Web Pentest & Security Assessment
AvailableAssess a website you are authorized to test: detected technologies and versions, security headers, cookies, CORS, TLS, exposed and default files, admin and API endpoints — with a risk score, visual dashboard and recommendations. No exploitation.
Only scan systems you own or have explicit authorization to test. Automated Exposure Assessment — not a full penetration test. NetTools never logs in, guesses passwords, exploits vulnerabilities or sends modifying requests.
1Target
3Scan progress
Assessment report
Automated Exposure Assessment — not a full penetration test.
4Findings & recommendations
5Technology inventory
6Exposure & path results
7Security configuration
How it works
The NetTools server fetches the page once and reads public indicators — response headers, cookie flags, generator tags, asset paths — to identify technologies and assess security headers, CORS and TLS. For owners who verify the domain with a DNS TXT record it then checks curated lists of common, sensitive, default, admin and API paths, one request at a time at a gentle rate, and confirms each hit by its content format rather than the status code alone. Sensitive contents are never downloaded into the report.
What is tested — and what never is
- Tested: response headers, cookies’ security flags, CORS, TLS certificate and redirect, technology indicators (generator tags, asset paths, headers, cookie names), public well-known files, and — for verified owners — curated lists of common, sensitive, default and admin paths plus CMS-specific checks.
- Never: logins, password guessing or spraying, exploitation, POST/PUT/DELETE requests, or downloading sensitive content into the report.
- Found vs possible: a file only counts as found when its content matches the expected format. A 200 answer without that is “possible”; a site that answers 200 for every URL is detected with a random-path baseline.
- Score: Critical 40, High 20, Medium 8, Low 3 points per finding, capped at 100 — higher means more exposed.
Safeguards & responsible use
- GET requests only: no logins, password guessing, exploitation or modifying requests.
- Wordlist path checks require DNS TXT ownership verification; quick checks are limited to public well-known files.
- One host per scan; redirects to other hosts are not followed; private and internal addresses are refused (SSRF protection).
- Conservative rate (1–5 requests/s), hourly budget per target, automatic stop when the target stops answering.
Frequently asked questions
Is this a penetration test?
No. It is an automated exposure assessment: it finds publicly visible weaknesses and misconfigurations. A real penetration test is performed by people, covers far more, and tries to exploit issues under a contract.
Why do I need to verify ownership?
Checking hundreds of paths for files like .env or .git is reconnaissance. Verification makes sure it is only run against sites whose owners asked for it.
Does it test default passwords?
No. It reports known default login pages and which default accounts their vendors document, so you can check them yourself. It never tries credentials.
How is the score calculated?
Each finding adds points by severity (Critical 40, High 20, Medium 8, Low 3, Informational 0), capped at 100. A higher score means more exposure.