External Vulnerability Scanner

Easy, quick, and intuitive to use

The Pentest-Tools.com team prioritized user experience from the earliest iterations of our platform design. This is why the Pentest-Tools.com UI has evolved to enhance your experience of using our professional set of tools. A fluid UI eliminates distractions and makes navigation an intuitive journey. You can easily employ filters and export options in Findings to view the results you want. And, to make information easy to digest, there are features like the .

Although it may not be your go-to use case, our designers have ensured that the mobile version is as easy and quick to use as the desktop.

One example of this is the addition of an option on the dashboard interface that allows you to easily view the target description for all your scans, including scheduled ones. We’ve also streamlined many smaller tasks, meaning less configuration on your part.

For instance, you can add specific findings to reports, delete headers you no longer need, or share items and workspaces across your team, all with preset options.

Testing for the most common vulnerabilities and critical threats

There are many cybersecurity organizations, like NIST and CISA, that publish lists of the most critical risks facing organizations. From the start, we’ve referenced the most well-known and authoritative of these lists and made them an integral part of our scanning technology.

For example, the OWASP Top 10 list is an open-source industry standard that is known and used as a global reference for risk minimization and security by design.

Pentest-Tools.com’s pre-built pentest robots are designed to automatically detect and identify OWASP Top 10 vulnerabilities (and more). Our reports’ findings include OWASP 2017/2021 detected security risks along with their CWE reference. After each scan, you can view more details on an OWASP risk from the Findings list, visualize it from the Scans window, and automatically share these details with the reports.

The current version of the Pentest-Tools.com platform is a custom engine built in-house by our team of security specialists. Our pentesting flows and assessment workflows integrate the principles and tactics from industry staples such as the OWASP Web Security Testing Guide. And, since 2021, we’ve become a Corporate member of OWASP, contributing our expertise and data freely to improve the software security landscape around the world.

Minimizing and even eliminating false positives

In both network vulnerability scans and external web vulnerability assessments , it isn't enough just to pinpoint vulnerabilities. You must validate each one as a real security hole and direct threat to your organization’s digital collateral and data. This means you must be aware of the problem of false positives.

The Pentest-Tools.com scanners offer an option of Light or Deep scan. While the Light scan is faster, our Support documentation makes it clear that it is prone to returning false positives because it relies on the version reported by the services, which may be inaccurate.

However, from the Pentest-Tools.com vulnerability management feature – found in the Findings section of the dashboard – you can verify findings, change their risk level, mark them as fixed or ignored, and generate reports from which you can exclude unverified findings.

Our Website Vulnerability Scannerautomatically validates findings and tags them as Confirmed so you can select and add them to your report. And our Network Vulnerability Scanner uses Sniper Auto-Exploiter modules to give you solid proof for vulnerability validation.

If a finding is unconfirmed, you must conduct a manual check to see if it’s a false positive or not – and mark it accordingly. Pentest-Tools.com can help you with this in two ways. You can conduct a check yourself using our support article How to validate findings? Or, as managed pentesting service providers, our security specialists can validate each finding manually in every engagement, leaving you with zero false positives.

An external scan report that’s easy to digest and apply

Reporting is an often neglected feature of the external scanning process, with all the attention and effort focused instead on the scanning tools. But the report is often all that a manager or customer cares about or sees.

After all your work, can they even understand what they're reading? And will they know what they're supposed to do with all that information?

For report readers, Pentest-Tools.com advanced, editable reports feature:

• A categorized breakdown of all types of discovered weaknesses and threats
• A visual representation of the findings with their criticality levels
• A customizable table with the more significant findings, their risk level, and their verified status
• Detailed and actionable recommendations for each vulnerability, to help you prioritize the most important business assets
• Multiple sections that break down the report material into easily digestible and fully customizable chunks, such as Background, Methodology, Executive Summary, and Findings & Remediation
• Editable DOCX reports that you can easily customize, including with your own logo

A pentest report tool that takes the pain away

As for report writers, structuring, compiling, and writing pentest reports is often a tedious, time-consuming part of the work. We understand this taxing task and have developed an advanced reporting tool that constantly collates your scan results, showcases your efforts, and presents a streamlined reading experience.

Reports come with pre-filled data and allow you to:

• Choose from multiple predefined pentest report templates – or you can create your own
• Select relevant findings – by target or vulnerability – with handy filters
• Exclude unverified findings, false positives, informational findings, or any other findings that are irrelevant
• Make reports more comprehensive by adding manual findings from other sources
• Create reusable Findings templates for future engagements