Autonomous red-team · free
IndexTracer maps your entire attack surface, runs AI agents that chain real exploits like an attacker, and ships a verified patch — on a continuous loop, from a single platform.
Maps to
Platform
From passive CVE intelligence to active scanning — every layer scoped to your organization's attack surface.
A live CVE feed from NVD and CISA KEV, risk-scored by CVSS + EPSS + known-exploited status. PoC detection, exploit-maturity bands (active / PoC / likely / unproven), and Patch-Tuesday flagging surface what's actually weaponized first.
Spot exposure before attackers act — Have I Been Pwned breach matching, public paste-site search, and URLScan clone/phishing detection, with optional AbuseIPDB and GreyNoise IP reputation when you add the keys.
crt.sh CT-log inventory with expiry and wildcard tracking, plus heuristic anomaly detection that flags freshly-issued wildcards and oversized SAN sets — the hallmarks of phishing infrastructure spun up in your name.
Six passive sources — crt.sh, AlienVault OTX, HackerTarget, Anubis, Wayback CDX, and CertSpotter — plus a DNS brute-force pass and live resolution, so nothing internet-facing slips past.
Upload CycloneDX, SPDX, or lockfiles (npm, pip, Go, Maven) and match every dependency against live CVEs via OSV.dev — track vulnerable third-party components across the whole stack.
One A–F posture score across every signal — findings, vulnerable deps, cert hygiene, WAF/CDN coverage and the active-exploit feed — with a score-over-time trend and a print-ready PDF report.
Connect-scan of common service ports with banner fingerprinting and active misconfiguration checks — unauthenticated Redis, Elasticsearch, Docker API and more. Restricted to hosts you've verified you own.
Same-host crawling, technology + WAF/CDN fingerprinting, security-header auditing, query-parameter discovery, and exposed-file probing (.git, .env). Restricted to verified hosts.
Claude-powered CVE explanations, posture triage that buckets every action into Immediate / This-week / Backlog, and a grounded analyst chat that reasons across all nine features' data.
Watch it think
Every scan streams in real time — discovered endpoints, exploit chains as they form, the root cause located in your repo, and the patch verified in a sandbox before you ever see it.
> discovered 14 subdomains via crt.sh
[verify] api.example.com — DNS TXT verified
[recon] 47 endpoints, 12 with parameters
[exploit] chaining IDOR → priv-esc on /api/users/:id
[diff] NEW: SQL Injection /api/users?id= (A03)
[patch] root cause · users.repository.ts:88
[verify] sandbox replay — exploit closed ✓
How it works
A continuous loop — each scan feeds the next, so coverage compounds instead of resetting every year.
Add a root domain. We enumerate subdomains from Certificate Transparency and probe each host for tech stack, headers, and live status.
Prove ownership in 60 seconds with a DNS TXT record or .well-known file. Only verified assets are scannable, isolated to your tenant.
Agents map the surface, craft context-aware payloads, and chain findings into CVSS-scored kill-chains — then locate the root cause.
Subscribe to recurring scans and get only what changed — verified patches, new findings, severity shifts — over signed webhooks.
Attack coverage
Eight vulnerability classes, tested with real attack techniques — then chained into composite kill-chains.
Composite kill-chain
Union-based, blind time-based, and error-based SQLi with automated schema extraction.
Server-side request forgery probes targeting cloud metadata endpoints, internal services, and IMDS.
IDOR detection across sequential and randomised resource IDs with privilege escalation chaining.
Reflected, stored, and DOM-based cross-site scripting with payload mutation and bypass detection.
Path traversal sequences targeting sensitive Linux and Windows system files and config.
AI-specific attacks against LLM-integrated APIs — jailbreaks, instruction hijacking, data leakage.
Token manipulation, JWT forgery, and session fixation attacks against authentication flows.
Composite CVSS-scored attack chains that combine multiple vulnerabilities into a single kill-chain.
Continuous monitoring
We rerun the full suite on your cadence, then tell you only what changed. No alert fatigue from re-flagged issues.
A vulnerability that wasn't on the previous scan — a regression, a new CVE, or a freshly-exposed endpoint.
A previously-flagged issue is gone. Evidence your fix landed in production — no ticket-chasing required.
Same finding, different impact. The asset became internet-reachable, or the exploit chain got longer.
A new framework, server, or runtime on your asset. Either your team shipped — or someone else did.
FAQ
Traditional pentests happen once a year, take weeks, and produce a static PDF. IndexTracer runs on demand — every new deployment, config change, or emerging threat is tested in real time. Our AI agents chain findings across your entire stack, uncovering attack paths that point-in-time assessments consistently miss.
No — that's what asset discovery is for. Give us your root domain and we enumerate every subdomain on record by querying public Certificate Transparency logs (the same ones browsers use to validate HTTPS certs). We then HTTP-probe each candidate to capture status, server header, page title, and tech fingerprints. Forgotten staging boxes, abandoned marketing sites, and shadow IT show up automatically.
Subscribe any verified asset to a recurring scan on hourly, daily, or weekly cadence. Our scheduler reruns the full test suite and a diff engine compares the new findings against the previous scan using stable signatures. You only get notified about what changed: new vulnerabilities, fixes that landed, severity shifts, or tech-stack drift. Notifications go via HMAC-signed webhooks or email digests, with every delivery attempt logged for retry visibility.
Our agents go beyond what basic scanners catch. They detect reflected XSS, SQL injection, SSRF, missing security headers, authentication flaws, information disclosure, cookie misconfigurations, CSRF vulnerabilities, and LLM-specific attacks like prompt injection and data leakage. Every finding includes CVE references, evidence, and step-by-step remediation.
The agent uses a Playwright-powered crawler to map your attack surface — pages, endpoints, APIs, and forms. It then systematically tests each target using real payloads, analyzes responses with Gemini AI, and chains findings into a comprehensive security report. Unlike static scanners, it reasons about what it finds and adapts its approach.
Yes. All tests are non-destructive and observation-based — we inject payloads and observe responses without modifying target data. Built-in safety controls block destructive keywords, and you can run scans in dry-run mode to discover endpoints without executing any attack payloads.
Web applications, REST and GraphQL APIs, single-page apps (React, Angular, Vue), server-rendered sites, and AI/LLM chatbot endpoints. You can scan by domain name or IP address, with optional authenticated scanning using bearer tokens, cookies, basic auth, or custom headers.