Log in from the SignalKit homepage first, then reload this page.
Scanner → Finding → PoC
Finds concrete, mechanically-verified evidence (error signatures, timing deltas, unescaped reflection, out-of-band callbacks) — not guesses. Only scan sites you are authorized to test.
1 · Scan a request
1a · Full domain audit (auto-finder)
Discovers live subdomains (certificate transparency logs + bounded DNS checks, same engine as WebDigger), then automatically runs the config/exposure scan and parameter auto-discovery + vulnerability scan against the root domain and up to 5 live subdomains it finds. One click, whole domain. Uses a much larger request budget — expect this to take a minute or more.
1b · Config & exposure scan
Checks the host itself (no parameter needed) for ~25 known-sensitive paths (.env, .git, SQL dumps, backup files, phpinfo, Actuator, Adminer, SSH keys…) and security headers/cookie flags. Uses the same scope hostname as above.
2 · Findings
3 · Exploit workspace
Proof of concept (Markdown)
Out-of-band Collaborator
Generates a unique token.oob.kyanbarth.com hostname. Paste it (or let the scanner's SSRF probe use it automatically) into a parameter you suspect triggers a server-side outbound request — a webhook URL, an "image from URL" field, an import/fetch endpoint. If the target's server fetches it, the callback is logged here, proving blind SSRF/XXE even with no visible response.