance mapping, SIEM/STIX exports, watchlist, and a 50-scan archive. Auto-renews monthly or yearly — pick on checkout. New accounts can try every Pro feature free for 7 days first.

Daily scansUnlimited
Scan profilesIntense, comprehensive, web, stealth, Kali recon
Kali Applications menuZenmap, qterminal, GSA, Wireshark, ZAP — this sweep
Timing templatesT1–T5 including stealth
Ping / host discoveryIncluded
Forward and reverse DNSIncluded
Geo / ASN / ISP / RDAPIncluded
Satellite lockOptical · infrared · thermal
Port errata (what each port does)Included
Share to X / Instagram / FacebookIncluded
Custom portsRanges and lists
Traceroute world-mapIncluded
Version / OS / TLS / UDPIncluded
OAuth 2.0 RFC 8414Discovery + grade A–F
OpenVAS-style NVTsFull and fast · version CVE · families
CIS / NIST / CISA scorecardIncluded
Analyst briefingIncluded
SIEM + CSV/PDF + STIX 2.1Included
Packet capture (Wire)25 MB PCAP, follow stream, export
Scan archiveLast 50 + port diff
Watchlist + asset inventoryIncluded
Certificate expiry watchIncluded
Mail auth (SPF / DMARC / MX)Included
Email address checkSMTP mailbox exists, catch-all, DKIM
Email origin traceGeo + reverse DNS per hop
DKIM / BIMI / MTA-STSMail DNS
DNSSEC + CAAIncluded
WAF / CDN / tech stackWhatWeb / Wappalyzer-style
security.txt + CT namesIncluded
HTTP header observatoryA+–F grade (securityheaders)
Nikto / nuclei path checks.git, .env, phpMyAdmin, actuators
WPScan / CMS surfaceWordPress, Joomla, Next.js
Gobuster / dirb pathsShort high-signal wordlist
Cookie · CORS · TRACE auditHttpOnly / Secure / SameSite
theHarvester emailsHomepage mailboxes
Wayback URL countArchive.org CDX
Zero Trust scorecardIdentity · device · network · app · data
CISA KEV + exploit likelihoodMatched to this sweep
Ransomware readinessSMB/RDP/backup posture
Detection packSigma · Suricata · Snort · Zeek · Elastic · Splunk
IR playbooks (NIST 800-61)Detect · contain · eradicate · recover
Threat hunts + purple testsQueries from this surface
Telemetry + segmentation planWhat to log and isolate
Governance mappingPCI DSS 4.0 · ISO 27001 · SOC 2 · HIPAA · 800-53 · ASVS
CISA BOD 22-01 patch queue15-day internet-facing KEV clock + compensating controls
FAIR-lite residual lossBoard heat map + USD bands from this host
Cyber insurance questionnaireNYDFS / NAIC-style filled from the sweep
CIS Benchmarks (inferred)Linux, Windows, Apache, Redis, Docker, K8s
SBOM-lite + attack pathInventory + likely kill chain from this vantage
ACL as codenftables · iptables · AWS SG · Cloudflare WAF
Kali Cloud DesktopAlpha · DigitalOcean Kali + Java terminal

New on Pro

Defender VPC network

Kali · Intense · Web · Comprehensive · Stealth

One Pro sweep now folds in the Apps menu (Zenmap, Nikto, Lynis, Zeek, Suricata, Maltego, Gobuster, GSA, Wireshark, ZAP…) plus optical / infrared / thermal satellite lock and a defender suite: Zero Trust, KEV, detection packs, IR playbooks, PCI/ISO/SOC 2/HIPAA mapping, a BOD 22-01 patch queue, FAIR-lite residual loss, CIS Benchmarks, ACL-as-code, YARA, SOAR, and deception — still defensive, no exploit payloads.

Kali Applications

Click a package: Zenmap, qterminal, Greenbone GSA, Wireshark, ZAP, Observatory, Dradis — filled from this sweep

Parrot OS extras

AnonSurf, FinalRecon, Caido, Amass, NetExec, airgeddon, Empire/Sliver — Parrot packages Kali does not ship on its Applications menu

Kali recon profile

Top-160 ports + toolkit + NVT + TLS; Metasploit/Hydra/DoS stay off VPC network

Satellite optical / IR / thermal

NASA GIBS + ArcGIS lock — tabs for daylight, infrared, land-surface temperature

OpenVAS NVTs

Greenbone-style families, OIDs, QoD, banner/version CVE matching, web path tests

Nikto + nuclei paths

Defensive checks for /.git, /.env, phpMyAdmin, actuators, TRACE

WPScan / Joomscan

WordPress login, xmlrpc, wp-json, Joomla administrator

Gobuster / dirb

Short high-signal directory wordlist, no SecLists dump

httpx / WhatWeb / Wafw00f

Status, title, CMS, CDN/WAF from headers — no active WAF trip

theHarvester + recon-ng

Homepage emails, wayback CDX, security.txt, crt.sh names

dnsrecon mail DNS

DKIM selectors, BIMI, MTA-STS besides SPF/DMARC

testssl.sh / sslscan

Certificate, protocol, ALPN, trust flag on 443/8443

Mailbox existence

SMTP RCPT probe, catch-all detection, hop-by-hop Received trace

searchsploit

CVE → Exploit-DB search links only. No payloads.

OAuth 2.0 RFC 8414

Authorization-server discovery, PKCE, HTTPS-only grade

Zero Trust scorecard

NIST 800-207 pillars scored from this host

CISA KEV matching

EternalBlue, BlueKeep, Log4Shell, Exchange, VPN, Redis…

Detection pack

Sigma / Suricata / Snort / Zeek / Elastic / Splunk rules

IR playbooks

NIST 800-61 detect-contain-eradicate-recover plus D3FEND

Hunts + purple team

Hypotheses, queries, and tabletop tests from the surface

Governance mapping

PCI DSS 4.0, ISO 27001:2022, SOC 2, HIPAA, NIST 800-53, OWASP ASVS, CIS IG1

BOD 22-01 patch queue

15-day internet-facing KEV SLA, EPSS rank, compensating controls

FAIR-lite + insurance

Residual USD bands, board heat map, NYDFS/NAIC questionnaire

CIS Benchmarks + SBOM

Inferred checks for the OS/app you actually published

ACL as code

nftables, iptables, AWS security groups, Cloudflare WAF expressions

YARA · SOAR · Engage

Webshell rules, TheHive case, Shuffle isolate, MITRE Engage, canaries

Kali Cloud Desktop

Pro Alpha: DigitalOcean Kubernetes Kali shell; Java SSH terminal

Apps arsenal

Every Apps-menu package

Same tiles you open after a sweep, including twenty Blue Team apps (Lynis through Censys, plus checkdmarc, oauth2c, OpenSCAP, MISP, ntopng, CrowdSec, and TheHive). Each card has its man page. Free runs ping/quick analogs. Pro fills the live host. Off VPC Network tools still open as apps — then refuse to fire.

Nmap / Zenmap

Information Gathering

Free Quick port set · Pro Top-160, custom lists, version/OS

man nmap(1)

dnsrecon / dnsenum

Information Gathering

Free A/AAAA/MX/NS/TXT/PTR · Pro CAA, DNSSEC, related names

man dnsrecon(1)

whois / RDAP

Information Gathering

Free Included · Pro Included

man whois(1)

theHarvester

Information Gathering

Free — · Pro Homepage emails

man theHarvester(1)

WhatWeb / Wappalyzer

Information Gathering

Free — · Pro Stack fingerprint

man whatweb(1)

Wafw00f

Information Gathering

Free — · Pro Passive CDN/WAF

man wafw00f(1)

Recon-ng / SpiderFoot

Information Gathering

Free — · Pro Wayback, security.txt, crt.sh

man recon-ng(1)

lbd

Information Gathering

Free Multiple A records · Pro Included

man lbd(1)

traceroute

Information Gathering

Free Main scan and DNS desk hop path · Pro Hop path + world map

man traceroute(8)

netdiscover / ping

Information Gathering

Free TCP ping · Pro Included

man netdiscover(8)

enum4linux / smbmap

Information Gathering

Free — · Pro 139/445 noted · no share brute

man enum4linux-ng(1)

OpenVAS / GVM

Vulnerability Analysis

Free — · Pro NVT families, OID, QoD

man gvm-cli(8)

Nikto

Web Application Analysis

Free — · Pro Dangerous path list

man nikto(1)

WPScan

Web Application Analysis

Free — · Pro WP login / REST / XML-RPC

man wpscan(1)

httpx / httprobe

Web Application Analysis

Free — · Pro Status, title, headers

man httpx(1)

Gobuster / dirb

Web Application Analysis

Free — · Pro Short directory wordlist

man gobuster(1)

Nuclei

Web Application Analysis

Free — · Pro Actuator / debug templates

man nuclei(1)

testssl.sh / sslscan

Web Application Analysis

Free — · Pro Cert, protocol, ALPN

man testssl.sh(1)

securityheaders

Web Application Analysis

Free — · Pro A+–F header grade

man lynis(1)

ZAP / Burp (passive)

Web Application Analysis

Free — · Pro Cookies, CORS, methods

man zap(1)

searchsploit

Exploitation Tools

Free — · Pro Exploit-DB search links

man searchsploit(1)

Wireshark / tcpdump

Sniffing & Spoofing

Free Sweep reconstruct · 2 MB · Pro 25 MB PCAP, follow stream

man tshark(1)

Dradis / Faraday

Reporting Tools

Free On-screen report · Pro SIEM · STIX · PDF export

man dradis(1)

FinalRecon

Information Gathering

Free — · Pro DNS + WHOIS + headers + TLS

man finalrecon(1)

OWASP Amass

Information Gathering

Free — · Pro Passive related names

man amass(1)

subfinder

Information Gathering

Free — · Pro Passive subdomains

man subfinder(1)

TruffleHog

Information Gathering

Free — · Pro .env / .git path check

man trufflehog(1)

Caido

Web Application Analysis

Free — · Pro Passive proxy analog

man caido(1)

Wapiti

Web Application Analysis

Free — · Pro Findings as modules

man wapiti(1)

ffuf

Web Application Analysis

Free — · Pro Short path fuzz

man ffuf(1)

CMSeeK

Web Application Analysis

Free — · Pro CMS fingerprint

man cmseek(1)

NetExec

Information Gathering

Free — · Pro 139/445 noted · no spray

man nxc(1)

EyeWitness

Reporting Tools

Free HTTP title · Pro HTTP title · status

man eyewitness(1)

Lynis

Blue Team

Free Header / TLS checklist · Pro Full hardening analog

man lynis(8)

p0f

Blue Team

Free OS / Server header · Pro Passive fingerprint

man p0f(1)

Maltego CE

Blue Team

Free DNS + IP graph · Pro Emails, RDAP, related hosts

man maltego(1)

SpiderFoot

Blue Team

Free — · Pro OSINT modules from toolkit

man spiderfoot(1)

Sherlock

Blue Team

Free — · Pro Usernames from harvested emails

man sherlock(1)

dnstwist

Blue Team

Free — · Pro Related / lookalike names

man dnstwist(1)

Zeek

Blue Team

Free conn.log from ports · Pro http.log + dns.log

man zeek(8)

Suricata

Blue Team

Free — · Pro EVE alerts from NVTs

man suricata(1)

osquery

Blue Team

Free listening_ports · Pro certificates table

man osqueryi(1)

Sigma

Blue Team

Free — · Pro YAML detections from findings

man sigma(1)

Legion

Blue Team

Free Port table · Pro Version / OS columns

man legion(1)

metagoofil

Blue Team

Free HTML title · Pro Tech + security.txt

man metagoofil(1)

checkdmarc

Blue Team

Free MX / SPF / DMARC if published · Pro DKIM, BIMI, MTA-STS, AXFR

man checkdmarc(1)

oauth2c

Blue Team

Free — · Pro OIDC discovery + RFC 9700 checks

man oauth2c(1)

OpenSCAP

Blue Team

Free High-level grade · Pro CIS / NIST / PCI / CISA OVAL

man oscap(8)

MISP

Blue Team

Free IP / domain attributes · Pro CVE + ATT&CK + ASN event

man misp(1)

ntopng

Blue Team

Free Ping RTT · Pro Hop path + listener latency

man ntopng(8)

CrowdSec

Blue Team

Free Hosting/proxy clue · Pro Decisions from WAN listeners

man cscli(1)

TheHive

Blue Team

Free — · Pro Cases from NVTs + ATT&CK

man thehive(1)

Censys

Blue Team

Free IP + ASN · Pro Cert, CAA, days-to-expiry, listeners

man censys(1)

GreyNoise

Investigate

Free Hosting / proxy class · Pro ASN, org, timezone, RIOT analog

man greynoise(1)

urlscan.io

Investigate

Free Status + title · Pro Redirect, robots, security headers, HTTP/2

man urlscan(1)

crt.sh

Investigate

Free — · Pro Fingerprint, issuer, CAA, related names

man crtsh(1)

BGPView

Investigate

Free ASN if geo locked · Pro Prefix, netname, traceroute path

man bgpview(1)

JA4

Investigate

Free — · Pro TLS protocol + ALPN handshake analog

man ja4(1)

IOC Workbench

Investigate

Free IP + domain · Pro Cert, emails, CVEs, exposures, OIDC

man ioc-workbench(1)

Kali Cloud Desktop

Blue Team

Free — · Pro Alpha: DigitalOcean Kali + Java SSH terminal

man kali-cloud(8)

sqlmap

Database Assessment