Local Reconnaissance & Intelligence Platform
for Security Researchers
Automate reconnaissance, asset discovery, screenshots, port analysis, CVE enrichment, and intelligence reporting from a single interface.
⚠ Only use against targets you own or have explicit written authorisation to test. Unauthorised scanning is illegal.
A modular platform designed for methodical security assessment and vulnerability research. Each module is independently configurable and can be run in any combination.
Automated subdomain enumeration, DNS resolution, and alive-host identification. Helps map your target's attack surface starting from a single domain.
Port scanning with service detection and version fingerprinting. Results are automatically classified by risk level — database ports, exposed services, and HTTP endpoints each highlighted distinctly.
Automatically captures screenshots of discovered HTTP/HTTPS endpoints. Browse a responsive gallery with fullscreen lightbox view directly in the interface.
Active path and file enumeration across discovered hosts. Results are rendered as a filterable table with HTTP status badges, response sizes, and methods.
Correlates detected software versions against CVE databases. Surfaces critical and high-severity vulnerabilities with CVSS scores and direct reference links.
Aggregates all scan data into a structured intelligence report. Prioritised findings, raw metrics, and a plain-language executive summary generated per scan.
Maps how discovered assets and vulnerabilities chain together into potential attack paths. Visual representation of your target's exposure profile from an attacker's perspective.
Export structured reports covering the complete scan lifecycle — target overview, findings, CVEs, and intelligence summary — ready for documentation or submission.
A local web interface that gives you complete visibility into every scan, accessible from any browser on your machine.
Designed around the realities of bug bounty hunting and security assessment work. Every feature exists to address a specific friction point in the reconnaissance-to-report workflow.
Everything runs on your machine. Your targets, findings, and credentials never touch an external server. Full control, full privacy.
No API keys to manage, no data leaving your network, no subscription model. Works completely offline once installed.
Replace a pile of disconnected terminal windows, text files, and spreadsheets with a single interface that tracks every scan from start to report.
Raw scan data is automatically correlated into a structured intelligence layer — prioritised findings, attack paths, and executive summaries generated per target.
Scope-aware scanning, structured output per target, and export-ready reports make it equally useful for bug bounty programs and professional security assessments.
// Scan workflow
Enter a domain, select your scan modules, and launch. The queue handles the rest.
Subdomains, ports, paths, screenshots, and CVEs are all collected in a single pipeline pass.
Findings are aggregated and scored. Attack paths, prioritised risks, and summaries are automatically produced.
Explore every artefact through the web interface or export structured reports for submission.
We're looking for security researchers and bug bounty hunters who want to shape the direction of Scopeix. Beta access is limited — apply below and we'll review your application within 48 hours.
Thanks for applying to the Scopeix closed beta. We review every application and will get back to you by email, usually within 48 hours.