Every tool SimpleSec uses, mapped to what it does.
We don't reinvent the wheel. SimpleSec orchestrates the same 39 battle-tested open-source tools your auditor already trusts — run in the right order, with AI planning, evidence capture, and approval gates layered on top. It doesn't stop at "port 445 is open": it authenticates, enumerates, and proves exploitability.
Recon
Map the attack surface. Discover hosts, services, subdomains, and content before anything intrusive runs.
nmap
Service and version detection across discovered ports.
naabu
Fast SYN/CONNECT port scanner from ProjectDiscovery.
subfinder
Passive subdomain enumeration across 30+ sources.
httpx
HTTP probing and service identification at scale.
dnsx
Bulk DNS resolution of domains and subdomains.
katana
JavaScript-aware crawler — endpoints, params, JS files.
whatweb
Fingerprints CMSes, frameworks, and versions.
Web vulnerability scanners
Find weaknesses in web applications, APIs, and services with proven open-source scanners.
nuclei
Template-based vulnerability scanning at scale.
nikto
Web misconfig, exposed-file, and CVE checks.
ffuf
Content discovery and directory fuzzing.
testssl
TLS/SSL config analysis — weak ciphers, expired certs.
wpscan
WordPress plugin, theme, user, and CVE scanning.
kiterunner
Context-aware API route brute-forcing.
arjun
HTTP parameter discovery to surface hidden inputs.
openapi_probe
OpenAPI, Swagger, and GraphQL document discovery.
Exploit & validation
Confirm findings are real — not false positives. Targeted exploitation under approval gates.
sqlmap
SQL injection detection and proof-of-impact.
dalfox
Reflected, stored, and DOM XSS with PoC payloads.
Active Directory attack paths
The full authenticated chain — roast tickets, map every route to Domain Admin, abuse certificate templates and delegation, then prove it.
bloodhound
Collects and analyses AD attack paths — "N routes to Domain Admin", in plain English.
adcs
AD CS certificate-template misconfiguration sweep, ESC1 through ESC15 (Certipy).
adcs_exploit
ESC1 proof-of-exploit — mints an impersonation certificate. Destructive, approval-gated.
kerberoast
Extracts TGS-REP hashes for SPN accounts.
asreproast
Extracts AS-REP hashes for accounts without pre-auth.
delegation
Kerberos delegation abuse — unconstrained, constrained, and RBCD.
gpp_password
Recovers GPP cpasswords from SYSVOL (MS14-025).
ldap_enum
Users, groups, and admins via LDAP — authenticated or anonymous.
credential_spray
Lockout-safe spraying, capped at 3 passwords per user against the real domain policy.
smb_spider
Authenticated share crawl and sensitive-file discovery.
secretsdump
Dumps SAM, LSA, and NTDS secrets with admin credentials.
Internal network & remote execution
Once the WireGuard agent is connected, enumerate the inside the way a foothold attacker would — and prove code execution where it counts.
netexec
Unauthenticated SMB enum — signing, SMBv1, null auth, shares, users, policy.
netexec_authed
Authenticated SMB enum — shares, sessions, local-admin validation.
enum4linux
Null-session SMB and RPC enumeration.
winrm_exec
Proof-of-execution over WinRM.
ssh_audit
SSH crypto posture — ciphers, KEX, MACs, known CVEs.
ssh_auth_methods
Enumerates which SSH authentication methods a host accepts.
Databases & credentials
Enumerate databases with captured credentials, extract sample data as proof of impact, and crack what you collect.
hashcat
Offline cracking of Kerberos TGS/AS-REP and NTLM hashes.
mssql_exec
Proof-of-execution via MSSQL xp_cmdshell.
postgres_enum
PostgreSQL database and schema enumeration with captured creds.
postgres_tables
Table-level enumeration inside a reachable PostgreSQL instance.
postgres_dump_table
Extracts sample rows as evidence of real data exposure.
All of these in one workflow.
You don't install them. You don't glue them together. You launch a test and SimpleSec runs the right tool at the right time.