Attack Surface Intelligence

See Everything.
Miss Nothing.

Sharingan is a continuous attack surface monitoring platform built for security professionals. Enumerate subdomains, track DNS mutations, fingerprint HTTP services, and surface critical signals — automatically.

Request free demo →

Discovery engines

Real-time

CT log monitoring

5 tiers

Flexible plans

Passive DNS enumeration Certificate Transparency logs Active DNS resolution HTTP service fingerprinting DNS brute-force with wordlists Real-time CT log streaming HackerOne scope CSV import Signal alerting & Telegram bot Multi-company workspace Passive DNS enumeration Certificate Transparency logs Active DNS resolution HTTP service fingerprinting DNS brute-force with wordlists Real-time CT log streaming HackerOne scope CSV import Signal alerting & Telegram bot Multi-company workspace

Capabilities

Everything in your attack surface,
nothing left in the dark.

Sharingan chains passive enumeration, active probing, and continuous monitoring into a single platform — so you always know what's exposed.

Passive Discovery

Harvest subdomains from certificate transparency logs, subfinder, crt.sh, and more — without touching the target network.

DNS Resolution & Brute-force

Resolve every discovered hostname with dnsx and run wordlist-driven brute-force with multi-million entry lists stored in optimised volumes.

HTTP Fingerprinting

Run httpx across live subdomains to capture status codes, titles, tech stacks, and etc. — continuously updated.

Signal Intelligence

Every DNS change, new subdomain, and HTTP state transition emits a severity-graded signal. Triage from a unified feed or get Telegram alerts.

Real-time CT Streaming

Subscribe to live certificate issuance feeds. New subdomains matching your scope are ingested seconds after the certificate is signed.

HackerOne Import

Drop in a HackerOne program scope CSV and Sharingan automatically parses wildcard and explicit scope entries into your asset inventory.

Workflow

From zero to full visibility in three steps.

Define your scope

Add companies and seed domains manually, via bulk upload, or by importing directly from a HackerOne program scope CSV. Sharingan instantly scaffolds your asset tree.

manual add bulk upload hackerone scope CSV

Enumerate & probe

Workers fire across dedicated VPS nodes — passive engines find subdomains, dnsx resolves them, httpx fingerprints every live service, and CT streams watch for new certs in real time.

subfinder dnsx httpx ct-stream dns brute

Monitor & act on signals

Every state change — new subdomain, DNS mutation, HTTP status flip — produces a severity-graded signal. Review in the dashboard or receive instant Telegram notifications.

signal feed telegram bot severity grading

See it in action

A single scan, start to finish.

Here's what a real recon run looks like — from passive discovery to a graded signal, in seconds.

sharingan — discovery

$ sharingan scan --target acme-corp.com --engines ct,subfinder,dns_brute

[*] Querying certificate transparency logs...

[*] Running subfinder passive enumeration...

[*] DNS brute-force: 10,000,000 words loaded ...

[+] api.acme-corp.com:80 → HTTP 200 · Index of /

[+] staging.acme-corp.com:80 → HTTP 302 · redirect to /login

[+] admin.acme-corp.com:443 → HTTPS 403 · Admin Panel

[+] admin.acme-corp.com:8443 → HTTPS 200 · Welcome Admin

[+] vpn.acme-corp.com:8080 → HTTPS 500 · Internal Server Error

[!] SIGNAL · HIGH → New subdomain: dev-internal.acme-corp.com (CT log) is alive.

[!] SIGNAL · MED → DNS change: mail.acme-corp.com A-record updated from 1.2.3.4 to 5.6.7.8

[*] Scan complete · 2534 subdomains · 260 resolved · 603 HTTP services · 2 signals

New · Agent Integration

Awaken your agents
with Sharingan.

Connect Claude Code, Claude Desktop, or any MCP-compatible agent straight to your attack surface. Companies, domains, subdomains, live HTTP services, and signals — queryable in real time, from inside the tools you already work in. Agents can also add and remove companies, domains, and subdomains on your behalf, and check plan quotas and scan freshness before they do.

Get agent access → Ask a question

Pricing

Five eyes. One for every mission.

Plans scale with your program size — from solo hunters to full security teams running continuous recon on enterprise-wide scope.

HTTP Scan Freshness

Select how often HTTP services are re-fingerprinted across your subdomains.

DNS Scan Freshness

Select how often subdomains are re-resolved via DNS across your inventory.

DNS Brute-Force Add-on

Light frequency

Heavy frequency

✓ Selected

One Tomoe

一 · Sharingan

$13 /mo

Companies 1
Domains 5
Subdomains 15,000
HTTP Services30,000

✓ Selected

Two Tomoe

二 · Sharingan

$30 /mo

Companies 3
Domains 15
Subdomains 45,000
HTTP Services90,000

✓ Selected

See Everything. Miss Nothing.

Everything in your attack surface,nothing left in the dark.

From zero to full visibility in three steps.

A single scan, start to finish.

Awaken your agentswith Sharingan.

Five eyes. One for every mission.

Your attack surface doesn't sleep.Neither does Sharingan.

See Everything.
Miss Nothing.

Everything in your attack surface,
nothing left in the dark.

Awaken your agents
with Sharingan.

Your attack surface doesn't sleep.
Neither does Sharingan.