Recon & scanning tools

The open-source tools Tandera orchestrates across its recon flows. Each page covers how to install it, the commands worth knowing, what its output means, and how to use it in a pentest — grounded in how Tandera actually runs it.

• Arjun How to install and run Arjun, and why undocumented parameters are where authorisation logic tends to break.
• cdncheck How to install and run cdncheck, and why Tandera resolves CDN ownership in discovery before any active scanning is scheduled.
• cero How to install and run cero, and why certificate SANs surface hosts that no passive DNS source knows about.
• dnsx How to install and run dnsx, what its record output looks like, and why Tandera resolves every discovered hostname before probing it.
• Findomain How to install and run findomain, and why Tandera runs three passive subdomain producers instead of one.
• gau (getallurls) How to install and run gau, what its URL corpus is good for, and how Tandera uses archived URLs to surface endpoints that no longer appear in a crawl.
• graphw00f How to install and run graphw00f, what the GraphQL engine tells you about likely weaknesses, and where it fits in Tandera recon.
• httpx How to install and run httpx, read its JSON output, and how Tandera uses it to turn a hostname list into a live, fingerprinted attack surface.
• jxscout What jxscout does in Tandera JavaScript analysis, how it complements LinkFinder and TruffleHog, and how to work its output in a pentest.
• katana How to install and run katana, when to use headless mode, and how Tandera uses its crawl output to feed parameter and secret analysis.
• Kiterunner How to install and run Kiterunner, why it beats generic directory brute-forcers on modern APIs, and how Tandera uses it for shadow-endpoint discovery.
• LinkFinder How to install and run LinkFinder, and why JavaScript is the most reliable place to find undocumented API routes.
• masscan How to install and run masscan, why rate limiting is a safety control rather than a tuning knob, and how Tandera pairs it with nmap.
• MobSF How to run MobSF against an APK or IPA, what its static analysis reports, and where mobile recon fits in Tandera.
• Nmap How to install and run nmap, which scan profiles matter, how to read its XML output, and where it sits in Tandera active scanning.
• nuclei How to install and run nuclei, tune severity and rate limits, read its JSONL output, and how Tandera turns each match into a deduplicated finding.
• Prowler How to install and run Prowler against AWS, Azure and GCP, and how Tandera turns hundreds of check results into a reportable set.
• retire.js How to install and run retire.js, and how to turn a vulnerable-library match into a finding a client can act on.
• S3Scanner How to install and run S3Scanner, and how Tandera uses it for unauthenticated cloud footprint enumeration.
• Scout Suite How to install and run Scout Suite, how its HTML report differs from Prowler output, and why Tandera runs both.
• Shodan How to use the Shodan CLI and API for passive enrichment, and how Tandera uses it without sending traffic to the target.
• subfinder How to install and run subfinder, what its JSON output contains, and how Tandera uses it in the discovery phase of web recon.
• tlsx How to install and run tlsx, what its certificate output reveals about an attack surface, and how Tandera uses it across fingerprint and active scan.
• TruffleHog How to install and run trufflehog, why verified-only mode matters, and how Tandera turns a verified secret into a finding with real severity.
• unfurl How to install and run unfurl, and how Tandera uses it to turn a raw URL list into parameter and path wordlists.
• wafw00f How to install and run wafw00f, and why knowing the WAF changes both your methodology and what you can honestly claim in the report.
• waybackurls How to install and run waybackurls, how it differs from gau, and why Tandera schedules both in the enrich phase.
• XSStrike How to install and run XSStrike, why context-aware payloads beat generic ones, and how to keep XSS testing inside scope.