Skip to main content
Internal Attacks take what Internal Recon proved and run the tools that apply to it, through the same beacon pivot. Open Internal Pentest, Internal Attacks and pick the beacon.

What it needs first

The planner only runs on fresh evidence. It needs a completed Discover Assets sweep on the selected beacon, and a completed (or usable Partial) Internal Recon on that beacon and site from the last 24 hours with its service and live-web stages done. Existing assets in the project alone do not unlock a beacon: it needs its own sweep.

What runs

  • One broad nuclei HTTP template pass, so the same templates are not repeated across focused, all and KEV subsets.
  • Parameter DAST, switched on separately.
  • ffuf against a bounded path list.
  • testssl as a targeted HTTPS follow-up.
Automated HTTP traffic crosses a scoped HTTP to SOCKS bridge through the selected pivot. Heavy injection suites, DNS and raw-socket, headless and code templates are left out of this first tier. Missing tools or wordlists link straight to the Tools page.

Results

Findings land in Needs Review, tagged Internal and filed under the beacon’s site, and out-of-band callbacks keep their evidence and network metadata. The page shares the recon run view (ticker, pipeline, meters, charts, elapsed time, Stop and JSON exports). Manual commands and their input files are available too: run them yourself and import the output as Internal for the beacon’s site.