Penetration Testing Tools
The penetration testing tools that run inside every pentest
You could download and configure a dozen scanners yourself. Or point TurboPentest at your target and it runs 14 penetration testing tools plus the Paladin AI - Web Scanner, Vuln Scanner, Server Audit, Enumerator and more - wires them together, de-duplicates the output, and confirms what is actually exploitable. One short report, not eight raw logs.
See a sample report →The tools TurboPentest orchestrates for you
These are the real penetration testing tools that run inside a TurboPentest scan. Most are open source, and you can absolutely run each of them yourself. The value TurboPentest adds is not a secret scanner - it is the orchestration: it wires these tools together, runs them against your target in a single pass, de-duplicates the overlapping findings, and uses an AI agent to validate exploitability.
So instead of standing up eight scanners, reconciling their formats, and triaging thousands of raw alerts by hand, you get a short list of confirmed findings - each with a proof of concept, remediation, and a Fix with AI prompt.
14 + AI
scanning tools plus Paladin AI, run against your target in one pass
TurboPentest engine
1 report
de-duplicated and AI-validated, not eight separate scanner logs
Paladin AI validation
$99
per target, flat - the whole stack, no setup and no per-tool license
TurboPentest pricing
The black-box tool stack
Runs on every pentest by default - covering network, web app, API, SSL/TLS, and external attack surface in a single run.
Web Scanner
Web app scanningA comprehensive web application scanner. Crawls your app and probes for injection, XSS, broken authentication, and the rest of the OWASP Top 10 against the running target.
Vuln Scanner
CVE + service detectionA template-driven scanner. TurboPentest points it at non-web ports (SSH, FTP, SMTP, RDP, databases) for service-detection and version templates, then matches CVE templates against the versions it finds.
Server Audit
Web server checksA web server scanner that flags dangerous files, outdated server software, and misconfigurations that broad web scanners often skip.
Enumerator
Content discoveryA fast web fuzzer used to brute-force hidden directories, files, and parameters - surfacing forgotten admin panels, backups, and endpoints that never appear in the sitemap.
Port Scanner
Port scanningA fast port scanner for open-port discovery. TurboPentest fingerprints on top of its port map by routing each port to the right follow-up tool.
Web Probe
Web-port fingerprintingTakes the web ports Port Scanner finds and fingerprints them - server, technology, and version - building the technology-stack half of your attack surface map.
Net Scanner
Network vulnerability scanningA full-featured network vulnerability scanner that checks exposed hosts and services against a large, continuously updated vulnerability feed.
Security Checks
In-house offensive toolingIntegSec's own offensive-security tooling, built by CISSP / OSCP / OSCE operators, adding checks the off-the-shelf scanners miss.
Note: port discovery finds open ports only. Web Probe fingerprints web ports for server, technology, and version, while Vuln Scanner fingerprints non-web services and matches CVE templates against the detected versions.
Paladin AI - the 15th component
The tools find candidates. The Paladin AI orchestrator is what turns that into a pentest: it drives the scanners, correlates their output, validates each candidate finding to confirm what is actually exploitable, and classifies source-code findings to OWASP ASVS levels. That is the difference between a stack of scanners and a report you can act on.
White-box tools (when you connect a repo)
Connect a GitHub repository read-only and TurboPentest adds a source-code layer on top of the black-box run - same $99 per target.
Code Scanner
SAST - 325 rulesStatic analysis run with IntegSec's own rule pack - 325 rules across 7 languages, each mapped to CWE, OWASP, and ASVS - to find vulnerabilities at their root in your source.
Secret Scanner
Secrets detectionScans your connected repository for hardcoded credentials, tokens, and private keys committed to source - each flagged with the exact file and line.
Dep Scanner
SCA - dependenciesSoftware composition analysis that inspects your dependencies for known-vulnerable versions, so a flawed library gets caught before it ships.
Every Code Scanner rule is documented on the public Security Checks catalog with vulnerable-vs-safe code examples and CWE/OWASP/ASVS mappings.
How the tools run together
Point it at your target
Enter a domain and prove you own it. Optionally connect a GitHub repo read-only to turn on the white-box layer.
The full stack runs in one pass
Web Scanner, Vuln Scanner, Server Audit, Enumerator, Port Scanner, Web Probe, Net Scanner, and Security Checks run against the target - plus Code Scanner, Secret Scanner, and Dep Scanner on connected source.
Paladin AI validates and de-duplicates
The AI orchestrator correlates overlapping output, drops false positives, and confirms what is genuinely exploitable.
Get one short, confirmed report
Findings with proof-of-concept, an attack surface map, a STRIDE threat model, remediation, and retest commands - in hours.
Keep reading
See how the tools add up to an autonomous pentest, and dig into the static and dynamic layers on their own.
Penetration testing tools FAQ
What penetration testing tools does TurboPentest use?+
Every black-box run orchestrates 14 scanning tools plus the Paladin AI: Web Scanner, Vuln Scanner, Server Audit, Enumerator, Port Scanner, Web Probe, Net Scanner, and IntegSec's own Security Checks. When you connect a GitHub repository, the white-box layer adds Code Scanner (SAST), Secret Scanner (secrets), and Dep Scanner (dependency/SCA scanning). Paladin AI is the orchestrator that validates which findings are actually exploitable.
Do I need to install or configure these tools myself?+
No. TurboPentest wires the full toolchain together, runs it against your target, de-duplicates the overlapping output, and AI-validates exploitability, so you get a short list of confirmed findings instead of raw scanner logs from a dozen different tools. No setup, no tuning, no triage.
How does TurboPentest map ports to running services?+
Port discovery runs first with Port Scanner to find open ports. Web ports are then fingerprinted by Web Probe for server, technology, and version, while non-web services (SSH, FTP, SMTP, RDP, databases) are fingerprinted by Vuln Scanner, which also matches CVE templates against the detected versions - giving you a service-and-version map across the entire attack surface.
What does the Paladin AI actually do?+
Paladin is the AI orchestrator - effectively the 15th component. It drives the tools, correlates their output, validates each candidate finding to confirm what is genuinely exploitable, and classifies source-code findings to OWASP ASVS levels (and mobile findings to MASVS). That validation step is why you get a triaged report rather than a pile of unfiltered scanner alerts.
How much does it cost to run all of these?+
$99 per target, flat. That runs the full black-box tool stack, and the white-box tools (Code Scanner, Secret Scanner, Dep Scanner) at no extra charge when you connect a repository. No subscription, no per-tool licensing, no setup.
Or run all of them for $99. No setup.
Point TurboPentest at your target and get the full tool stack, AI-validated, in one run. See pricing