Tools
Small, practical tools to help you prepare for a penetration test, harden your site and analyse your own apps.
The browser tools run entirely in your browser. AppSleuth, getIPA and getAPK are open-source programs that run on your own computer, offline unless you turn on a network check. Nothing you enter is sent to us.
One command-line tool for mobile app security triage. Scan an IPA, APK, APKS or AAB for risky settings, secrets and weak hardening, compare builds, and audit app data. Free and open source.
Open source · install
Pull an app off your own jailbroken iPhone and package it as an IPA in one command, decrypted and ready to analyse. Free and open source.
Open source · install
Pull an installed app off your own Android phone as an APK, or an APKS bundle for split apps, in one command. No root needed. Free and open source.
Open source · install
Decode, verify and sign JSON Web Tokens with any algorithm (HMAC, RSA, RSA-PSS, ECDSA, EdDSA), flag risky settings, and generate or convert keys.
Runs in your browser
Answer 20 yes/no questions to see how ready you are for a SOC 2 penetration test, and which gaps to close first.
Runs in your browser
Describe what you want tested and get an indicative range of tester-days, the unit we use to scope every engagement.
Runs in your browser
Choose your options and get ready-to-paste security headers for Nginx, Apache, Cloudflare, Netlify and Vercel.
Runs in your browser
Build valid SPF and DMARC DNS records for your domain, with a plain-English explanation of every tag.
Runs in your browser
Create an RFC 9116 security.txt file so researchers know how to report vulnerabilities to you.
Runs in your browser
Score a vulnerability with CVSS v3.1, see what each metric means in plain English, and copy the vector string.
Runs in your browser
Tell us what you need tested. You’ll get a fixed-fee proposal with tester-days and timeline stated, usually within a few days of the scoping call.
