Crossfyre CLI
One CLI for security testing.
crossfyre is the command-line toolchain for authorized security
testing. Log in, bring any host online as a distributed recon node, and
install the scan engines you need: content discovery, subdomain enumeration,
network scanning, all from one binary. Authenticated by default: the CLI
does nothing until you crossfyre login.
curl -fsSLO https://get.crossfyre.io/install.sh sudo bash install.sh Read install.sh before you run it. It checks the release manifest's signature and every binary's SHA-256 before it installs anything. Other ways to install are on the install page.
crossfyre login sudo crossfyre node init What the CLI does
Signs in once
crossfyre login saves a session that node init uses to enrol a host and node list uses to show your fleet. Sign in with an API key, your credentials, or the browser. The engines and the local commands run without it.
Runs distributed nodes
Turn any host into a recon node with one command, provisioned under your account, wired into the control plane, with its own local database, ready to take work.
Installs scan engines
A built-in package manager installs, updates, and removes the voyage / doorward / ambulo / toolmark / plessor engines, every download checksum-verified against the release manifest.
Scan engines
Engines are the scanners your nodes run. The CLI installs and supervises them;
add or drop one any time with crossfyre extension install. Each is a
standalone, checksum-verified daemon.
voyage
Subdomain enumeration engine. Maps an organization’s external footprint by resolving and expanding its DNS namespace at scale.
doorward
Network host and port-scanning engine. Sweeps ranges for live hosts and open services to chart the reachable perimeter.
ambulo
High-throughput HTTP fuzzer and content-discovery engine. Brute-forces paths, parameters, and virtual hosts to surface hidden attack surface.
toolmark
Service and technology fingerprinting engine. Identifies the software, versions, and stacks behind live services so the rest of the pipeline knows what it is hitting.
plessor
Vulnerability scanning engine. Runs active, confirm-before-report checks for injection, authorization, and exposure classes, reproducing each finding before it lands.
Downloads
Prebuilt binaries of the CLI and its scan engines for Linux on x86-64 and 64-bit ARM, Windows on x86-64 and macOS on Intel and Apple silicon, each with the SHA-256 from the signed release manifest. The Android Tracer app and the Workbench desktop app are below them. Prerequisite: Docker. The scan engines persist state to a local database that the CLI runs as a Docker container, so install Docker before you bring a node online.
| Binary | Version | SHA-256 | |
|---|---|---|---|
crossfyre | 0.1.37 | 05011ff6b51a9022… | Download |
node | 0.1.47 | 9664f1cca7a4730c… | Download |
ambulo | 0.0.19 | b71d956d0244b5da… | Download |
voyage | 0.0.12 | cde5a10bb95a5033… | Download |
doorward | 0.0.12 | 62339d8da4c88edc… | Download |
toolmark | 0.0.11 | c8fe7abc5291f884… | Download |
plessor | 0.0.29 | a6659eaa564b9390… | Download |
cfx-script | 0.1.6 | 0151f6513c78bb02… | Download |
Crossfyre Tracer Android
Pair the app to a Web Tracer session and it captures your phone's traffic into the same asset graph, per app or device-wide. Useful for the APIs a mobile client talks to and a browser never sees.
aaf5f459acf8c698b27ea54ba82fbca62be9f1702a39ce9e126f0e4947fdd9f4 Distributed directly, not through Google Play, so Android will ask you to allow installs from this source.Check the SHA-256 above against the file before you install it. This page shows it only after checking the manifest's signature against the Crossfyre release key.
Crossfyre Workbench Linux desktop
An intercepting proxy with a Repeater, Decoder, Comparer and site map that runs on your machine and keeps projects on your disk. Scope, replay as another user and findings come with a paid plan.
Command reference
crossfyre login Authenticate to your account (API key, username/password, or the browser). node init enrols a host with the session it saves.
crossfyre node init Bring this host online as a node. Signed in, it takes the oldest node on your account that has not come online yet; without a session it asks for a node key from the dashboard. Then it installs the scan engines, sets up the database, and starts the service.
crossfyre extension install ambulo Install a scan engine (voyage / doorward / ambulo / toolmark / plessor / all): downloads, verifies its checksum against the release manifest, and starts its daemon.
crossfyre status See what is running. Scope it with node status or db status.
crossfyre update all Update the CLI itself and every installed engine from the release manifest, by checksum.
crossfyre doctor Diagnose the environment: Docker, the database container, release-CDN reachability, PATH.
Get your toolchain online.
Install the CLI, crossfyre login, and bring your first recon node up in
under a minute.