Tool Overview
TurboPentest runs up to 15 security tools in parallel during each pentest. Each tool runs in its own Docker container with dedicated resources.
Black box tools (11)
These run on every pentest - no source code access needed.
| Tool | Category | Purpose | Resources | |
|---|---|---|---|---|
| 🌐 | Nmap | Network | Port discovery, service detection, version fingerprinting | 1 CPU, 1 GB |
| 🕸️ | OWASP ZAP | Web app | Comprehensive web app vulnerability testing | 1 CPU, 2 GB |
| 🎯 | Nuclei | Web app | Template-based vulnerability detection for known CVEs | 1 CPU, 1 GB |
| 🔍 | Nikto | Web app | Web server misconfiguration and dangerous file detection | 1 CPU, 1 GB |
| 📂 | FFUF | Web app | Directory and file brute-forcing | 1 CPU, 1 GB |
| 🛡️ | OpenVAS | Vulnerability | Full network vulnerability assessment | 2 CPU, 4 GB |
| 🔒 | TestSSL | SSL/TLS | TLS certificate and cipher analysis | 1 CPU, 1 GB |
| 📡 | Subfinder | Recon | Passive subdomain enumeration | 1 CPU, 1 GB |
| 🔌 | HTTPX | Recon | HTTP response probing and technology detection | 1 CPU, 1 GB |
| 🧱 | Wafw00f | Recon | Web Application Firewall detection | 1 CPU, 1 GB |
| 🔧 | PentestTools | Multi | Additional vulnerability testing | 1 CPU, 1 GB |
White box tools (3)
These require a GitHub connection and run in addition to all black box tools.
| Tool | Category | Purpose | Resources | |
|---|---|---|---|---|
| 📝 | Semgrep | SAST | Static analysis for code-level vulnerabilities | 2 CPU, 4 GB |
| 📦 | Trivy | SCA | Dependency vulnerability detection | 1 CPU, 2 GB |
| 🔑 | Gitleaks | Secrets | Detect hardcoded secrets in source code | 1 CPU, 1 GB |
Shannon AI
In addition to the 14 open-source Phase 1 tools above, Shannon is TurboPentest's autonomous AI pentester (the 15th tool) that analyzes results, generates unified findings, and produces the executive summary and threat model. See Shannon AI for details.
Execution model
- All tools run in parallel as isolated Docker containers on Azure Container Instances
- Each tool has a timeout (typically 5-10 minutes)
- Tools report results via callbacks as they complete
- A pentest is complete when all tools have finished