The pinnacle of offensive security infrastructure.
The fastest, most evasive recon and vulnerability scanning, at any scale, from nodes you run. Think of it as heavy artillery for everyone in offensive security, human or AI.
Crossfyre is in beta and changing fast. Expect major changes as we build.
The stack
Security testing at scale is an infrastructure problem. So we built the infrastructure.
Six layers, from a bare Linux box to a ranked list of proven findings. The engines are open-source Rust.
- 01
Nodes
One command turns a Linux box into a node. Engines install from a signed release and keep running through reboots.
- 02
Egress
Scans leave from your own machines and their IPs, never from ours.
- 03
Engines the layer you already have
Five open-source Rust engines for recon and scanning. Most tools stop here.
- 04
Workflows
Recon feeds scanning automatically, and each stage branches on what the last one found.
- 05
Orchestration
Work spreads across your fleet from a control plane that runs no scans itself. If a node dies mid-scan, the work is not lost.
- 06
Findings
Every finding is confirmed and ranked, with the request that proves it.
Running it across many machines needs the other five.
How it works
Your machines, the target's pace, and proof, not guesses.
01 Enrol a machine, start a scan.
Nodes are yours and they dial out, so nothing needs a way in. The control plane hands out work and runs no scans itself.
02 The target sets the pace.
Each node probes from its own address and reads what comes back. Push back and it slows down, then finds its way up again. A fixed rate you typed in is its own giveaway.
03 The whole target, mapped and proven.
Recon reaches every host it can, and every finding is confirmed before it is reported. On the limeyard lab that was all 48 answer-key entries, with no false positives.
Mobile
A pinned app, on a phone you did not root.
Capture on a phone stops dead at certificate pinning, which is what the apps worth testing use. Crossfyre repackages the app instead. No root, no laptop, no Frida.
01 Attach the tracer.
Every request goes through it, and a copy reaches crossfyre. The app pins its certificate, so that copy is noise.
02 Rebuild the app.
The pinning check is rewritten and your certificate goes inside the build. Nothing is installed on the phone afterwards, and nothing is rooted.
03 Read the traffic.
Same phone, same backend, same tracer. The copy reaching crossfyre is now a request you can read, hold, edit and send again.
Pricing
Pay for how much you scan.
- Free $0 Try it.
- Pro $290/yr One operator.
- Reaper $790/yr Running flat out.
- Syndicate $1,490/yr A crew of three.
Prices are per year, which is two months free against paying monthly. The free tier needs no card. Pro and Reaper start with a 7-day trial that needs a card and charges nothing until it ends, and you can cancel any time before then. Syndicate includes three seats; more are $390 a year each. Billed in INR, so the figures above are indicative. Full pricing.
Questions
The ones worth answering.
Bring up a node. Run a scan.
Free tier, no card. Or read the code first, which is the better order.