--- title: "Phase 1 Tools" description: "The 14 dockerized security tools that run in parallel during Phase 1 reconnaissance, covering network scanning, web vulnerability detection, TLS analysis, directory enumeration, subdomain discovery, and static code analysis." canonical: https://turbopentest.com/learn/paladin-agents/phase-1-tools source: "TurboPentest Learn" --- # Phase 1 Tools ## The Reconnaissance Layer Before any AI agent touches a target, TurboPentest runs a comprehensive automated reconnaissance phase. Phase 1 deploys 14 dockerized security tools, each specialized for a different domain of security testing. The tools launch in two waves: wave 1 runs the recon and non-web tools (Port Scanner, Sub Hunter, Secret Scanner, Code Scanner, Dep Scanner, Net Scanner), and wave 2 launches the web tools (Web Probe, WAF Detect, Server Audit, Web Scanner, Vuln Scanner, Security Checks, TLS Analyzer, Enumerator) once Port Scanner discovers the open ports. Within each wave the tools run in parallel, ensuring broad attack surface coverage while keeping execution time short. Every tool runs inside its own isolated Docker container with defined CPU and memory limits. Each container is ephemeral: it starts, executes its scan, reports results via a callback endpoint, and terminates. This architecture provides isolation (a crashing tool cannot affect others), reproducibility (identical container images every run), and scalability (containers can run on Azure Container Instances in production or local Docker in development). ## The 14 Tools ### Network and Service Discovery **Port Scanner** performs fast open-port discovery against the target hostname. It identifies which TCP ports are open - the foundational map of the target's network surface. Port Scanner covers the full TCP port range (all 65535 ports), emitting one `host:port` line per open port. The open ports it discovers determine which URLs the wave 2 web tools (notably Web Probe, which handles HTTP service and technology detection) test. **Sub Hunter** discovers subdomains through passive enumeration using public data sources. Every subdomain found expands the attack surface and may reveal staging environments, admin panels, or forgotten services. Results are output one subdomain per line for downstream consumption. **Web Probe** probes discovered URLs for HTTP response details including status codes, page titles, server headers, and technology fingerprinting. It detects the technology stack (frameworks, CDNs, server software) that informs which vulnerability classes are most relevant. ### Web Vulnerability Scanning **Web Scanner** runs a full active scan against the target URL, testing for common web vulnerabilities including XSS, SQL injection, and security header misconfigurations. Web Scanner spiders the target for up to 20 minutes, then runs a full active scan. **Vuln Scanner** runs template-based vulnerability checks from an extensive template library. Each template targets a specific CVE, misconfiguration, or exposure pattern. Vuln Scanner outputs one finding per line for easy streaming and parsing. **Server Audit** is a web server scanner that checks for dangerous files, outdated server software, and server configuration issues. It identifies over 6,700 potentially dangerous files and programs and checks for over 1,250 outdated server versions. ### Directory and File Discovery **Enumerator** brute-forces directory and file paths against the target URL using a curated wordlist. The default wordlist includes common admin paths, API endpoints, configuration files, backup files, and environment files. Enumerator runs with 20 concurrent threads and filters for HTTP 200, 301, 302, 307, 401, 403, 405, and 500 responses - 403 being important because it confirms the path exists even if access is denied. ### WAF and TLS Analysis **WAF Detect** detects whether a Web Application Firewall sits in front of the target. Knowing the WAF vendor and configuration helps agents understand which attack payloads might be filtered and which bypass techniques to attempt. **TLS Analyzer** performs a comprehensive TLS/SSL analysis of the target's HTTPS configuration. It checks for weak cipher suites, deprecated protocol versions (TLS 1.0/1.1), certificate issues, and known TLS vulnerabilities like BEAST, POODLE, and Heartbleed. ### Infrastructure Vulnerability Scanning **Net Scanner** runs a full vulnerability assessment against the target host. It checks for known CVEs in running services, misconfigurations, and missing patches. Net Scanner requires the most resources (2 CPU, 12 GB RAM) and the longest timeout (160 minutes) due to its comprehensive scanning approach. **Security Checks** provides additional vulnerability detection coverage with a focus on web application and infrastructure issues, outputting structured JSON results for all detected findings. ### White-Box Tools (Source Code Required) Three tools require access to the application's source code repository and only run when a repository URL is provided: **Code Scanner** performs static application security testing (SAST) using community and custom rules. It detects security antipatterns like SQL injection via string concatenation, hardcoded credentials, and insecure cryptographic usage directly in the source code. **Dep Scanner** performs software composition analysis (SCA), scanning dependency lockfiles for known CVEs. It identifies vulnerable library versions and recommends upgrades to patched versions. **Secret Scanner** scans the repository for leaked secrets - API keys, passwords, tokens, and other credentials that may have been accidentally committed. It uses pattern matching and entropy analysis to detect secrets across the repository's current files (the repository is cloned at depth 1, so the latest snapshot is analyzed). ## Parallel Execution and Callbacks Tools launch with a short stagger within each wave to avoid cloud capacity bursts, and wave 2 starts as soon as Port Scanner reports the open ports it discovered. As each tool completes, it sends an HTTP POST callback to TurboPentest's callback endpoint with its tool name and completion status. The callback may include a cryptographic signature (HMAC-SHA256) for verification when a callback secret is configured. TurboPentest tracks the status of each tool in the database. Once all 14 tools have reported completion (or failure), Phase 1 is complete and Phase 2 begins. Tool failures are non-fatal - if one tool crashes, the remaining 13 still provide their results. This resilience ensures that a single misbehaving tool never blocks the entire pentest. ## Why Phase 1 Matters Phase 1 output is the raw material that Paladin agents consume in Phase 2. The breadth and quality of reconnaissance directly determines how deep and accurate the agentic analysis can be. A port scan finding an open Redis instance on port 6379 means nothing to Port Scanner - but when the API Agent sees that data, it checks for unauthenticated access and session token exposure. Phase 1 provides the facts; Phase 2 provides the intelligence.