Crossfyre CLI
One CLI for security testing.
crossfyre is the command-line toolchain for authorized security
testing. Log in, bring any host online as a distributed recon node, and
install the scan engines you need: content discovery, subdomain enumeration,
network scanning, all from one binary. Authenticated by default: the CLI
does nothing until you crossfyre login.
curl -fsSL https://get.crossfyre.io/install.sh | sudo bash Reviews before it runs. Read the script first at get.crossfyre.io/install.sh.
crossfyre login sudo crossfyre node init What the CLI does
Logs you in first
Authenticated by default: every command requires crossfyre login. Sign in with an API key, your credentials, or the browser; the session is tied to your account.
Runs distributed nodes
Turn any host into a recon node with one command, provisioned under your account, wired into the control plane, with its own local database, ready to take work.
Installs scan engines
A built-in package manager installs, updates, and removes the voyage / doorward / ambulo / toolmark / plessor engines, every download checksum-verified against the release manifest.
Scan engines
Engines are the scanners your nodes run. The CLI installs and supervises them;
add or drop one any time with crossfyre extension install. Each is a
standalone, checksum-verified daemon.
voyage
Subdomain enumeration engine. Maps an organization’s external footprint by resolving and expanding its DNS namespace at scale.
doorward
Network host and port-scanning engine. Sweeps ranges for live hosts and open services to chart the reachable perimeter.
ambulo
High-throughput HTTP fuzzer and content-discovery engine. Brute-forces paths, parameters, and virtual hosts to surface hidden attack surface.
toolmark
Service and technology fingerprinting engine. Identifies the software, versions, and stacks behind live services so the rest of the pipeline knows what it is hitting.
plessor
Vulnerability scanning engine. Runs active, confirm-before-report checks for injection, authorization, and exposure classes, reproducing each finding before it lands.
Downloads
Prebuilt Linux (x86-64) binaries for the CLI and its scan engines, each checksum-verified against the release manifest. The Android Tracer app and the Workbench desktop app are below them. Prerequisite: Docker. The scan engines persist state to a local database that the CLI runs as a Docker container, so install Docker before you bring a node online.
| Binary | Version | SHA-256 | |
|---|---|---|---|
crossfyre | 0.1.32 | 076fbabbaeb22cbb… | Download |
node | 0.1.42 | 054980105880cff5… | Download |
ambulo | 0.0.16 | ce27ff86fe9cfa48… | Download |
voyage | 0.0.9 | 150b94274d4daffc… | Download |
doorward | 0.0.9 | 63fea75f4a04eafe… | Download |
toolmark | 0.0.8 | e8b8f16e973acfb2… | Download |
plessor | 0.0.24 | 2d66a7f656249dd2… | Download |
cfx-script | 0.1.1 | 10ce53ecffe4f0f7… | Download |
Crossfyre Tracer Android
Pair the app to a Web Tracer session and it captures your phone's traffic into the same asset graph, per app or device-wide. Useful for the APIs a mobile client talks to and a browser never sees.
96df3fd0dc306af729290c405ab694a5da5bb7bb39e0dc551fce540a045e4e1c Distributed directly, not through Google Play, so Android will ask you to allow installs from this source. Check the SHA-256 above against the file before you install it.
Crossfyre Workbench Linux desktop
An intercepting proxy with a Repeater, Decoder, Comparer and site map that runs on your machine and keeps projects on your disk. Scope, replay as another user and findings come with a paid plan.
Command reference
crossfyre login Authenticate to your account (API key, username/password, or the browser). Required before anything else works.
crossfyre node init Bring this host online as a node: prompts for the node API key (from the dashboard), installs the scan engines, sets up the database, and starts the service.
crossfyre extension install ambulo Install a scan engine (voyage / doorward / ambulo / toolmark / plessor / all): downloads, verifies its checksum against the release manifest, and starts its daemon.
crossfyre status See what is running. Scope it with node status or db status.
crossfyre update all Update the CLI itself and every installed engine from the release manifest, by checksum.
crossfyre doctor Diagnose the environment: Docker, the database container, release-CDN reachability, PATH.
Get your toolchain online.
Install the CLI, crossfyre login, and bring your first recon node up in
under a minute.