Penetration Testers & Vulnerability Scanning
Pen test tools and vulnerability scanners are an essential part of a cybersecurity program. We recommend you just allow access to the tools you actually use, and block the rest. In our database of pentest tools, we currently have over 50 identified bots in the wild that can put a strain on system resources. Many of these are legitimate players active in promoting best cybersecurity practice If you are running a set of bespoke pen tests, then you can also use our custom whitelist to ensure just the particular pen test suite you use is allowed
Vendor
Bot Service
Recommendation
Description
Triop
Triop
Recommended
Not recommended
Pentest and vulnerability testing based in Sweden
Triop
WPSec
Recommended
Not recommended
WP is an online scanning solution for WordPress sites. It makes repeated requests to homepages and read me files to understand the configuration of your site in order to present users with a vulnerability report. Select this bot if you use this service to verify the security of your Wordpress site.
Tenable
Tenable ASM
Recommended
Not recommended
Tenable Attack Surface Management (formerly known as Tenable.asm) is a web-based inventory tool that you can use to identify internet-accessible assets that may or may not be known to your organization. Tenable Attack Surface Management identifies assets using DNS records, IP addresses, and ASN.
Tenable
Nessus Pro
Recommended
Not recommended
Nessus helps the security pros on the front lines quickly and easily identify and fix vulnerabilities - including software flaws, missing patches, malware, and misconfigurations - across a variety of operating systems, devices and applications.
Sucuri
Sucuri Web Performance Tools
Recommended
Not recommended
Securi Cleans and Protects Websites. Gain peace of mind by securing all your websites. Securi fixes hacks and prevent future attacks. A cloud-based platform for every site.
Sitelock
SiteLock
Recommended
Not recommended
SiteLock provides completely automated website security to protect your website from hackers, accelerate performance and boost conversions.
Qualys
Qualys
Recommended
Not recommended
The Qualys Cloud Platform and its integrated apps help businesses simplify security operations and lower the cost of compliance by delivering critical security intelligence on demand and automating the full spectrum of auditing, compliance and protection for IT systems and web applications.
Qualys
SSL Testing
Recommended
Not recommended
TBC
Phishlabs
PhishLabs
Recommended
Not recommended
Phishing and digital risk protection. Uses the BDfetch crawler to look for potential vulnerabilities across web and mobile.
Nmap
Nmap
Recommended
Not recommended
Nmap is a powerful open source network mapping tool, which is able to scan an entire web estate picking up each of the attributes of the estate e.g. IP filters, firewalls, routers, servers, port scanning, OS and version scans. Nmap is used by sys admins to check and verify what's on their estate, but can also be used by hackers to quickly understand the network topology and search for vulnerabilities.
Netcraft
Netcraft
Recommended
Not recommended
Netcraft has developed several services whereby companies can have access to detailed information on the performance of their prospects’ sites or their own sites, including timely notification of outages and the facility to compare and rank performance of the monitored sites.
McAfee
McAfee Secure - Scan Alert Bot
Recommended
Not recommended
Address visitor security concerns and reduce cart abandonment with the McAfee SECURE certification.
LeakIX
LeakIX
Recommended
Not recommended
LeakIX crawls the internet in search of common security misconfigurations. They provide site owners with a platform to fix misconfigurations leading to leaks and security issues by bridging the source, CERTs, hosting companies and researchers to solve the problem. If they identify such a leak/misconfiguration they allow a grace period of 30 days where Hosting companies and CERTs are warned if the leak is critical and trusted researchers can see and evaluate the leak.After this period, the leak is considered public ( indexed by other parties multiple times ) and shows in our public index.
IBM
AppScan
Recommended
Not recommended
IBM® Security AppScan® and Application Security on Cloud enhance web and mobile application security, improve application security program management and strengthen regulatory compliance. Testing web and mobile applications prior to deployment can help you identify security risks, generate reports and fix recommendations.
Foregenix
Foregenix
Recommended
Not recommended
Forgenix provide web scanning and other cybersecurity services to a range of businesses, they are particularly active for Magento e-commerce site owners. Their webscanner will scan sites regularly for Malware detection, patching issues, website setup insecurities, SSL issues and more.
Expanse
expanse
Recommended
Not recommended
https://www.paloaltonetworks.com/cortex/cortex-xpanse/attack-surface-management
Comodo Security Solutions
cWatch Website Security
Recommended
Not recommended
Free website security and malware removal solution - sometimes you get what you pay for... SSL checker bot.
Cloudflare
Cloudflare
Recommended
Not recommended
The SSL/TLS Recommender from Cloudflare helps you choose which Encryption mode is best for your application. If you are a Cloudflare user and have SSL/TLS recommendations enabled in your dashboard then you should allow this crawler.When enabled, the SSL/TLS Recommender runs an origin scan using the user agent Cloudflare-SSLDetector to determine if you should use a stronger SSL encryption mode. Recommender will run scans periodically.
BrowserSpy.dk
Browserspy bot
Recommended
Not recommended
BrowserSpy.dk shows you just how much information can be retrieved from your browser just by visiting a page.