Product
Most scanners run a fixed list and hand you a score. Ironimo runs reconnaissance, reads what came back, and decides what to run next — the way a tester works a target. Here is the whole pipeline, with nothing hidden.
Phase one
Every scan opens with the same disciplined sweep, because you cannot follow a lead you have not found yet. Ports and services, technology fingerprints, WAF presence, subdomains, crawled endpoints, hidden parameters, TLS posture, and a first pass of template-based CVE detection.
Phase two
This is the part a fixed tool list cannot do. Ironimo reads phase one's findings and decides what deserves a closer look — then runs the tool that answers the question.
→ wpscan
Enumerate plugins and themes, check each against known vulnerabilities, test for user enumeration.
→ xsstrike, sqlmap, commix
Probe for cross-site scripting, SQL injection, and command injection against the specific parameter, not blindly across the site.
→ hydra
Test for weak and default credentials — only in profiles you have explicitly enabled.
→ jwt_tool
Check algorithm confusion, signature stripping, weak secrets, and claim tampering.
→ searchsploit
Look up the exact version against Exploit-DB and report what public exploit code exists.
→ report
When the leads are exhausted, the scan correlates, deduplicates, ranks by severity, and writes the report.
The report
A severity label with nothing behind it is an opinion. Each Ironimo finding carries the evidence that produced it, so your engineer can reproduce it in one command instead of arguing about whether it is real.
Critical through informational, ordered so the top of the report is the part worth reading first.
The exact URL, port, parameter, or header where the issue lives — not just "the application".
Which binary found it, with what flags, and the raw output it returned. Verify it yourself.
What to change, in terms a developer can act on this sprint, not a link to a generic advisory.
Behind the login
An unauthenticated scan sees your front door. The interesting attack surface — the admin panel, the account settings, the upload handler, the internal API — is behind the login. Ironimo supports password, token, and cookie-based sessions.
How credentials are handled: encrypted at rest with Fernet symmetric encryption, decrypted only at scan time and only inside the scan worker, never written to a report, and never returned by the API. Full detail on the Security page.
The toolkit
These are the same binaries a consultant runs on an engagement. We name every one of them, because a scanner you cannot audit is a scanner you have to take on faith.
nmapPort & service discoverywhatwebTechnology fingerprintingwafw00fWAF detectionsubfinderSubdomain enumerationtheharvesterOSINT & domain intelligencegospiderCrawling & endpoint discoverygobusterDirectory / DNS / vhost brute forcedirbContent discoveryffufFast web fuzzingarjunHidden parameter discoveryniktoWeb server misconfigurationnucleiTemplate-based CVE detectiontestsslTLS configuration testingsqlmapSQL injectionxsstrikeCross-site scriptingcommixCommand injectionjwt_toolJWT analysis & attackshydraCredential brute forcewpscanWordPress vulnerabilitiessearchsploitExploit-DB lookupFits your workflow
Weekly on Starter, daily on Pro, continuous on Enterprise. Set it once and stop remembering to run it.
Scan completion and new findings pushed to the channel your team already watches. Pro and Enterprise.
Scan results delivered when a run finishes, on every plan.
Export a full report for your auditor, your board, or the customer security questionnaire that started all this.
Pull findings into your own systems. Pro and Enterprise, with webhooks on Enterprise.
Invite your team, separate environments by organisation, and control who can see which targets.
Honest limits
Any vendor who tells you their scanner replaces a pentester is selling you something. Automated scanning is very good at enumerable problems and genuinely bad at a few things:
Keep your pentester. Ironimo covers the enumerable surface on the days nobody is testing — which, for most teams, is roughly 355 days a year.
First scan is free — a fixed six-tool pass over one target. Paid plans run the full 20-tool, two-phase chain described above.