Tools & Methodology
Every assessment runs industry-standard open-source security tools trusted by compliance teams and security professionals worldwide.
Reconnaissance
passive • read_onlyDiscovers subdomains using passive sources like DNS datasets, certificate transparency logs, and search engines. No direct contact with the target.
Queries historical DNS records to find origin IPs behind CDNs, past hosting providers, and DNS configuration changes over time.
Probes discovered hosts for HTTP services, identifies web technologies, status codes, titles, and server headers.
Vulnerability Assessment
active • dns_verification_requiredTemplate-based vulnerability scanner with 8,000+ community-maintained detection templates covering CVEs, misconfigurations, exposed panels, and default credentials.
Crawls web applications to discover endpoints, parameters, and JavaScript files that may contain secrets or additional attack surface.
Network Analysis
infrastructure • servicesIndustry-standard network scanner that identifies open ports, running services, and their versions across the target infrastructure.
Queries the Shodan database for information about internet-facing services, known vulnerabilities, and end-of-life software detected on the target.
Assessment Methodology
QuackScan uses a progressive depth approach. Each level builds on the previous one, and you control how deep the assessment goes.
Level 1: Basic Assessment
Passive reconnaissance and public information gathering. Checks publicly accessible endpoints, server headers, SSL configuration, and exposed services. Does not send any payloads or modify anything on the target.
Level 2: Standard Assessment
Extends basic assessment with deeper infrastructure analysis, technology fingerprinting, and frontend secret detection. Crawls public pages to identify exposed API keys, tokens, and configuration values in client-side code.
Level 3: Deep Assessment
Active vulnerability scanning with nuclei templates, default credential testing, and parameter fuzzing. This level sends payloads to the target to detect exploitable vulnerabilities. Requires DNS verification to prove domain ownership before any active testing begins.