First visit · operator briefing

Free vs Pro

Codename Sonar is defensive reconnaissance. Free is enough to ping a host you own — guests get two sweeps a day, signed-in Free gets five. Pro unlocks the full VPC network: Apps menu (Zenmap, Lynis, Zeek, Maltego, GSA, Wireshark, ZAP…), optical / infrared / thermal lock, unlimited sweeps, and operator exports — $9.99/month or $99.99/year through PayPal, with a 7-day free trial first.

Free

$0

5 scans / day

Pro month

$9.99

after 7-day trial

Pro year

$99.99

after 7-day trial

7-day free trialno card · one per account

Try Pro free for 7 days

Every Pro feature for 7 days. When it ends the account drops back to Free on its own — no charge. Then Pro is $9.99/month or $99.99/year.

Included

Free

Default

$0forever

Sign in, run five scans a day (guests two), keep the last three results. Satellite optical / infrared / thermal and quick profiles stay open.

  • Daily scansGuest 2/day · signed-in 5/day
  • Scan profilesPing + Quick
  • Kali Applications menuMenu + ping/quick analogs
  • Timing templatesT1–T3
  • Ping / host discoveryIncluded
  • Reverse DNS + IPv6 AAAAIncluded
  • Geo / ASN / ISP / RDAPIncluded
  • Satellite lockOptical · infrared · thermal
  • Port errata (what each port does)Included
  • Share to X / Instagram / FacebookIncluded
  • Custom ports—
  • Traceroute world-mapIncluded on the main scan
  • Version / OS / TLS / UDP—
  • OAuth 2.0 RFC 8414—
  • OpenVAS-style NVTs—
  • CIS / NIST / CISA scorecard—
  • Analyst briefing—
  • SIEM + CSV/PDF + STIX 2.1—
  • Packet capture (Wire)Scan rebuild + 2 MB PCAP
  • Scan archiveLast 3
  • Watchlist + asset inventory—
  • Certificate expiry watch—
  • Mail auth (SPF / DMARC / MX)Included
  • Email address checkSyntax + MX / SPF / DMARC
  • Email origin traceReceived hop parse
  • DKIM / BIMI / MTA-STS—
  • DNSSEC + CAAIncluded
  • WAF / CDN / tech stack—
  • security.txt + CT names—
  • HTTP header observatory—
  • Nikto / nuclei path checks—
  • WPScan / CMS surface—
  • Gobuster / dirb paths—
  • Cookie · CORS · TRACE audit—
  • theHarvester emails—
  • Wayback URL count—
  • Zero Trust scorecard—
  • CISA KEV + exploit likelihood—
  • Ransomware readiness—
  • Detection pack—
  • IR playbooks (NIST 800-61)—
  • Threat hunts + purple tests—
  • Telemetry + segmentation plan—
  • Governance mapping—
  • CISA BOD 22-01 patch queue—
  • FAIR-lite residual loss—
  • Cyber insurance questionnaire—
  • CIS Benchmarks (inferred)—
  • SBOM-lite + attack path—
  • ACL as code—
  • Kali Cloud Desktop—

Full VPC Network

Pro

Recommended

Unlimited recon, Apps menu (Kali + Parrot + Blue Team), every profile including Kali recon, OSS toolkit, governance mapping, SIEM/STIX exports, watchlist, and a 50-scan archive. Auto-renews monthly or yearly — pick on checkout. New accounts can try every Pro feature free for 7 days first.

  • Daily scansUnlimited
  • Scan profilesIntense, comprehensive, web, stealth, Kali recon
  • Kali Applications menuZenmap, qterminal, GSA, Wireshark, ZAP — this sweep
  • Timing templatesT1–T5 including stealth
  • Ping / host discoveryIncluded
  • Reverse DNS + IPv6 AAAAIncluded
  • Geo / ASN / ISP / RDAPIncluded
  • Satellite lockOptical · infrared · thermal
  • Port errata (what each port does)Included
  • Share to X / Instagram / FacebookIncluded
  • Custom portsRanges and lists
  • Traceroute world-mapIncluded
  • Version / OS / TLS / UDPIncluded
  • OAuth 2.0 RFC 8414Discovery + grade A–F
  • OpenVAS-style NVTsFull and fast · version CVE · families
  • CIS / NIST / CISA scorecardIncluded
  • Analyst briefingIncluded
  • SIEM + CSV/PDF + STIX 2.1Included
  • Packet capture (Wire)25 MB PCAP, follow stream, export
  • Scan archiveLast 50 + port diff
  • Watchlist + asset inventoryIncluded
  • Certificate expiry watchIncluded
  • Mail auth (SPF / DMARC / MX)Included
  • Email address checkSMTP mailbox exists, catch-all, DKIM
  • Email origin traceGeo + reverse DNS per hop
  • DKIM / BIMI / MTA-STSMail DNS
  • DNSSEC + CAAIncluded
  • WAF / CDN / tech stackWhatWeb / Wappalyzer-style
  • security.txt + CT namesIncluded
  • HTTP header observatoryA+–F grade (securityheaders)
  • Nikto / nuclei path checks.git, .env, phpMyAdmin, actuators
  • WPScan / CMS surfaceWordPress, Joomla, Next.js
  • Gobuster / dirb pathsShort high-signal wordlist
  • Cookie · CORS · TRACE auditHttpOnly / Secure / SameSite
  • theHarvester emailsHomepage mailboxes
  • Wayback URL countArchive.org CDX
  • Zero Trust scorecardIdentity · device · network · app · data
  • CISA KEV + exploit likelihoodMatched to this sweep
  • Ransomware readinessSMB/RDP/backup posture
  • Detection packSigma · Suricata · Snort · Zeek · Elastic · Splunk
  • IR playbooks (NIST 800-61)Detect · contain · eradicate · recover
  • Threat hunts + purple testsQueries from this surface
  • Telemetry + segmentation planWhat to log and isolate
  • Governance mappingPCI DSS 4.0 · ISO 27001 · SOC 2 · HIPAA · 800-53 · ASVS
  • CISA BOD 22-01 patch queue15-day internet-facing KEV clock + compensating controls
  • FAIR-lite residual lossBoard heat map + USD bands from this host
  • Cyber insurance questionnaireNYDFS / NAIC-style filled from the sweep
  • CIS Benchmarks (inferred)Linux, Windows, Apache, Redis, Docker, K8s
  • SBOM-lite + attack pathInventory + likely kill chain from this vantage
  • ACL as codenftables · iptables · AWS SG · Cloudflare WAF
  • Kali Cloud DesktopAlpha · DigitalOcean Kali + Java terminal

New on Pro

Defender VPC network

Kali · Intense · Web · Comprehensive · Stealth

One Pro sweep now folds in the Apps menu (Zenmap, Nikto, Lynis, Zeek, Suricata, Maltego, Gobuster, GSA, Wireshark, ZAP…) plus optical / infrared / thermal satellite lock and a defender suite: Zero Trust, KEV, detection packs, IR playbooks, PCI/ISO/SOC 2/HIPAA mapping, a BOD 22-01 patch queue, FAIR-lite residual loss, CIS Benchmarks, ACL-as-code, YARA, SOAR, and deception — still defensive, no exploit payloads.

Kali Applications

Click a package: Zenmap, qterminal, Greenbone GSA, Wireshark, ZAP, Observatory, Dradis — filled from this sweep

Parrot OS extras

AnonSurf, FinalRecon, Caido, Amass, NetExec, airgeddon, Empire/Sliver — Parrot packages Kali does not ship on its Applications menu

Kali recon profile

Top-160 ports + toolkit + NVT + TLS; Metasploit/Hydra/DoS stay off VPC network

Satellite optical / IR / thermal

NASA GIBS + ArcGIS lock — tabs for daylight, infrared, land-surface temperature

OpenVAS NVTs

Greenbone-style families, OIDs, QoD, banner/version CVE matching, web path tests

Nikto + nuclei paths

Defensive checks for /.git, /.env, phpMyAdmin, actuators, TRACE

WPScan / Joomscan

WordPress login, xmlrpc, wp-json, Joomla administrator

Gobuster / dirb

Short high-signal directory wordlist, no SecLists dump

httpx / WhatWeb / Wafw00f

Status, title, CMS, CDN/WAF from headers — no active WAF trip

theHarvester + recon-ng

Homepage emails, wayback CDX, security.txt, crt.sh names

dnsrecon mail DNS

DKIM selectors, BIMI, MTA-STS besides SPF/DMARC

testssl.sh / sslscan

Certificate, protocol, ALPN, trust flag on 443/8443

Mailbox existence

SMTP RCPT probe, catch-all detection, hop-by-hop Received trace

searchsploit

CVE → Exploit-DB search links only. No payloads.

OAuth 2.0 RFC 8414

Authorization-server discovery, PKCE, HTTPS-only grade

Zero Trust scorecard

NIST 800-207 pillars scored from this host

CISA KEV matching

EternalBlue, BlueKeep, Log4Shell, Exchange, VPN, Redis…

Detection pack

Sigma / Suricata / Snort / Zeek / Elastic / Splunk rules

IR playbooks

NIST 800-61 detect-contain-eradicate-recover plus D3FEND

Hunts + purple team

Hypotheses, queries, and tabletop tests from the surface

Governance mapping

PCI DSS 4.0, ISO 27001:2022, SOC 2, HIPAA, NIST 800-53, OWASP ASVS, CIS IG1

BOD 22-01 patch queue

15-day internet-facing KEV SLA, EPSS rank, compensating controls

FAIR-lite + insurance

Residual USD bands, board heat map, NYDFS/NAIC questionnaire

CIS Benchmarks + SBOM

Inferred checks for the OS/app you actually published

ACL as code

nftables, iptables, AWS security groups, Cloudflare WAF expressions

YARA · SOAR · Engage

Webshell rules, TheHive case, Shuffle isolate, MITRE Engage, canaries

Kali Cloud Desktop

Pro Alpha: DigitalOcean Kubernetes Kali shell; Java SSH terminal

Apps arsenal

Every Apps-menu package

Same tiles you open after a sweep, including twenty Blue Team apps (Lynis through Censys, plus checkdmarc, oauth2c, OpenSCAP, MISP, ntopng, CrowdSec, and TheHive). Each card has its man page. Free runs ping/quick analogs. Pro fills the live host. Off VPC Network tools still open as apps — then refuse to fire.

Nmap / Zenmap

Information Gathering

Free Quick port set · Pro Top-160, custom lists, version/OS

man nmap(1)

dnsrecon / dnsenum

Information Gathering

Free A/AAAA/MX/NS/TXT/PTR · Pro CAA, DNSSEC, related names

man dnsrecon(1)

whois / RDAP

Information Gathering

Free Included · Pro Included

man whois(1)

WhatWeb / Wappalyzer

Information Gathering

Free — · Pro Stack fingerprint

man whatweb(1)

Wafw00f

Information Gathering

Free — · Pro Passive CDN/WAF

man wafw00f(1)

Recon-ng / SpiderFoot

Information Gathering

Free — · Pro Wayback, security.txt, crt.sh

man recon-ng(1)

lbd

Information Gathering

Free Multiple A records · Pro Included

man lbd(1)

traceroute

Information Gathering

Free Main scan hop path · Pro Hop path + world map

man traceroute(8)

enum4linux / smbmap

Information Gathering

Free — · Pro 139/445 noted · no share brute

man enum4linux-ng(1)

OpenVAS / GVM

Vulnerability Analysis

Free — · Pro NVT families, OID, QoD

man gvm-cli(8)

Nikto

Web Application Analysis

Free — · Pro Dangerous path list

man nikto(1)

WPScan

Web Application Analysis

Free — · Pro WP login / REST / XML-RPC

man wpscan(1)

httpx / httprobe

Web Application Analysis

Free — · Pro Status, title, headers

man httpx(1)

Gobuster / dirb

Web Application Analysis

Free — · Pro Short directory wordlist

man gobuster(1)

Nuclei

Web Application Analysis

Free — · Pro Actuator / debug templates

man nuclei(1)

testssl.sh / sslscan

Web Application Analysis

Free — · Pro Cert, protocol, ALPN

man testssl.sh(1)

securityheaders

Web Application Analysis

Free — · Pro A+–F header grade

man lynis(1)

ZAP / Burp (passive)

Web Application Analysis

Free — · Pro Cookies, CORS, methods

man zap(1)

Wireshark / tcpdump

Sniffing & Spoofing

Free Sweep reconstruct · 2 MB · Pro 25 MB PCAP, follow stream

man tshark(1)

Dradis / Faraday

Reporting Tools

Free On-screen report · Pro SIEM · STIX · PDF export

man dradis(1)

FinalRecon

Information Gathering

Free — · Pro DNS + WHOIS + headers + TLS

man finalrecon(1)

OWASP Amass

Information Gathering

Free — · Pro Passive related names

man amass(1)

subfinder

Information Gathering

Free — · Pro Passive subdomains

man subfinder(1)

TruffleHog

Information Gathering

Free — · Pro .env / .git path check

man trufflehog(1)

Caido

Web Application Analysis

Free — · Pro Passive proxy analog

man caido(1)

Wapiti

Web Application Analysis

Free — · Pro Findings as modules

man wapiti(1)

ffuf

Web Application Analysis

Free — · Pro Short path fuzz

man ffuf(1)

CMSeeK

Web Application Analysis

Free — · Pro CMS fingerprint

man cmseek(1)

NetExec

Information Gathering

Free — · Pro 139/445 noted · no spray

man nxc(1)

EyeWitness

Reporting Tools

Free HTTP title · Pro HTTP title · status

man eyewitness(1)

Lynis

Blue Team

Free Header / TLS checklist · Pro Full hardening analog

man lynis(8)

p0f

Blue Team

Free OS / Server header · Pro Passive fingerprint

man p0f(1)

Maltego CE

Blue Team

Free DNS + IP graph · Pro Emails, RDAP, related hosts

man maltego(1)

Sherlock

Blue Team

Free — · Pro Usernames from harvested emails

man sherlock(1)

Zeek

Blue Team

Free conn.log from ports · Pro http.log + dns.log

man zeek(8)

osquery

Blue Team

Free listening_ports · Pro certificates table

man osqueryi(1)

Sigma

Blue Team

Free — · Pro YAML detections from findings

man sigma(1)

Legion

Blue Team

Free Port table · Pro Version / OS columns

man legion(1)

checkdmarc

Blue Team

Free MX / SPF / DMARC if published · Pro DKIM, BIMI, MTA-STS, AXFR

man checkdmarc(1)

oauth2c

Blue Team

Free — · Pro OIDC discovery + RFC 9700 checks

man oauth2c(1)

OpenSCAP

Blue Team

Free High-level grade · Pro CIS / NIST / PCI / CISA OVAL

man oscap(8)

MISP

Blue Team

Free IP / domain attributes · Pro CVE + ATT&CK + ASN event

man misp(1)

ntopng

Blue Team

Free Ping RTT · Pro Hop path + listener latency

man ntopng(8)

CrowdSec

Blue Team

Free Hosting/proxy clue · Pro Decisions from WAN listeners

man cscli(1)

TheHive

Blue Team

Free — · Pro Cases from NVTs + ATT&CK

man thehive(1)

Censys

Blue Team

Free IP + ASN · Pro Cert, CAA, days-to-expiry, listeners

man censys(1)

GreyNoise

Investigate

Free Hosting / proxy class · Pro ASN, org, timezone, RIOT analog

man greynoise(1)

urlscan.io

Investigate

Free Status + title · Pro Redirect, robots, security headers, HTTP/2

man urlscan(1)

crt.sh

Investigate

Free — · Pro Fingerprint, issuer, CAA, related names

man crtsh(1)

BGPView

Investigate

Free ASN if geo locked · Pro Prefix, netname, traceroute path

man bgpview(1)

JA4

Investigate

Free — · Pro TLS protocol + ALPN handshake analog

man ja4(1)

IOC Workbench

Investigate

Free IP + domain · Pro Cert, emails, CVEs, exposures, OIDC

man ioc-workbench(1)

Kali Cloud Desktop

Blue Team

Free — · Pro Alpha: DigitalOcean Kali + Java SSH terminal

man kali-cloud(8)

sqlmap

Database Assessment

Free Documented only · Pro Documented only

Off VPC Network

man sqlmap(1)

Metasploit

Exploitation Tools

Free Documented only · Pro Documented only

Off VPC Network

man msfconsole(1)

Hydra / Medusa / Patator

Password Attacks

Free Documented only · Pro Documented only

Off VPC Network

man hydra(1)

John / Hashcat

Password Attacks

Free Documented only · Pro Documented only

Off VPC Network

man john(1)

Aircrack-ng / Reaver

Wireless Attacks

Free Documented only · Pro Documented only

Off VPC Network

man aircrack-ng(1)

Ettercap / Bettercap

Sniffing & Spoofing

Free Documented only · Pro Documented only

Off VPC Network

man ettercap(8)

BeEF

Post Exploitation

Free Documented only · Pro Documented only

Off VPC Network

man beef(1)

Ghidra / radare2

Reverse Engineering

Free Documented only · Pro Documented only

Off VPC Network

man ghidraRun(1)

Slowloris / siege / t50

Stress Testing

Free Documented only · Pro Documented only

Off VPC Network

man slowhttptest(1)

Autopsy / binwalk

Forensics

Free Documented only · Pro Documented only

Off VPC Network

man autopsy(1)

AnonSurf

Privacy

Free Documented only · Pro Documented only

Off VPC Network

man anonsurf(8)

OnionShare

Privacy

Free Documented only · Pro Documented only

Off VPC Network

man onionshare(1)

I2P

Privacy

Free Documented only · Pro Documented only

Off VPC Network

man i2prouter(1)

macchanger

Privacy

Free Documented only · Pro Documented only

Off VPC Network

man macchanger(1)

VeraCrypt

Privacy

Free Documented only · Pro Documented only

Off VPC Network

man veracrypt(1)

airgeddon

Wireless Attacks

Free Documented only · Pro Documented only

Off VPC Network

man airgeddon(1)

Wifiphisher

Wireless Attacks

Free Documented only · Pro Documented only

Off VPC Network

man wifiphisher(1)

Cutter / rizin

Reverse Engineering

Free Documented only · Pro Documented only

Off VPC Network

man cutter(1)

Sliver C2

Post Exploitation

Free Documented only · Pro Documented only

Off VPC Network

man sliver-server(1)

Armitage

Exploitation Tools

Free Documented only · Pro Documented only

Off VPC Network

man armitage(1)

Payment processor

PayPal

PayPal, cards, and Apple Pay. 7 days free, then the Monthly Professional Subscription or Annual Professional Subscription auto-renews. Cancel during the trial and PayPal does not charge.

Same Pro seat either way. .