Home / Platform
Every capability, in depth: from the first sweep of an address range to a prioritized, exportable report, all in one self-hosted console.
Discovery Scan is the front of the funnel: sweep a range into a named group, then point the vulnerability, attack-surface or OT/IoT scanners at that same group.
A purpose-built, read-only check engine for internal infrastructure (not restricted to public targets) that maps results straight onto ThreatLark findings.
| Module group | Representative checks |
|---|---|
| Plaintext / legacy protocols | Telnet, FTP, Finger, rlogin/rsh/rexec, plaintext POP3/IMAP/SMTP, TFTP, HTTP Basic Auth over plaintext |
| TLS / crypto weaknesses | TLS 1.0/1.1, SSLv2, SSLv3, weak cipher suites |
| Windows / SMB / AD | SMBv1 and signing, NTLMv1 downgrade, SMB shares, AS-REP roasting, Kerberoastable SPNs, AD CS web enrollment, WinRM |
| Remote access | Legacy SSH algorithms, RDP without NLA, VNC, X11, RADIUS, TACACS+, IKEv1 aggressive mode |
| Network / infra protocols | SNMP v1/v2c, IPMI/BMC, SIP, LLMNR, WPAD, BGP, DNS zone transfer, open resolvers, NTP mode 6 |
| Cloud metadata | AWS IMDSv1, GCP and Azure metadata service reachability |
| Containers / orchestration | Docker API, Kubernetes API and kubelet, etcd, Consul, Nomad, Portainer, registries |
| Databases | Redis, MongoDB, Elasticsearch, PostgreSQL trust auth, MySQL, Kafka, ClickHouse, MinIO, and more |
| IoT / messaging | Unauthenticated MQTT and NATS brokers |
| Dev tools & admin panels | Jenkins, Grafana, Spring Boot Actuator, Tomcat Manager, exposed .git and secret files, Swagger/OpenAPI |
Most OT and IoT protocols are unauthenticated by design, so a reachable port is itself the finding. ThreatLark probes for them without ever touching the process.
New Scan consolidates core web checks, content discovery and an optional chain of open-source scanners into one run, one report and one set of findings.
Each runs as its own tracked job, with its own schedule, results and reports.
Twelve modules: fingerprinting, plugin and theme enumeration, CVE cross-reference against a local NVD feed, XML-RPC, REST API, user enumeration, auth security, file exposure and plugin/theme deep dives. Intrusive checks are off by default.
Read-only audit of REST and GraphQL APIs: headers, CORS, methods, rate limiting, GraphQL introspection, verbose errors, a 108-path exposed-endpoint catalog and OpenAPI spec audit with optional two-identity BOLA testing.
Trivy-powered CVE scanning of container images (OS packages and application dependencies, layer by layer) with severity and fix-available filters. Findings feed the same prioritization.
Multi-protocol credential auditing for internal infrastructure: SMB, SSH, WinRM, FTP, RDP, VNC, NFS, LDAP, rsync, TFTP and SNMP. Per-attempt delay and jitter, attempt caps and an SMB lockout threshold keep audits from locking real accounts; an optional password-reuse check pivots a confirmed credential across protocols.
Scans the full commit history of git repositories for hardcoded credentials with hundreds of provider detectors, optionally verifying candidates live against the issuing provider. Entropy-based detection and a “verified only” mode are available; findings carry a redacted preview.
Intelligence features enrich findings and surface emerging risk alongside your scan results.
External API keys are optional and encrypted at rest; tools fall back to free tiers or degrade gracefully when a key is absent.
Raw tool output is de-duplicated into findings, one row per distinct issue, so re-running a scan updates what you already track instead of piling up duplicates.
Fix-first priority score (0-100)
Export formats
Dashboards, program metrics and reports all draw on the same findings, so the numbers agree everywhere.
Run any scanner once or on a recurring cadence (minutes to months), timezone-aware.
Reusable named host lists, shareable with specific users, usable across every scanner.
In-app notifications, plus optional Slack, webhook and email (SMTP) alerts per event type.
Tech-detect, SSL/TLS, port, WHOIS and CVE lookups for the current tab, through your signed-in session.
Subdomains, ports, SSL/TLS, certificates, DNS, WHOIS, IP info, headers, tech, URLs, content discovery, CORS, CVE and IOC.
Everything the UI does goes through a documented HTTP API, browsable in-app at /api-docs.
Book a walkthrough and see discovery, exposure scanning and prioritized findings running on your own network ranges.