Product
Four parts, one platform.
Attack surface management and security testing, at any scale. Crossfyre Cloud is the platform at crossfyre.io, and the scans run on nodes you launch on your own machines, so only your hardware ever touches a target.
What Crossfyre is
Everything an engagement needs.
Map the target, test it by hand, run it at scale with your team and follow it from your phone, all on one Crossfyre login.
Crossfyre Cloud
Runs on crossfyre.ioThe attack surface management and security testing platform at crossfyre.io. Map what a target exposes, test it, and keep it mapped on a schedule, with confirmed findings, teams and an audit log around it. The scanning runs on nodes you launch on your own machines, so the platform never touches a target itself.
- Attack surface
- Hosts, ports, endpoints and tech, in one asset graph
- Testing
- Vulnerability scans and authorization testing, every finding confirmed
- Nodes
- Launched on your own machines, which is where the scans run
How a run works
Five stages, in order.
You pick targets and press go. Each stage hands the next one typed results rather than text to re-parse, so nothing is guessed twice.
Governance
Every request accounted for.
Roles for every member, a scope nothing gets past, one egress for the whole team, and a record of who did what.
- 10:42:12 meera browsed /checkout in the Workbench app.example.com sent via 203.0.113.24
- 10:42:09 meera sent a request cdn.other-site.net refused: not in scope
- 10:42:06 asha replayed POST /api/orders api.example.com:8443 sent via 203.0.113.24
- 10:42:03 ravi started a scan app.example.com sent via 203.0.113.24
Who can do what
Roles and workspaces
Orgs, teams and workspaces, with a role for every member. Every action checks membership, and nothing leaks across a workspace edge.
What gets tested
A scope you write down
Scans, the Workbench proxy and every replay check one list before anything is sent. Nothing a scan finds is added to it, and an entry that does not parse is refused, never read as a wildcard.
Where requests come from
One egress for the whole team
Every operator can test through the team's proxies and nodes, even from a personal laptop. The client allow-lists one set of addresses, and every request traces back to your team.
Who did what
A trail for every member
The team's activity log records each member's actions, from invites and removals to shell sessions on a node.
Where your data lives
Data that stays put
Production runs in Frankfurt. Credentials and OAST secrets are encrypted at rest, OAST interactions are sealed to a per-scan key, and the platform itself never touches a target.
What the AI may do
AI under your control
Switched off in production today. When it runs, everything is redacted before it leaves, it cannot send a request to a target, and its scan proposals wait for your approval.
The backbone
What every scan stands on.
Pacing and evasion get requests through, discovery finds what there is to test, and testing proves what is wrong. One distribution engine runs all four across your nodes.
Pacing
The target sets the pace
Each node reads what comes back. When the target pushes back it slows down, then finds its way up again, so there is no fixed rate to give it away.
On every plan
Evasion
It gets through
Origin discovery finds the app behind a CDN, browser-fingerprint mode presents a real browser's TLS and headers, and traffic leaves through your own proxy chains.
Fingerprint mode on Reaper
Discovery
It finds everything to test
Subdomains, ports, paths and the tech behind them, then each operation's request fields, learned from the server's own validation errors.
Testing
It proves what is wrong
Templates and injection across query, path and body, structure fuzzing for type confusion and mass assignment, authorization tested as every identity, and GraphQL. Blind bugs are confirmed out of band.
Underneath all four
The distribution engine
It splits every workflow into operations and spreads them across your nodes. When a node drops mid-scan, its work moves to another and picks up exactly where it stopped.
Example
What it tests for
The things a template scanner cannot see.
Recon is the commodity. What finds the bugs worth reporting is testing the same request as different people, and staying logged in while you do it.
- Vulnerability scanning that confirms before it reports Crossfyre’s vulnerability engine proves a finding before it shows you one: out-of-band callbacks for blind classes, an inert control on every differential oracle, and a build that fails if a template matches a word it sent. 101 templates, and every false positive we have shipped is written down.
- Self-hosted, zero-knowledge OAST Crossfyre includes an out-of-band interaction server (OAST) you can self-host for confirming blind bugs like SSRF and blind RCE. Interactions are sealed to a per-scan key, so even the server operator only holds ciphertext. Managed pool or bring your own.
- Reaching authorized targets behind a WAF or CDN A scan that gets blocked returns nothing. Crossfyre discovers a target’s real origin behind a CDN and, on Reaper, presents a genuine browser handshake, so an authorized scan reaches the in-scope app. Origin discovery is available on every plan; paid egress levers are opt-in.
- Mobile app testing without a rooted phone or a PC Crossfyre’s Mobile Tracer captures an Android app’s traffic from the phone itself, no laptop and no root. For certificate-pinned apps it runs a server-assisted repackage that returns patched, installable splits, so full request and response bodies land in the platform. Android only.
Vulnerability scanning
22 classes, every one proven.
Pick a class to see where the engine looks, and what the application has to do before a finding is reported.
Injection 8
SQL injection
InjectionWhere it looks
Error-based, boolean-differential and time-based, including login and search forms.
What has to happen before it is reported
A differential pair plus an inert control of the same length, so a page that simply changes cannot fake it.
Out-of-band 3
Serialization and parsing 2
Business logic 4
Access and exposure 5
SQL injection
InjectionWhere it looks
Error-based, boolean-differential and time-based, including login and search forms.
What has to happen before it is reported
A differential pair plus an inert control of the same length, so a page that simply changes cannot fake it.
Status
What works, what half works, what does not exist.
Taken from our own internal maturity table and published without editing. If something is under Half built, it is because you would notice.
Live10
- Distributed recon across a fleet you enrol: subdomain, port and content discovery
- Authenticated scanning, credentials, and the multi-identity authorization matrix
- The injection oracle and confirm-before-report
- Self-hosted OAST, browser-fingerprint mode and origin discovery
- Web Tracer, the full-capture requests table, intercept and a node-executed Repeater
- Mobile Tracer on Android, with server-assisted capture from pinned apps
- Workbench, the Linux desktop proxy: Proxy, Target, Repeater, Decoder, Comparer, Replay and Findings
- Signed installs of the CLI: one command, apt, Homebrew and GitHub releases
- Discord and Slack alerts, sent as direct messages by the Crossfyre bot
- Orgs, teams, workspaces, RBAC, audit, scheduled routines and the billing stack
Half built6
- Custom .cfx workflows: the create card is still locked
- Priority-queue enforcement
- Per-tier adaptive level differentiation
- Findings retention: the sweep is built and armed in development, and deliberately runs dry in production until a few cycles have been watched
- The mobile app: signing in, launching a node, activity, notifications and remote actions are still being built
- Valkyrie, the AI triage and workspace assistant: built, and switched off on crossfyre.io until every model call runs on an API key
Not yet5
- Managed nodes and managed proxy pools
- Aggregated PDF reporting
- A public partner API
- Two-factor authentication
- A self-hosted control plane
Bring up a node. Run a scan.
Free tier, no card. Or read the code first, which is the better order.