Skip to main content
D0pam1ne does not bolt twenty scanners together at random. Every tool sits at a specific point in the flow, fed by the stage before it and feeding the stage after. This page is the full catalog: 77 tools across 23 categories, grouped the way the engine runs them, each with what it does, why it earns its place, and where its source lives.
Core tools (marked below) make up the default recon pipeline: 16 tools that run automatically on every scan. Everything else is optional, installed alongside but run when you choose it, by profile, by category, or by hand. The attack tools are always run deliberately, never by recon.
Three of these are Black Hat Ethical Hacking’s own, built for gaps the flow exposed and marked BHEH throughout: SecretOpt1c, D0rkerR3con and AdminPBuster. Install, version and update every one of these from the in-app Tools page.

​
Recon flow

Recon widens the picture one stage at a time. Hostnames resolve to IPs, IPs reveal open ports, ports reveal web servers, web servers reveal URLs, URLs reveal parameters and secrets. Each category below is one of those stages, and its tools exist to carry that stage as far as it goes before handing off.

​
Subdomains and DNS

Discover the target’s hostnames and resolve them, widening the in-scope surface before anything is probed.

​
Ports and services

Find which ports are open on the resolved hosts and identify the services behind them.

​
Live web, TLS and fingerprinting

Confirm which hosts serve web, capture their fingerprints, and run the safe recon-stage checks.

​
URLs and crawling

Gather known and crawlable URLs and endpoints to feed content and parameter discovery.

​
Content discovery

Brute-force the hidden files, directories and vhosts that crawling does not find.

​
Parameters

Surface the hidden input parameters that endpoints accept but do not advertise.

​
JavaScript and secrets

Mine client-side JavaScript for endpoints and exposed secrets.

​
OSINT

Gather intelligence from third parties (scan engines, search dorks, code, email and DNS) without hitting the target directly, so you know the public exposure before you probe anything. OSINT and automated attacks are D0pam1ne Pro features.

​
Attack flow

Attack tools are installed by D0pam1ne but run deliberately, never by recon. Each category reads the recon signal that justifies it and builds its in-scope target list automatically, so the right tool runs against the right host. Automated attacks are a D0pam1ne Pro feature.
SQL, command, template and file-inclusion injection: the classic input-reaches-interpreter bugs.
Cross-site scripting, verified in a real browser to cut false positives.
Broad web scanners whose results are normalized into D0pam1ne’s own findings.
Targeted audits for the platforms most sites actually run on.
Transport security: protocols, ciphers, certificates and known TLS flaws.
Dangling DNS pointing at unclaimed services.
Non-web services exposed on open ports.
Exploit validation under the intrusive opt-in.
Desync and cache attacks that live between the front-end and the back-end.
The auth and schema bugs specific to API and GraphQL surfaces.
Response-splitting and header-level bugs that bypass front-end controls.
Finding the login and admin surfaces that are not meant to be found.
Public and misconfigured cloud storage.
The egress side of Evasive Mode: grouped under the attack set so they install together.

​
Vulnerability intelligence

One more tool sits outside recon and attack: it never touches a target, it answers questions about CVEs. It powers the Vuln Intel page.

​
Helpers

Not scanners: the small utilities the tools above lean on.
Every tool here installs, versions and updates from the in-app Tools page, which checks each installed version against the latest release and updates in one click. You never chase a GitHub release by hand.