Lite: Web Sandbox

The tools installed in the sandbox that Lite scans run in: 84 tools on Kali Linux Rolling, with the source and exact version of each.

The tools installed in the sandbox that Lite scans run in: 84 tools on Kali Linux Rolling, with the source and exact version of each.

At a glance

PropertyValue
SandboxWeb sandbox, version 1.2.30-WEB
Base systemKali GNU/Linux Rolling 2026.3
Tools84, of which 24 were added in 1.2.30
Built2026-10-11
Python (agent environment)3.13.15
Python (system)3.14.7
Gogo1.26.8
Node.jsv24.21.0

How to read this inventory

Each entry shows the tool name, a one-line summary, a description, where it was installed from, the exact version in the sandbox image, the command to run it, and a link to the upstream project. Tools marked New were added in sandbox release 1.2.30. See Tool Inventory for the list of source types.

Note: Tools with the version unpinned are built from the default branch of the upstream project when the sandbox image is built, and the repository history is not kept. The same build on a different day can contain different code, so these are the only tools without a fixed version to audit.

Network & port scanning

Find live hosts and open ports, identify the services behind them, and track how an exposed surface changes between runs.

nmap

Network exploration tool and security scanner

The standard for host discovery, port scanning, service and version detection, and OS fingerprinting. The Nmap Scripting Engine (NSE) extends it with scripts for vulnerability checks, authentication testing and deeper service enumeration. In the Cyrion sandbox the binary holds cap_net_raw, so SYN scans and OS detection run without root.

nmap -sV -sC -p- --min-rate 1000 -oA scan target.example.com

masscan

Asynchronous, internet-scale TCP port scanner

Uses its own TCP/IP stack and asynchronous transmission to scan very large address ranges far faster than nmap. Its syntax is deliberately close to nmap's, and it writes grepable, XML, JSON or list output. Best used to find open ports across wide ranges, then hand the hits to nmap for service detail.

masscan 203.0.113.0/24 -p80,443,8080 --rate 1000 -oJ masscan.json

massdns

High-performance DNS stub resolver

Resolves very large lists of domain names in bulk against a set of recursive resolvers. Without special tuning it can sustain over 350,000 lookups per second on public resolvers, which makes brute-forcing subdomains and validating huge candidate lists practical. Output is available in several simple and JSON formats.

massdns -r resolvers.txt -t A -o S -w results.txt subdomains.txt

naabu

Fast port scanner written in Go

ProjectDiscovery's port scanner, supporting SYN and CONNECT scans. It reads hosts from arguments, files or stdin and emits clean host:port lines, so it slots directly in front of httpx or nmap in a reconnaissance pipeline.

naabu -host example.com -top-ports 100 -silent

ncat

Feature-packed networking utility (Nmap's netcat)

Reads and writes data across networks from the command line. Supports TCP, UDP, SCTP, SSL, IPv4 and IPv6, listen mode, port relaying and proxy chaining. Used for banner grabbing, quick listeners for callbacks, and relaying traffic between hosts.

ncat -lvnp 4444

ndiff

Utility to compare Nmap scan results

Compares two Nmap XML scans and reports what changed: hosts that appeared or went down, ports opened or closed, and service or OS changes. Used to detect drift between scan runs.

ndiff before.xml after.xml

Subdomain & DNS reconnaissance

Map an organisation's hostnames from passive sources, DNS records and brute force, then check them for takeover conditions.

subfinder

Passive subdomain discovery tool

Queries dozens of passive sources, including certificate transparency logs, search engines and public DNS datasets, to enumerate valid subdomains without sending traffic to the target. The Go build is installed ahead of the apt package, which prints an outdated banner.

subfinder -d example.com -silent -o subs.txt

amass

In-depth attack surface mapping and external asset discovery

OWASP Amass performs DNS enumeration and network mapping using passive sources, active probing, brute forcing and name alterations. Results are stored in a graph database that links discovered names to IP addresses, netblocks and ASNs.

amass enum -passive -d example.com -o amass.txt

assetfinder

Find domains and subdomains related to a given domain

A fast, lightweight tool that pulls related hostnames from public sources such as certificate transparency. It is deliberately simple: one domain in, one host per line out, so it composes cleanly with other tools.

assetfinder --subs-only example.com

dnsx

Fast and multi-purpose DNS toolkit

Runs DNS queries (A, AAAA, CNAME, MX, NS, TXT and more) against a list of hosts using a retryable client with user-supplied resolvers. Supports wildcard filtering and DNS brute forcing. It is the link between subdomain discovery and httpx probing.

cat subs.txt | dnsx -silent -a -resp

alterx

Pattern-based subdomain wordlist generator

Generates subdomain permutations from patterns and the words found in known hostnames, such as adding -dev, -staging or numbered suffixes. The candidates are then resolved with dnsx or massdns to find hosts that passive sources miss.

alterx -l subs.txt -silent | dnsx -silent

dnsrecon

DNS enumeration and reconnaissance script

Checks every name server for zone transfers, enumerates standard records (SOA, NS, A, AAAA, MX, SRV, TXT), tests for wildcard resolution, performs reverse lookups over IP ranges, and brute forces hostnames with a wordlist.

dnsrecon -d example.com -t std

dnsenum

Multithreaded DNS information enumerator

Collects host addresses, name servers and mail servers, attempts zone transfers on each name server, scrapes Google for additional hostnames, brute forces subdomains and performs reverse lookups on discovered netblocks.

dnsenum --enum example.com

fierce

DNS reconnaissance tool for locating non-contiguous IP space

Finds the target domain's name servers and attempts a zone transfer, then falls back to hostname brute forcing and probes the IP addresses around any hit. This surfaces related hosts that sit outside the documented ranges.

fierce --domain example.com

subzy

Subdomain takeover vulnerability checker

Checks a list of subdomains for dangling DNS records that point at unclaimed third-party services such as cloud storage, hosting platforms and SaaS. Responses are matched against a maintained fingerprint set to report which services can be claimed.

subzy run --targets subs.txt

subjack

Subdomain takeover tool written in Go

Reads a list of subdomains and checks for takeover conditions through dangling CNAMEs and service-specific error fingerprints. It uses an older fingerprint format than subzy and is kept so existing playbooks continue to work.

subjack -w subs.txt -t 50 -ssl -o takeovers.txt

whois

Client for the WHOIS directory service

Looks up registration, ownership, registrar and name-server data for domains and IP ranges. Useful for scoping, for attributing infrastructure, and for confirming that a discovered asset belongs to the target organisation.

whois example.com

Web content discovery & crawling

Probe live web services, crawl them, fuzz for hidden paths and parameters, and recover historical URLs and JavaScript endpoints.

httpx

Fast and multi-purpose HTTP toolkit

Probes large lists of hosts over HTTP and HTTPS and reports status codes, titles, content length, redirect chains, web server and detected technologies. Used to separate live web services from a raw host list and to triage them at scale.

cat subs.txt | httpx -silent -title -status-code -tech-detect

katana

Next-generation crawling and spidering framework

Crawls web applications in standard and headless-browser modes, follows JavaScript-referenced endpoints, and extracts links, forms and file paths. Supports scope control, depth limits and rate limiting.

katana -u https://example.com -d 3 -jc -silent

ffuf

Fast web fuzzer written in Go

Replaces a FUZZ keyword anywhere in a request (path, header, parameter or body) with entries from one or more wordlists, and filters responses by status, size, word count or regular expression. Covers content discovery, virtual-host discovery and parameter fuzzing.

ffuf -u https://example.com/FUZZ -w wordlist.txt -mc 200,301,403

feroxbuster

Fast, recursive content discovery tool written in Rust

Brute-forces directories and files and automatically recurses into the directories it finds. Handles wildcard responses and supports extension lists, status filters and resumable scans.

feroxbuster -u https://example.com -w wordlist.txt -x php,txt

gobuster

Directory, DNS and virtual-host brute-forcing tool

A Go brute-forcer with separate modes for directories and files, DNS subdomains, virtual hosts and cloud storage buckets. Simple, fast and predictable when you want a straightforward wordlist pass.

gobuster dir -u https://example.com -w wordlist.txt

dirsearch

Advanced web path scanner

A mature path brute-forcer with extension handling, recursion, status filtering, request throttling and multiple report formats. Handles large wordlists well and supports custom headers and authentication.

dirsearch -u https://example.com -e php,html,js

gospider

Fast web spider written in Go

Crawls a site and extracts URLs, forms, JavaScript files, subdomains and S3 buckets from page content and responses. It can also seed from sitemap.xml, robots.txt and third-party archives.

gospider -s https://example.com -d 2 -c 10

hakrawler

Simple, fast crawler for endpoint and asset discovery

Reads starting URLs from stdin and prints discovered links, JavaScript files, forms and other assets, one per line. Its minimal interface makes it a convenient crawler stage in shell pipelines.

  • Source: go
  • Version: v0.0.0-20260805040537-52a16fe61bd1
  • Command: hakrawler
  • Upstream project
echo https://example.com | hakrawler -d 2

gau

Fetch known URLs from public archives

Collects every URL known for a domain from AlienVault OTX, the Wayback Machine, Common Crawl and URLScan, so old and forgotten endpoints surface without touching the target. Supports subdomain inclusion and extension or status filters.

gau --subs example.com

waybackurls

Fetch the URLs the Wayback Machine knows about a domain

Takes domains on stdin and prints archived URLs from the Internet Archive. A cheap, fast way to recover removed endpoints, legacy parameters and exposed files.

echo example.com | waybackurls

paramspider

Mine parameters from web archives

Collects URLs for a domain from web archives and keeps those carrying query parameters, replacing values with a placeholder so the list can be passed straight to fuzzers and scanners. Installed in editable mode so its console script resolves from the agent virtual environment.

paramspider -d example.com

arjun

HTTP parameter discovery suite

Finds hidden GET, POST, JSON and XML parameters by sending large batches of candidate names and observing response changes, keeping the request count low. Good for surfacing undocumented inputs on APIs and legacy endpoints.

arjun -u https://example.com/endpoint

LinkFinder

Discover endpoints in JavaScript files

Parses JavaScript from a URL, a file or an entire page and extracts endpoints and parameters using a regular-expression engine. Installed behind a wrapper that runs it in the agent virtual environment.

linkfinder -i https://example.com/app.js -o cli

JS-Snooper

JavaScript reconnaissance helper

A shell helper that mines JavaScript for endpoints and secrets. It runs during JavaScript analysis passes alongside LinkFinder and SecretFinder.

jsniper.sh

JavaScript reconnaissance shell script

A shell helper for JavaScript reconnaissance that pulls interesting data out of a target's script files.

Web vulnerability scanning

Template-driven and signature-based scanners, plus fingerprinting tools that identify the technology and filtering in front of an application.

nuclei

Fast, customizable scanner driven by YAML templates

Sends template-defined requests across HTTP, DNS, TCP, SSL and more, and matches responses against declarative conditions. A large community template library covers CVEs, misconfigurations, exposed panels and default credentials. Templates are refreshed when the sandbox image is built.

nuclei -u https://example.com -severity high,critical

nikto

Web server scanner

Tests web servers for dangerous files and CGI scripts, outdated server software, version-specific problems and insecure configuration. Noisy by design, it gives fast baseline coverage of a server.

nikto -h https://example.com

wapiti

Black-box web application vulnerability scanner

Crawls a site, then fuzzes the forms and parameters it finds. Modules cover SQL and XPath injection, cross-site scripting, file disclosure, command execution, SSRF, XXE and CRLF injection, without needing the application's source.

wapiti -u https://example.com -m sql,xss

whatweb

Web technology fingerprinting scanner

Identifies content management systems, frameworks, JavaScript libraries, analytics, web servers and embedded devices using a large plugin set matched against headers, HTML, cookies and URLs. Aggression levels trade stealth for depth.

whatweb -a 3 https://example.com

wpscan

WordPress vulnerability scanner

Detects the WordPress version, installed themes and plugins, and enumerates users, then matches them against the WPScan vulnerability database.

wpscan --url https://example.com --enumerate vp,vt,u

wafw00f

Web Application Firewall fingerprinting tool

Sends a set of requests and analyses the responses to identify which WAF, CDN or filtering product sits in front of a site. Knowing what is filtering you shapes payload choice for every later test.

wafw00f https://example.com

jaeles

Signature-based web application testing framework

Runs YAML signatures that describe requests, payloads and detection logic, which makes it quick to encode a new check or reproduce a published vulnerability. Supports concurrency and passive checks.

  • Source: go
  • Version: v0.0.0-20260620125341-d40305ffe42a
  • Command: jaeles
  • Upstream project
jaeles scan -s cves -u https://example.com

retire

Scanner for known-vulnerable JavaScript libraries

retire.js detects JavaScript libraries and Node modules with known vulnerabilities by comparing version fingerprints against a maintained advisory repository. Helpful for identifying outdated front-end dependencies quickly.

retire --path ./app

Injection & exploitation

Detect and prove injection flaws (SQL, NoSQL, OS command, template, XSS, CRLF, request smuggling and SSRF), with out-of-band capture for blind cases.

sqlmap

Automatic SQL injection and database takeover tool

Detects and exploits boolean-based, error-based, time-based, UNION and stacked-query injection across major database engines. Beyond detection it can enumerate databases, tables and columns, dump data, read files and, in some configurations, run commands on the database host.

sqlmap -u "https://example.com/item?id=1" --batch --risk 2 --level 3

ghauri

Advanced SQL injection detection and exploitation tool

A newer SQL injection tool with boolean, error, time-based and stacked-query detection and database enumeration. It complements sqlmap by cross-checking results with a separate implementation. Installed in the agent virtual environment.

ghauri -u "https://example.com/item?id=1" --batch

commix

Automated OS command injection and exploitation tool

Tests parameters, headers and cookies for command injection using classic, time-based and file-based techniques, and can open a pseudo-shell on a vulnerable target. Runs from the pure-Python upstream source behind a wrapper.

commix --url="https://example.com/ping?ip=INJECT_HERE" --batch

SSTImap

Server-side template injection detection and exploitation

Detects template injection in engines such as Jinja2, Twig and Freemarker and, where possible, escalates it to file access or remote code execution. Template injection is a direct route to RCE.

sstimap -u "https://example.com/page?name=test"

nosqli

NoSQL injection scanner

Scans for MongoDB and CouchDB injection by sending crafted operators and boolean and timing payloads. It replaces the Python 2-only NoSQLMap.

nosqli scan -t https://example.com/login

dalfox

Parameter analysis and XSS scanning tool

Analyses reflected and DOM contexts, mines parameters and tests with context-aware payloads, including blind XSS callbacks. Supports pipe mode and a wide payload set.

dalfox url "https://example.com/search?q=test"

XSStrike

Advanced XSS detection suite

Combines a payload generator, fuzzer and crawler with a context analyser that crafts payloads for the exact reflection point. Includes WAF detection and DOM XSS scanning. Installed behind a wrapper that pins the interpreter.

xsstrike -u "https://example.com/search?q=test" --crawl

Gxss

Reflected-parameter checker

Reads URLs from stdin, injects a marker into each parameter and reports which parameters reflect and which special characters survive unfiltered. A quick first pass before heavier XSS testing.

  • Source: go
  • Version: v0.0.0-20240804155857-8ee938bf4ead
  • Command: Gxss
  • Upstream project
cat urls.txt | Gxss -c 100 -p Xss

crlfuzz

CRLF injection scanner

Tests URLs for CRLF injection (response splitting and header injection) using multiple encodings and injection points, and runs concurrently across large URL lists.

crlfuzz -u "https://example.com/"

smuggler

HTTP request smuggling tester

Probes a target for desynchronisation between front-end and back-end servers using CL.TE, TE.CL and TE.TE variants with mutated Transfer-Encoding headers.

smuggler -u https://example.com

SSRFmap

Automatic SSRF fuzzer and exploitation tool

Takes a captured request and a vulnerable parameter, then uses modules to read files, scan internal ports and reach cloud metadata and common internal services through the server-side request.

ssrfmap -r request.txt -p url -m readfiles

interactsh-client

Out-of-band interaction capture client

Registers a unique callback domain and listens for DNS, HTTP, SMTP and other interactions. This is how blind vulnerabilities such as SSRF, blind XSS and XXE, which give no direct response, are detected (OAST).

interactsh-client -v

API, GraphQL & auth

Fingerprint GraphQL engines, test JSON Web Tokens and find secrets exposed in client-side code.

graphw00f

GraphQL server engine fingerprinting tool

Identifies which GraphQL engine a server runs by sending probe queries and comparing error behaviour. The result decides which attacks apply: introspection abuse, query batching or alias overloading.

graphw00f -d -t https://example.com/graphql

jwt_tool

Toolkit for testing, tampering and cracking JSON Web Tokens

Decodes tokens, tests for known weaknesses (alg none, key confusion, weak secrets, kid and jku injection) and forges modified tokens. Used for authentication and session analysis of JWT-based APIs.

jwt_tool <token>

SecretFinder

Find sensitive data in JavaScript files

Scans JavaScript for API keys, tokens, credentials and other secrets using regular expressions, and can crawl all the scripts on a page. Installed behind a wrapper that runs it in the agent virtual environment.

secretfinder -i https://example.com/app.js -o cli

TLS & crypto

Audit protocol versions, cipher suites and certificates, and harvest hostnames from certificates at scale.

sslscan

Fast SSL/TLS cipher suite and protocol scanner

Connects to a service and lists the protocols, cipher suites, key exchange groups and certificate details it accepts, flagging weak and deprecated options.

sslscan example.com:443

testssl

Test TLS/SSL encryption on any port

A comprehensive TLS audit covering protocols, ciphers, forward secrecy, certificate validity, HTTP security headers and known vulnerabilities such as Heartbleed and ROBOT. The upstream script testssl.sh installs as testssl.

testssl https://example.com

sslyze

Scriptable SSL/TLS configuration analyser

Analyses cipher suites, certificate chain validation, session resumption, compression, renegotiation and known flaws. Produces machine-readable JSON, which suits automation.

sslyze example.com:443

tlsx

Fast and configurable TLS grabber

Performs TLS handshakes across many hosts and extracts certificate fields, including subject alternative names and common names that expose additional hostnames. Supports cipher enumeration, JARM fingerprints and JSON output.

tlsx -u example.com -san -cn -silent

Secrets, SAST & supply chain

Static analysis and secret scanning for source code and JavaScript, with live verification of leaked credentials.

trufflehog

Find, verify and analyse leaked credentials

Scans git repositories, filesystems and other sources for secrets using hundreds of detectors, and verifies candidates against the live service so only credentials that still work are flagged. The release binary is pinned and can be checked against its SHA-256 checksum.

trufflehog git https://github.com/org/repo --only-verified

semgrep

Lightweight multi-language static analysis

Pattern-based static analysis that matches code structure rather than text, with rule sets for security issues across many languages. Rules are easy to read and write, and results include the exact code location.

semgrep --config auto ./src

bandit

Security linter for Python code

Parses Python into an AST and runs checks for common security issues such as hard-coded passwords, unsafe deserialisation, shell injection and weak cryptography, with severity and confidence ratings.

bandit -r ./app -ll

eslint

Pluggable JavaScript linter

Identifies problematic patterns in JavaScript and TypeScript. Security-focused plugins add checks for dangerous constructs such as eval and unsafe regular expressions.

eslint .

jshint

JavaScript static analysis tool

Detects errors and potential problems in JavaScript source, including undeclared variables, unsafe comparisons and risky constructs.

jshint ./app.js

js-beautify

JavaScript beautifier

Re-indents and reformats minified or compressed JavaScript so it can be read. Run before review to restore structure, though it does not reverse obfuscation that renames identifiers.

js-beautify app.min.js -o app.js

Reverse engineering & exploit development

Binary analysis and debugging for native code found during a scan.

radare2

Reverse engineering framework

A scriptable command-line framework for disassembly, debugging, patching, binary diffing and analysis across many architectures and file formats. Also used for quick triage of binaries found during a scan.

r2 -A ./binary

gdb

GNU Debugger

The standard native debugger on Linux. Runs a binary under control, sets breakpoints, inspects memory and registers, and analyses crashes.

gdb -q ./binary

Proxy & traffic interception

The intercepting proxy that records and replays traffic during a scan.

caido-cli

Web security auditing proxy

The primary intercepting proxy. It records and replays HTTP traffic, runs supervised for the lifetime of the sandbox container, and has its CA certificate imported at build time so HTTPS traffic can be inspected. The version is held at 0.48.0 deliberately.

OSINT

Gather public intelligence about a target without touching its infrastructure.

theHarvester

Email, subdomain and host harvester

Gathers emails, names, subdomains, IP addresses and URLs from public sources such as search engines, certificate transparency and threat-intelligence datasets. Passive, so it leaves no trace on the target.

theHarvester -d example.com -b crtsh

recon-ng

Full-featured web reconnaissance framework

A modular framework with workspaces, a database of discovered hosts, contacts and credentials, and installable modules for reconnaissance from many sources.

recon-ng -w example

shodan

Command-line client for the Shodan search engine

Queries Shodan for exposed hosts, open ports, banners and known vulnerabilities for an IP address or search filter without scanning the target directly. Requires a Shodan API key.

shodan host 203.0.113.10

vulnx

ProjectDiscovery CVE and exploit intelligence lookup

Looks up vulnerability records by CVE ID or search filter and returns severity, affected products and exploit information, so findings can be prioritised by real-world risk.

vulnx id CVE-2024-3094

Pipeline glue & utilities

Small tools that join the rest together: dedupe, reshape, search and parallelise tool output.

anew

Append lines from stdin to a file, skipping duplicates

Reads lines from stdin, appends only those not already in the target file and prints the new ones. Because the stream continues, it dedupes across runs without breaking a pipeline.

cat new.txt | anew seen.txt

unfurl

Pull out the parts of URLs

Parses URLs and prints selected parts (domains, paths, keys, values or key=value pairs) or formatted combinations. Turns a URL list into parameter and path wordlists.

cat urls.txt | unfurl --unique domains

qsreplace

Replace query-string values

Accepts URLs on stdin and replaces every query-string value with the one you supply. Turns a plain URL list into an injection corpus ready for a fuzzer or scanner.

cat urls.txt | qsreplace FUZZ

jq

Command-line JSON processor

Filters, transforms and reshapes JSON with a compact query language. Used to pull fields out of API responses and tool output.

curl -s https://example.com/api | jq '.items[].id'

ripgrep

Fast recursive search tool

Searches file trees with regular expressions at high speed, respecting ignore files by default. Used to hunt for keys, endpoints and dangerous sinks in downloaded source and JavaScript.

rg -n "api[_-]?key" ./src

parallel

Run shell commands in parallel

Runs many jobs concurrently across CPU cores, replacing slow sequential loops over host or URL lists.

cat hosts.txt | parallel -j 10 nmap -F {}

tmux

Terminal multiplexer

Keeps shell sessions alive in detachable windows and panes, so long-running work survives a disconnect.

tmux new -s scan

Runtimes & languages

The interpreters and toolchains the sandbox needs to build and run the tools above.

python3 (venv)

Python interpreter for the agent environment

The interpreter the agents run. It lives in a virtual environment with system site-packages disabled, so libraries must be installed into the environment itself.

python3 --version

python3 (system)

Kali system Python

Kali's own interpreter, used by its packages. Libraries installed through apt python3-* packages land here and cannot be imported from the agent environment.

/usr/bin/python3 --version

go

Go toolchain

The compiler and tools used to build and install Go-based security tools.

go version

node

Node.js runtime

The JavaScript runtime behind npm-installed tools such as eslint, jshint, retire and js-beautify.

node --version

poetry

Python dependency manager

Pinned dependency manager for the agent runtime.

poetry --version

What higher plans add

Plans above Lite run larger sandboxes. They contain everything listed above plus the tools below. Lite does not include them.

AreaAdditional tools
Network & port scanningrustscan
Subdomain & DNS reconnaissanceasnmap, uncover
Injection & exploitationmetasploit-framework
Password cracking & brute forcehydra, john, hashcat, hashid, name-that-hash
Active Directory & Windowsnetexec, crackmapexec, enum4linux-ng, enum4linux, impacket-scripts, certipy-ad, bloodhound.py, kerbrute, responder, mitm6, evil-winrm, smbclient, smbmap, ldapdomaindump
Secrets, SAST & supply chaingitleaks, syft, osv-scanner
Mobile: Androidapktool, jadx, dex2jar, smali / baksmali, apksigner, zipalign, adb, fastboot, androguard, apkid, apkleaks, mobsfscan, frida-tools, objection
Mobile: iOSlibimobiledevice-utils, ideviceinstaller, libplist-utils, libusbmuxd-tools
Reverse engineering & exploit developmentbinwalk
Stealth & anonymitytor, torsocks, proxychains4
Runtimes & languagesjava

This comparison is made on command names, so it cannot show two things. pwntools is a Python library rather than a command, and is available only on higher plans. ghidra is not part of the Lite sandbox and ships only in the largest sandbox.