Intelligence Tab
Cross-tool intelligence aggregation: structure maps, access matrices, target profiles, and 40+ panels.
Overview
The Intelligence tab aggregates structured data from all active tools into unified views. Rather than opening each tool's raw output files, you see correlated, filterable panels organized by domain: network topology, web application structure, API maps, OSINT intelligence, wireless environments, database schemas, cloud inventories, endpoint assessments, and more.
Data populates in real-time as tools complete. Panels that have no data (because the relevant tool hasn't run) show a placeholder.
Target filter: When a tool produced results for multiple targets (e.g., Fracture tested three web apps), a target dropdown lets you filter to one target or view all.
Exclusion filtering: All intelligence panels automatically exclude entries from hosts in the project's exclusion list. This happens server-side — excluded hosts never appear in any panel.
Network Intelligence (SS3)
Panels populated from Scattershot3 network reconnaissance:
Host Inventory
net-hosts
All discovered hosts with IP, hostname, OS fingerprint, and open port count. Built from SS3's correlated report and inventory/hosts.json.
Service Map
net-services
All identified services across all hosts. Shows service name, version, port, and protocol. Useful for identifying outdated service versions across the estate.
Software Inventory
net-software
Detected software and technology stack from HTTP headers, banner grabs, and web fingerprinting (webanalyze, whatweb). Groups by product name and version.
Port Matrix
net-ports
Grid view of all hosts × ports. At a glance, see which hosts share common open ports. Highlights unusual ports and non-standard service-to-port mappings.
OSINT Intelligence (OSift)
Panels populated from OSift open-source intelligence gathering:
Domains & WHOIS
osint-domains
Discovered domains and subdomains with WHOIS registration data (registrar, creation/expiry dates, name servers, registrant org, privacy service status). Multi-domain support when the engagement covers multiple root domains.
DNS Records
osint-dns
Aggregated DNS records per domain — A, AAAA, MX, NS, TXT, CNAME, SOA, SRV, and more. Collected from OSift's per-domain dig + dnsx enrichment pass.
Certificates (CT Logs)
osint-certs
SSL/TLS certificates from Certificate Transparency logs (crt.sh), parsed certificates from direct connections, and issuer chain data. Shows common name, SAN entries, issuer, and validity dates.
Emails
osint-emails
Email addresses harvested from OSINT sources. Each email is tagged with its root domain and source. Useful for phishing scope validation and social engineering preparation.
Breach Data
osint-breaches
Breach exposure data from DeHashed and other OSINT breach databases. Shows which email addresses or domains have appeared in known data breaches.
People & Employees
osint-people
Employee names and roles discovered via LinkedIn, OSINT databases, and email pattern matching. Useful for social engineering scope and pretexting.
Phone Numbers
osint-phones
Phone numbers associated with the target organization, extracted from WHOIS, directories, and OSINT sources.
Typosquatting
osint-typosquat
Domain typosquatting analysis via dnstwist. Shows look-alike domains that could be used for phishing or brand impersonation, with registration status and IP resolution.
Wayback Machine
osint-wayback
Historical snapshots of target web properties from the Wayback Machine. Useful for discovering deprecated endpoints, old login pages, and exposed files.
Web Application Intelligence (Fracture)
Panels populated from Fracture web application testing:
Structure Map
fr-structure
Application sitemap generated by Fracture's spider. Shows all discovered pages, forms, endpoints, and their relationships as a hierarchical tree. Includes HTTP method, response code, and content type for each node.
Access Matrix
fr-access
Role-based access control matrix. Shows which authenticated roles can access which endpoints. Highlights authorization bypass opportunities where a lower-privileged role can reach admin-only pages.
Authentication Status
fr-auth
Current authentication state for each target. Shows whether login succeeded, which method was used, session cookie validity, CSRF token status, and any auth-related errors encountered during testing.
Target Profile
Profile
Aggregated target host profile: OS fingerprint, port count, detected services, software stack. Built from SS3 correlated data when available, or from Fracture's own reconnaissance.
Screenshots
fr-screenshots
Browser screenshots captured during Fracture's spider phase. Visual evidence of each discovered page — useful for report appendices and for identifying pages that require manual review.
API Intelligence (Siphon)
Panels populated from Siphon API testing:
API Map
si-structure
Complete API endpoint map with HTTP methods, parameter schemas, and response codes. When an OpenAPI spec was provided, shows spec-defined endpoints alongside discovered endpoints — highlighting rogue (undocumented) endpoints.
API Inventory
si-api
Inventory of all tested API endpoints with their authentication requirements, rate limiting status, and test coverage. Shows which endpoints were tested, which were skipped, and why.
Access Matrix
si-access
API-specific access control matrix. Which API keys, tokens, or roles can reach which endpoints. Highlights BOLA (Broken Object Level Authorization) and function-level access control issues.
Authentication Status
si-auth
API authentication state: token validity, refresh status, rate limit headers, and any auth failures encountered during testing.
Firewall Intelligence (Bastion)
Panels populated from Bastion firewall policy auditing:
Firewall Rules
fw-rules
Complete firewall ruleset with source/destination zones, ports, protocols, and actions (permit/deny). Highlights overly permissive rules (any-any, broad CIDRs).
Zone Map
fw-zones
Network zone topology — which zones exist, their trust levels, and inter-zone traffic policies.
Policy Compliance
fw-compliance
Compliance assessment against CIS benchmarks, NIST 800-41, and PCI DSS requirements for firewall configuration.
Configuration Summary
fw-config
Firewall device configuration overview: firmware version, management interfaces, logging settings, NTP, and administration access methods.
Cloud Intelligence (Forge)
Panels populated from Forge cloud infrastructure assessment:
Cloud Resources
cloud-resources
Inventory of cloud resources: compute instances, storage buckets, databases, load balancers, and networking components across AWS, Azure, or GCP.
IAM Matrix
cloud-iam
Identity and Access Management analysis: users, roles, policies, and their effective permissions. Highlights over-privileged accounts and unused credentials.
Service Dashboard
cloud-services
Cloud service utilization dashboard showing which services are active, their configurations, and potential security misconfigurations.
Mobile Intelligence (Quill)
Panels populated from Quill mobile application analysis:
Component Map
mobile-components
Application components: activities, services, broadcast receivers, and content providers (Android) or view controllers and extensions (iOS).
Permission Matrix
mobile-perms
Requested and granted permissions with risk classification. Highlights dangerous permissions (camera, microphone, location, contacts, SMS).
Binary Hardening
mobile-hardening
Binary security assessment: PIE, ASLR, stack canaries, code signing, certificate pinning, root/jailbreak detection, and debuggable flags.
Data Flow
mobile-data
Data flow analysis: where sensitive data is stored (SharedPrefs, Keychain, SQLite), how it's transmitted (HTTP vs HTTPS, certificate pinning), and potential data leakage vectors.
Endpoint Intelligence (Dredge)
Panels populated from Dredge endpoint security and hardening assessment:
Endpoint Overview
endpoint-overview
Overall endpoint security posture: OS details, patch level, antivirus status, firewall state, and encryption status.
Hardening Results
endpoint-hardening
Hardening assessment results: password policies, account lockout, audit logging, service configurations, and unnecessary services.
Software Inventory
endpoint-software
Installed software with version information. Highlights end-of-life or vulnerable versions.
Active Directory
endpoint-ad
AD assessment: domain controllers, group policies, trust relationships, user/group enumeration, and Kerberos configuration.
Network Posture
endpoint-network
Network configuration: IP settings, DNS, routing, listening services, and established connections.
Browser Audit
endpoint-browser
Browser security: extensions, autofill data, saved credentials, certificate stores, and privacy settings.
Disk & Storage
endpoint-disk
Storage assessment: partition layout, encryption status (BitLocker/FileVault/LUKS), free space, and sensitive file locations.
Hardware Report
endpoint-hardware
Hardware inventory: CPU, RAM, TPM status, Secure Boot configuration, and peripheral devices.
CIS Benchmark
endpoint-cis
CIS Benchmark compliance assessment for the endpoint's OS. Pass/fail per control with remediation guidance.
NIST Assessment
endpoint-nist
NIST SP 800-53 / 800-171 control assessment mapped to endpoint configuration.
STIG Compliance
endpoint-stig
DISA STIG compliance assessment with per-rule pass/fail status.
Additional Intelligence Panels
Panels from specialized tools:
Traffic Overview (Trawler)
traffic
Network traffic analysis summary: protocol distribution, top talkers, anomalous flows, and cleartext credential detections from pcap analysis.
Traffic Conversations (Trawler)
traffic
Individual network conversation flows between source and destination with protocol, byte count, duration, and flagged anomalies.
Database Schema (Auger)
db-schema
Database structure: tables, columns, data types, and relationships. Identifies tables containing sensitive data (PII, credentials, financial).
Database Privileges (Auger)
db-privs
User privilege matrix: which database users have which permissions. Highlights excessive privileges (DBA grants, GRANT OPTION, FILE privilege).
File Properties (Isotope)
iso
Static file analysis: file type, entropy, embedded strings, YARA rule matches, metadata extraction, binary analysis, secrets detection, and IOC correlation.
AuthProbe Results
authprobe
Authentication fingerprinting results from AuthProbe: detected auth methods, CMS identification, WAF detection, and login form analysis.
Intelligence Export
Export intelligence panel data as XLSX (multi-sheet workbook) or JSON. Each panel's data becomes a sheet in the workbook or a key in the JSON export. Useful for appendices in deliverables or for offline analysis.