Product

Everything it does, on one page.

Crossfyre runs penetration testing across machines you own. Recon, authenticated scanning, API authorization testing and mobile capture, from one control plane.

How a run works

Five stages, in order.

You pick targets and press go. Each stage hands the next one typed results rather than text to re-parse, so nothing is guessed twice.

1. 1 Find the surface voyagepulse Subdomains, live hosts, open ports. hosts and ports
2. 2 Walk the app mach Paths, files and parameters. endpoints and parameters
3. 3 Work out what it is scout Servers, frameworks, versions. tech and versions
4. 4 Test it cortex Templates, injection, authorization. candidate findings
5. 5 Confirm, then report cortexOAST Nothing arrives unconfirmed.

The engines

Five binaries, all readable.

The parts that touch the target are Apache-2.0 and run on their own, without the platform, if that is what you want.

• voyage Subdomain enumeration Docs
• pulse Port scanning Docs
• mach Content discovery Docs
• scout Service fingerprinting Docs
• cortex Vulnerability and authorization testing Docs

What it tests for

The things a template scanner cannot see.

Recon is the commodity. What finds the bugs worth reporting is testing the same request as different people, and staying logged in while you do it.

• Vulnerability scanning that confirms before it reports Crossfyre’s vulnerability engine proves a finding before it shows you one: out-of-band callbacks for blind classes, an inert control on every differential oracle, and a build that fails if a template matches a word it sent. 101 templates, and every false positive we have shipped is written down.
• Self-hosted, zero-knowledge OAST Crossfyre includes an out-of-band interaction server (OAST) you can self-host for confirming blind bugs like SSRF and blind RCE. Interactions are sealed to a per-scan key, so even the server operator only holds ciphertext. Managed pool or bring your own.
• Reaching authorized targets behind a WAF or CDN A scan that gets blocked returns nothing. Crossfyre discovers a target’s real origin behind a CDN and, on Reaper, presents a genuine browser handshake, so an authorized scan reaches the in-scope app. Origin discovery is available on every plan; paid egress levers are opt-in.
• Mobile app testing without a rooted phone or a PC Crossfyre’s Mobile Tracer captures an Android app’s traffic from the phone itself, no laptop and no root. For certificate-pinned apps it runs a server-assisted repackage that returns patched, installable splits, so full request and response bodies land in the platform. Android only.

What comes with it

The rest of the box.

Your machines

Nodes you enrol on your own Linux boxes. Probes leave from your address, never from shared infrastructure, so someone else cannot get you blocked.

One asset graph

Every engine writes into the same model of the target: hosts, endpoints, the operations on them and their parameters. What the mobile app reveals sits beside what web recon found.

Web Tracer and Bench

Capture your own browsing through a local proxy, read every request and response, hold one and edit it, and replay it from a node rather than from your laptop.

Mobile Tracer

Android capture from the phone itself, through certificate pinning, with no root and no PC.

Credentials

Static tokens, form logins, and OAuth2, OIDC and SSO through a headless browser. Each credential carries a role, which is what makes authorization testing possible.

Out-of-band confirmation

A managed OAST endpoint, or your own: the server is open source and runs inside the CLI.

Scheduling

Routines run a workflow on a schedule. Missions chain several and pass results between them.

Teams

Organisations, teams, workspaces, role-based access and an audit log. Every route is authorization-gated, and the gate is checked on commit.

Status

What works, what half works, what does not exist.

Taken from our own internal maturity table and published without editing. If something is under Half built, it is because you would notice.

Bring up a node. Run a scan.

Free tier, no card. Or read the code first, which is the better order.