Live from the scan-engine registry — always current

Every Scanner We Run — All 276

No marketing fluff. This is the actual plugin registry of the 2MNY scan engine — the same list our orchestration dispatches on every scan.

Quick tier

272

Deep tier

276

Superdeep tier

13,000

Nuclei templates

Engine Intelligence

More Than A Scanner List

Six intelligence layers enrich every single finding before it reaches your report.

Exploit Availability

Each CVE is cross-checked against the CISA Known Exploited Vulnerabilities catalog, 264 exploit-arsenal CVEs with validated weaponized PoCs (82 CISA KEV), 25,089 ExploitDB-mapped CVEs and 3,192 Metasploit-mapped CVEs — so you know which bugs are actually weaponized, not just theoretical. The 27 highest-value CVEs (11 CISA KEV) can be actively confirmed in real time with read-only, non-destructive detection probes — live verification, not just a version match.

Synced daily (2026-10-14) EPSS scoring

CWE → OWASP Mapping

Every finding carries its CWE identifier mapped automatically to the OWASP Top 10 category — so both engineers and compliance teams read the same language.

CWE IDs OWASP Top 10 CVSS severity

Safe-By-Design Scanning

A safe-tag policy excludes destructive and DoS-class templates from the Nuclei pack. Every result passes 3-gate confirmation — template matcher, engine verification, and a known-bad denylist — before it appears in your report.

Safe-tag policy 3-gate confirmation Isolated containers

Ransomware & Threat Intel

Every scan cross-checks your domain against our live ransomware leak-site intelligence — dozens of extortion groups and their published victims, synced hourly — and reports enrich with VirusTotal reputation and Censys internet-surface context when enabled.

Hourly leak-site sync VirusTotal reputation Censys surface intel

Evidence Verification

Critical and high findings are automatically re-checked live after the scan — confirmed live, already remediated, unreachable, or not machine-verifiable — and discovered credentials are validated against the live provider, so nobody chases a rotated password.

Live re-verification Credential liveness Verdict chips in reports

Repo & Secret Exposure

Proof-level checks for exposed .git history, Subversion/Mercurial metadata, dependency manifests across 11 ecosystems (OSV-queried), HashiCorp Vault / Consul / Infisical secrets managers, and unauthenticated API-gateway admin planes — with content-level evidence, not just existence checks.

.git history analysis OSV dependency SCA Vault & gateway planes

The Full Fleet

276 Scanners, 19 Categories

QUICK in every scan (free tier) DEEP deep-scan tier SUPERDEEP heavy tools, weekly

OWASP & Web Vulnerabilities

Injection (SQLi, SSTI across 13 engine families, XPath, XXE), XSS, SSRF, access control with 403/ACL-bypass matrices, JWT attacks (alg confusion, jku/x5u), server-side parameter pollution, logic flaws.

123 scanners

API Security Depth (OWASP API Top-10) DEEP

Account Enumeration Oracle Detection (login forms) DEEP

Apache Shiro rememberMe Default-Key Oracle DEEP

Auth Header + 403 Bypass Testing DEEP

Authenticated Surface Scan (opt-in) DEEP

Backup File Discovery DEEP

CRLF Injection Proof QUICK

CSRF (Cross-Site Request Forgery) DEEP

CSS Context Injection (reflected input in CSS surfaces) DEEP

CSV Formula Injection (export cell audit + reflection vector) DEEP

Cache Tier vs Authentication Misconfiguration QUICK

Captcha Weakness Audit (v1 widgets / answer leaks / enforcement) DEEP

Clickjacking Framability Proof (Browser PoC) DEEP

Client-Side Path Taint (DOM path injection surface) DEEP

Client-Side Token Storage (XSS-to-Account-Takeover surface) DEEP

Cloaking Detection (Googlebot vs user content) DEEP

Content Anomaly & Compromise Detection DEEP

Content Discovery & Misconfiguration Audit DEEP

Cross-Site Scripting (XSS) — Advanced DEEP

DOM Clobbering Surface (id/name global shadowing) DEEP

DOM Hygiene (Tabnabbing / Meta-Refresh / javascript: URIs) QUICK

Deep CORS Scanner (Corsy + Origin Matrix) QUICK

Deep Command Injection Scanner DEEP

Deep LFI Scanner DEEP

Deep SQL Injection Scanner DEEP

Deep XSS Scanner DEEP

Defacement Detection DEEP

Default Credential Exposure (opt-in, authorization-gated) DEEP

Drupal Deep Scanner DEEP

Exploit-Arsenal Known CVE Engine (264 CVEs, 82 CISA KEV, 27 active safe-probes) DEEP

Fastjson autoType Deserialization Surface Detector DEEP

File Upload Surface Detection DEEP

Ghauri SQLi Cross-Verification (detection-only) DEEP

GraphQL API Security Scanner DEEP

Hidden Parameter Discovery (Arjun) DEEP

Host Header Injection Reflection QUICK

IDOR / BOLA Attack Surface (pattern layer) DEEP

IIS 8.3 Shortname Oracle & Semicolon Extension Confusion QUICK

Information Disclosure Detection QUICK

Injection Subtechniques (LDAP/XPath/SSI/Deserialization/Prototype Pollution) DEEP

Insecure Direct Object Reference DEEP

JSONP Callback Hijack Precondition Audit QUICK

JWT Token Analysis QUICK

JavaScript Cryptographic Hygiene Audit QUICK

JavaScript Library CVEs (retire.js) DEEP

JavaScript Library Vulnerabilities DEEP

JavaScript Secret Extraction DEEP

Joomla Deep Scanner DEEP

Local File Inclusion (Advanced) DEEP

Magento Deep Scanner DEEP

Multi-Tenant Isolation Proof (opt-in) DEEP

Nginx Alias Off-By-Slash Traversal QUICK

Nikto Web Vulnerability Scanner DEEP

NoSQL Injection DEEP

Nuclei Extended (13K templates) SUPERDEEP

Nuclei Full-Pack (13.7K templates, safe-tag policy) DEEP

Nuclei Vulnerability Scanner DEEP

OAuth & Social Login Exposure QUICK

OAuth Scope & Argument Guard (ScopeArgGuard) DEEP

OIDC Discovery Configuration Analysis QUICK

ORM / HQL Injection (error-banner fingerprints) DEEP

OS Command Injection DEEP

OWASP LLM Top-10 Probe (deterministic) DEEP

OWASP ZAP DAST Scanner SUPERDEEP

Open Redirect Scanner DEEP

OpenAPI-driven API Security Testing DEEP

Out-of-Band (OOB) Vulnerability Detection DEEP

Outdated Software & CVE Lookup DEEP

PHP Type Juggling Auth Bypass (JSON type-confusion differential) DEEP

PII & Excessive-Data Exposure Classifier (BD NID/passport/mobile/email) DEEP

Password Policy & Reset Flow Assessment QUICK

Path Normalization Inconsistency (WAF bypass surface) QUICK

Prototype Pollution (Client and Server) DEEP

Race Condition (TOCTOU) Scanner DEEP

Rate Limiting & Brute-Force Protection Scanner DEEP

ReDoS Timing Differential (regex backtracking) DEEP

Relative Path Overwrite (RPO) style-injection chain DEEP

Repository Dependency SCA (OSV.dev) DEEP

SAML Metadata, Signing & Certificate Audit QUICK

SQL Injection (Advanced) DEEP

SQL Injection Proof-of-Exploit DEEP

SQLMap SQL Injection Confirmation SUPERDEEP

Secret Detection (gitleaks) DEEP

Sensitive Path & File Disclosure QUICK

Serialized Object & Deserialization Exposure QUICK

Server-Side Request Forgery (SSRF) DEEP

Server-Side Template Injection (SSTI, 13 engine families) DEEP

Service Worker Security (scope & imports) QUICK

Session Management Suite (opt-in) DEEP

Shadow API Discovery DEEP

Source Map Exposure & Secret Recovery (.map) DEEP

Subresource Integrity (SRI) Audit QUICK

Tomcat Ghostcat AJP File-Read Proof (CVE-2020-1938) DEEP

Two-Factor Authentication Presence Detection QUICK

Unauthorized Service Exposure (afrog pack) QUICK

Universal Content Discovery & Analysis DEEP

Value-Aware Parameter Mutation + SSPP (semantic, differential-confirmed) DEEP

Verbose Error Disclosure Fuzz (search inputs) QUICK

WAF Effectiveness Verdict (block/reflect/pass probe table) DEEP

Wapiti DAST Scanner SUPERDEEP

Web Application Firewall (WAF) Detection QUICK

Web Cache Deception & Poisoning (WCVS) DEEP

Web Cache Deception (asset-path caching of dynamic pages) DEEP

Web Cache Poisoning and Cache Deception DEEP

Web Malware & Skimmer Detection DEEP

WebSocket Security Scanner DEEP

Webshell Detection DEEP

WordPress Backup Plugin Exposure Scanner DEEP

WordPress Deep Enumeration DEEP

WordPress Hardening Residue (debug.log / wp-cron / plugins listing) DEEP

WordPress Plugin Vulnerability Scanner DEEP

WordPress User Enumeration Scanner DEEP

WordPress Vulnerability Scanner (WPScan) DEEP

WordPress XML-RPC Attack Vector Scanner DEEP

WordPress admin-ajax.php nopriv Exposure DEEP

XML External Entity (XXE) DEEP

XPath Injection (XML surface, error-based + boolean-diff + numeric axes) DEEP

XSLT Injection (system-property canary) DEEP

XSS Deep Scan (dalfox) DEEP

afrog CVE PoC Pack (verified, GET-only) DEEP

postMessage Handlers Origin Validation DEEP

Recon & Attack Surface

Subdomains, ports, directories, WHOIS, exposed panels and takeover risks.

43 scanners

AI/LLM Attack-Surface Exposure Audit QUICK

API Gateway Admin Plane Exposure DEEP

Advanced Subdomain Discovery DEEP

Amass Passive Subdomain Enumeration (OWASP) DEEP

Banner Grabber QUICK

Breach & Compromise Feed Aggregator QUICK

CI/CD Pipeline & DevOps File Exposure DEEP

Certificate SAN Sibling Discovery (live cert + crt.sh) DEEP

Cloudflare Bypass & Origin IP Discovery DEEP

Compromise & SEO-Spam Intelligence QUICK

Debug Output & Tooling Exposure DEEP

Directory Discovery (feroxbuster) DEEP

Docker/Kubernetes API Exposure DEEP

Document Metadata Exposure (FOCA-class, exiftool) DEEP

Domain Blacklist & Reputation Check QUICK

Exposed Admin Panels & Management Services DEEP

Fast Port Scanner (naabu) DEEP

FingerprintHub Tech Engine (3.3K signatures) DEEP

GitHub Exposure Monitor DEEP

HTTP Probing (httpx) DEEP

Headless Browser Scanner (Chromium) DEEP

Historical URL & Endpoint Mining (waymore) DEEP

Historical URL Discovery (gau) DEEP

IP Geolocation & ASN Intelligence QUICK

IP Reputation & Infrastructure Intelligence (ET + Feodo blocklists, ASN context, AbuseIPDB) DEEP

Infostealer Credential Intelligence QUICK

JavaScript/HTML Secret Scan DEEP

Live Phishing & Malware Feed Intelligence (OpenPhish + URLhaus + ThreatFox) QUICK

Open Directory Discovery QUICK

Open Directory Secret Scan DEEP

Open Port Scanner (Nmap) DEEP

Robots.txt & Sitemap.xml Analysis QUICK

Search Engine Dorking DEEP

Shodan InternetDB Exposure Intel QUICK

Subdomain Deep Security Scanner DEEP

Subdomain Enumeration (Multi-Source) DEEP

Technology Fingerprint (Multi-Layer) QUICK

Tor Proxy Connectivity Scanner DEEP

Typosquat & Lookalike Domain Discovery (dnstwist-class + feed correlation) DEEP

WHOIS & Domain Registration QUICK

Wayback CDX Endpoint History (Passive) QUICK

Web Crawler & Directory Discovery QUICK

Web Crawler (katana) DEEP

Cloud & Service Exposure

Public S3/GCS/Azure buckets, CMS installer scripts, SOAP/WSDL service contracts — listing-proof, no false positives.

27 scanners

CMS Installer / Setup Script Exposure QUICK

Cloud Storage Public-Bucket Exposure (S3/GCS/Azure, listing-proof) DEEP

Database Service Exposure (Redis / Memcached / PostgreSQL / MongoDB / ClickHouse / Solr / InfluxDB) DEEP

FTP Anonymous Access & FTPS Audit DEEP

Firebase Exposure Audit (RTDB / Firestore / Storage, read-only) QUICK

Git Repository History Exposure (proof-level .git rip check) DEEP

JavaScript Dev-Server Exposure (webpack / Vite / Next.js HMR) QUICK

LDAP Anonymous Bind & RootDSE Audit DEEP

Message Broker Exposure (MQTT / NATS / Kafka / RabbitMQ / ActiveMQ) DEEP

Mobile App Links Exposure (assetlinks.json / apple-app-site-association) QUICK

NTLM Challenge Information Disclosure QUICK

Public Office Document Macro Audit (VBA/DDE/external links) DEEP

RDP NLA Negotiation Audit DEEP

Ransomware Leak-Site Exposure Check QUICK

Repository API Key / Token Exposure DEEP

Repository Backup & Junk File Exposure DEEP

Repository CI/CD Pipeline Exposure DEEP

Repository Internal-Infrastructure Disclosure DEEP

Repository SQL Dump / PII Exposure DEEP

Repository Secret File Exposure DEEP

Repository Webshell / Backdoor Patterns DEEP

SOAP / WSDL Service Exposure QUICK

Secrets Manager Exposure (HashiCorp Vault / Infisical) DEEP

Service Registry & Config Exposure (ZooKeeper / Eureka / Apollo / Spring Config) DEEP

SharePoint Anonymous-Access Surface Audit QUICK

UDP Amplification Audit (Open Resolver / NTP monlist / SNMP public / Memcached-UDP) DEEP

VCS Working-Copy Metadata Exposure (SVN / Mercurial / Bazaar / CVS) DEEP

Framework & CMS Stacks

Stack-specific hygiene and CVE coverage: Laravel, Next.js (incl. CVE-2025-29927 middleware-bypass testing), Spring Boot, ASP.NET, Drupal/Joomla/Magento, Django, Rails, Node/Express.

16 scanners

ASP.NET / IIS Security Suite DEEP

Angular Security Suite DEEP

Django Security Suite DEEP

Drupal Hardening Suite DEEP

Joomla Hardening Suite DEEP

Laravel Security Suite DEEP

Magento Hardening Suite DEEP

Next.js Security Suite DEEP

Node.js / Express Security Suite DEEP

Nuxt Security Suite DEEP

PHP Hygiene & Framework Debug Suite DEEP

React Security Suite (CRA / Vite client) DEEP

Ruby on Rails Security Suite DEEP

Spring Boot / Java Stack Suite DEEP

Svelte / SvelteKit Security Suite DEEP

Vue Security Suite DEEP

DNS & Email Security

DNS records, DNSSEC, SPF/DKIM/DMARC, MX probing, subdomain takeover.

11 scanners

CAA Policy & DNSSEC Validation (DoH) QUICK

DNS Analysis QUICK

DNS Deep Probing (dnsx) DEEP

DNS Zone Transfer (AXFR) Test DEEP

DNSSEC Validation QUICK

Email Authentication Depth Audit (SPF/DKIM/DMARC/MTA-STS/TLS-RPT/BIMI) QUICK

Email Security (DKIM / MTA-STS / TLS-RPT) QUICK

IPv6 Readiness & Dual-Stack Security Parity QUICK

Passive-DNS History Analysis DEEP

SMTP Audit & Spoofability Verdict (SPF/DKIM/DMARC + MX probes) QUICK

Subdomain Takeover (Dangling CNAME) DEEP

Security Headers

CSP, HSTS, cookies, mixed content, clickjacking and MIME protections.

9 scanners

Content Security Policy Evaluator QUICK

Cookie Security Audit QUICK

Cookie Security Deep Analysis DEEP

HTTP/3 & Alt-Svc Advertisement Audit QUICK

Mixed Content Detection QUICK

Modern Security Header Tail (COOP/COEP/CORP/Permissions-Policy/SRI/security.txt) QUICK

Redirect Chain & Server Signature Audit QUICK

Security Features Enforcement Test QUICK

Security Headers Analysis QUICK

AI & LLM Security

MCP endpoint security, LLM/agent surfaces (llms.txt, ai-plugin.json), AI exposure mapping.

8 scanners

A2A Agent Card Exposure QUICK

AI Panel Exposure (Ollama / Open WebUI / Flowise / n8n / Dify / ...) DEEP

LLM / AI Agent Surface (llms.txt, ai-plugin.json) QUICK

MCP (Model Context Protocol) Endpoint Security DEEP

MCP Resource & Prompt Exposure DEEP

MCP Tool Surface & Poisoning Analysis DEEP

MLOps Exposure (MLflow / TensorBoard / Ray / Triton / BentoML) DEEP

Vector DB Exposure (Qdrant / Chroma / Weaviate / Meilisearch / Elasticsearch) DEEP

HTTP Protocol

HTTP verbs & methods, request smuggling (TE.CL, h2c), HEAD bypass, response behaviour.

8 scanners

API Verb Gap (HEAD Bypass + Actuator) DEEP

H2C Cleartext HTTP/2 Smuggling DEEP

HTTP Analysis DEEP

HTTP Method Exposure DEEP

HTTP Methods Audit QUICK

HTTP Request Smuggling DEEP

WebDAV Exposure (OPTIONS/PROPFIND, read-only) DEEP

gRPC Surface & Reflection Exposure DEEP

Technology Fingerprinting

whatweb-grade CMS/framework/server detection with CVE and EOL matching, plus an offline exploit-arsenal catalog of 264 CVEs with validated weaponized PoCs (82 CISA KEV) matched against observed product versions, with 27 high-value CVEs (11 CISA KEV) actively confirmed by read-only detection probes.

8 scanners

CMS & Framework Fingerprinting QUICK

CMS Deep Scanner DEEP

Deep Multi-Ecosystem Dependency Vulnerability Scanner (manifests + OSV.dev) DEEP

Favicon Technology Mapper DEEP

PWA Web App Manifest Audit QUICK

Supply-Chain Dependency Vulnerability Scanner (manifests + OSV.dev) DEEP

Technology Fingerprinting (webanalyze) DEEP

WAF Product Identification (wafw00f) DEEP

Payments

5 scanners

Payment & Checkout Surface Map DEEP

Payment Gateway Configuration Audit DEEP

Payment Page Transport Hygiene DEEP

Payment Return & Confirmation Exposure DEEP

Payment SDK & Script Audit DEEP

Configuration

5 scanners

Repository Branch Protection DEEP

Repository Dockerfile and Compose Audit DEEP

Repository IaC Misconfiguration Audit DEEP

Repository Kubernetes Manifest Audit DEEP

Repository Weak Cryptography Usage DEEP

SSL/TLS Analysis

Certificate chain, expiry, cipher strength, protocol versions.

4 scanners

SSH Algorithm Negotiation Audit (KEXINIT analysis) DEEP

SSL Labs Deep SSL Analysis DEEP

SSL/TLS Analysis QUICK

TLS / Cipher Strength Analysis QUICK

Secrets

3 scanners

Repository Hardcoded Credentials DEEP

Repository SOPS Secrets Management Leaks DEEP

Repository Webhook Token Exposure DEEP

Application Logic

Advanced multi-step penetration methods beyond single-page probes.

1 scanner

Advanced Penetration Scanner (APS) DEEP

Threat Intelligence

Correlation of findings with live threat feeds.

1 scanner

Dark-web Mention Monitor DEEP

Sca

1 scanner

Repository Dependency Supply-Chain Risk DEEP

Compliance & Disclosure

security.txt (RFC 9116) presence and validity — responsible-disclosure readiness.

1 scanner

security.txt (RFC 9116) Validation QUICK

Privacy

1 scanner

Third-Party Tracker & Privacy Flow Audit QUICK

Site Quality & Health

Accessibility, performance and SEO signals alongside security.

1 scanner

Website Health (Accessibility + Performance + SEO) DEEP

Put all 276 to work on your site.

Start with the free quick tier — upgrade to deep when you want the full 13,000-template Nuclei pass.

Start Free Explore Deep Audit