The free engine
The open-source engine is a complete reconnaissance and attack-planning toolchain, driven by thed0pam1ne CLI. For free, you get:
Full recon pipeline
All fifteen recon stages: subdomains, DNS, ports, services, live web, TLS, fingerprinting, screenshots, URLs, content, parameters and JavaScript secrets.
Profiles and scope
The fast, stealth, normal and deep profiles, and a strict scope guard with domains, wildcards, IPs, ranges and path-limited rules.
The whole toolchain
One registry that installs and manages every recon tool, with
d0pam1ne doctor, tools install and SecLists wordlists.Attack planning
d0pam1ne attack builds the in-scope target lists and the exact, tested commands for each attack category, ready to run by hand. Nothing runs automatically.The full CLI
Projects, runs, results, pause and resume, export, the complete CLI.
Reports of a run
d0pam1ne report renders a one-page HTML summary of any run.What Pro adds
D0pam1ne Pro wraps the engine in a multi-user web app and adds the orchestration and workflow a team needs:
That table is the short version. Pro is a full workspace, and there is a lot in it.
Here is the longer answer.
The War Room
Pro is a self-hosted, multi-user web app: the Command Center holds every client and project in one view, and the whole team works the same engagement at once with roles, two-factor login and a full audit log.Command Center
Every client, project and run in one place, with status and progress at a glance.
Projects and scope
The same strict scope guard as the engine, managed visually, shared across the team.
Project Data: everything recon and OSINT find, in one place
Instead of folders of text, Pro files every finding into a live, searchable workspace that cross-links as it fills.Hosts and services
Every in-scope host, its names, ports, services and technologies.
Attack-surface graph
The whole surface as a graph: how hosts, names and services connect.
Traffic log
Every request and response the platform made, kept for evidence.
Out of scope
Everything seen but never probed, with the reason it was refused.
Attacks that actually run
The engine prepares the commands; Pro runs them for you, stage by stage, under a single intrusive opt-in, and paces them with Evasive Mode when recon saw a WAF.Automated Attacks
Pro runs each attack category against the in-scope targets recon found, filing findings as it goes. One of the most-loved parts of the platform.
Manual Attacks
The guided, per-category workflow for the testing you want to drive yourself.
The Attack Equalizer
Tune intensity, categories and pacing like a mixing board before you run.
Evasive Mode, in full
Adaptive pacing and Tor egress across both recon and attacks, not just recon.
OSINT
A whole phase the free engine does not have: map public exposure before you touch the target.OSINT
ASNs, people and emails, exposed assets, search-engine dorks, email-security posture, breach and infostealer data. Alongside Automated Attacks, the part that gets the most love.
Triage, intelligence and a local AI
Issues and Needs Review
Findings flow into a triage queue; AI suggests a verdict and you confirm, edit or reject. Only verified issues reach the client.
Local AI
An on-device model via Ollama for triage, report drafting and the Ask AI assistant. No cloud, no account, no telemetry.
AI memory
The assistant remembers the engagement’s context so its help stays relevant.
Vulnerability intel
Look up CVEs, exploits, advisories and CISA KEV known-exploited status, built in.
Client-ready reporting
Report Builder
One branded house design, a full per-finding anatomy, across every format.
PDF and interactive HTML
A polished PDF and a live interactive HTML report from the same findings.
Word export
Export to Word (.docx) when the client needs an editable document.
Retests
Re-run against verified findings and show the client what was fixed and what still stands.
Administration
Everything a team running real engagements needs to run the platform itself.Team, roles and 2FA
Invite the team, set roles, require two-factor login.
Audit log
Who did what, when, across the whole platform.
Updates, keys and time
In-app updates, API keys and a time tracker.
The things that get the most love, Automated Attacks and OSINT, live in Pro. The free engine is where the recon power and the toolchain come from, and it stands on its own. Everything above runs on infrastructure you control, with the AI on your own machine.