Find the services
your scanner missed.
An AI agent fingerprints the open ports Nessus and nmap leave as unknown. It interacts with the service, researches it, and returns the exact software and version. It augments your existing scan.
Real networks don't look like the textbook.
Signature scanners fingerprint confidently on paper. In the field, the moment a service stops announcing itself they go quiet, and quiet reads as "nothing here."
- ::Masked and stripped banners, so there is no signature left to match against.
- >_Services on non-standard ports, behind proxies and load balancers that hide what they really are.
- ?!Reported as "unknown", then dropped from the report or chased down by hand for hours.
An agent that does what a human would.
For every unidentified port, the agent runs the same loop a pentester runs by hand. Just faster, and on every port at once.
Interact with the service
Sends protocol-aware probes, completes handshakes, reads cert chains and error behaviour. Not just a banner grab.
Look it up on the web
Cross-references the observed behaviour against documentation, advisories and source to pin the software and version.
Return auditable evidence
Service, version, a confidence rating and the sources it used, so you can trust it or check its work.
We obfuscated a network, then compared the scanners.
52 legacy services behind a proxy that masks banners and shuffles ports, exactly what real environments do. Same hosts, same open ports, ExploitSynth side by side with Rapid7 IVM and Nessus Pro.
× rewrites banners
× shuffles port numbers
× generic error pages
| Target ground truth | Rapid7 IVM 0 / 6 | Nessus Pro 0 / 6 | ExploitSynth 6 / 6 |
|---|---|---|---|
| :13002Redis 3.2.0 | unknown | tcpwrapped | Redis 3.2.0 |
| :13005nginx 1.8.1 | unknown | unknown | nginx 1.8.1 |
| :13008MySQL 5.6.27 | unknown | unknown | MySQL 5.6.27 |
| :13011Cassandra 2.0.14 | tcpwrapped | unknown | Cassandra 2.0.14 |
| :13014Memcached 1.4.22 | unknown | unknown | Memcached 1.4.22 |
| :13017RethinkDB 2.1.1 | unknown | unknown | RethinkDB 2.1.1 |
Drops into the workflow you already run.
Extend your existing scan
Feed in your Nessus or nmap export. ExploitSynth re-scans only the ports it left unidentified.
$ exploitsynth scan --nessus engagement.nessus --project acme [*] parsed 1,204 ports · 38 left unidentified by Nessus [*] scanning the 38 gaps ✓ 34 / 38 now identified · report written to acme/
Live in your terminal
Every unidentified port gets its own agent, all working in parallel. Progress and per-port timeouts stream to your terminal as each result lands.
$ exploitsynth scan 10.20.4.7 --ports 2222,8443,33060 :2222 done OpenSSH 8.2p1 HIGH :8443 done nginx 1.25.3 HIGH :33060 0:46 ▓▓▓░░ researching MySQL X
Wire it into your pipeline
Prefer to automate it? The same engine is available as a REST API, so ExploitSynth folds straight into your own tooling and pipelines.
$ curl -X POST https://scan.exploitsynth.com/api/v1/scan \ -H "Authorization: Bearer sk_…" \ -d '{"targets":[{"ip":"10.20.4.7","ports":[2222,8443]}]}' → { "ok": true, "scan_ids": ["a1b2c3d4-…"] }
A working lab for every CVE worth proving.
A growing library of reproducible CVE sandboxes from the CISA KEV catalog. Each one is a containerised environment where the exploit is already proven to work, so you can validate a finding on a mock target in minutes, with no VM hunting.
Browse the labs →Built by pentesters who got tired of missing things.
Two decades in offensive security and autonomous-agent research. We automate the repetitive parts so experts can focus on the creative ones.
15+ years of pentesting across industries and the full spectrum of security assessments. Three-time DEF CON presenter, with multiple discovered 0-days.
- Public 0-days: NetCharts, MDaemon, D-Link, ClamAV, ManageEngine, Garmin, Maple, Mathematica, MATLAB, Unitrends
- Non-public: VMware, NetIQ, Quest KACE
See what your scanner missed.
Open beta. Register for free and claim credits to test out the scanner agent.