Audit your public attack surface
from the outside
Tottle discovers what your domain exposes to the internet — subdomains, listening services, TLS, headers, exposed endpoints, potential secrets and dangling DNS — then gives you a prioritised list of what to fix, with the evidence behind every finding.
Tottle separates what it observed from what it concluded. Uncertainty has a type: no response after retries is filtered (open vs closed undetermined), while conflicting or unusable evidence is unknown. Neither is folded into "closed". Every report states how much it actually covered, so a clean result never overstates itself.
What you get
Discovery → evidence → fix → verify
Not a PDF of maybes. Each finding carries the observation behind it, what it means, and a recheck that re-runs just that one test so you can confirm the fix actually landed.
# Illustrative output. Addresses are RFC 5737 documentation ranges # (203.0.113.0/24, 198.51.100.0/24) — reserved, never routed to anyone. DISCOVERY 42 subdomains · 2 public IPs · 8 listening services coverage: takeover checked on 42 · exposure + web checks on 60 endpoints EXPOSURE most serious first high Dangling DNS — takeover condition dev.example.com medium Prometheus metrics exposed api.example.com:9090 low Missing HTTPS security headers ×5 endpoints EVIDENCE what was actually observed GET https://api.example.com:9090/metrics HTTP 200 · text/plain · Prometheus exposition format detected authentication: none observed REMEDIATION Restrict /metrics to an internal scraper or authenticated endpoint; it must not be reachable from the public internet. VERIFY [ recheck ] → resolved · still exposed · inconclusive PORTS 1–1024 + 159 infrastructure ports → 1,181 unique, per IP 203.0.113.10 · Frankfurt, Germany 22 SSH 80 HTTP 443 HTTPS 198.51.100.24 · Ashburn, United States 22 SSH 80 HTTP 443 HTTPS ✓ none of the tested database, Kubernetes or broker ports were reachable 2 ports gave no TCP response after retries — filtered, not reported as closed SERVICE & TLS 443 HTTPS HTTP/2 · TLSv1.3 · cert valid 89d · HSTS ✓ CSP ✓ 22 SSH OpenSSH_9.2p1 Debian-2+deb12u10 package revision observed · advisory says patched → no finding
Coverage
We check the doors attackers actually try
Basic scans tend to focus on common web ports. Tottle also probes 159 infrastructure ports used by databases, Kubernetes, message brokers, monitoring and admin interfaces — services where accidental public exposure tends to have high impact.
Subdomain discovery
Passive discovery from certificate-transparency logs and public datasets — including the staging host nobody remembers deploying.
Infrastructure port sweep
Every TCP port from 1–1024, plus 159 curated infrastructure ports — deduplicated to 1,181 unique ports — Postgres, MongoDB, Redis, Elasticsearch, etcd, the Kubernetes API and kubelet. IPv4 today.
TLS & certificates
Expiry, self-signed and hostname-mismatched certificates, deprecated TLS 1.0/1.1 detected through active protocol negotiation, and HTTP/2 support via ALPN.
Security headers
HSTS, Content-Security-Policy, X-Frame-Options and nosniff — checked on the pages you actually serve, not just the front door.
Exposed files & endpoints
.git, .env, cloud credential files, Spring actuators, Go pprof and
unauthenticated /metrics — paths that automated scanners routinely probe.
Subdomain takeover
Dangling DNS pointing at unclaimed GitHub Pages, S3, Heroku, Azure and 10 more platforms — where a stranger can serve content from your name.
Web application exposure
Permissive CORS that reflects any origin while allowing credentials, session cookies missing Secure/HttpOnly/SameSite, and redirects an attacker can aim anywhere.
Potential secrets
Credential-shaped strings — AWS keys, private-key blocks, provider tokens — spotted in the responses we fetch. Reported as a pattern to verify, never as a confirmed leak.
Internal leaks in DNS
Private addresses published in public DNS quietly hand an attacker a map of your internal network. We flag them.
How it works
Four steps, nothing to install
Enter a domain
Just the name — example.com. No agent, no API key, no DNS record, no code change.
We audit it externally
Discovery, DNS, ports, services, TLS, HTTP exposure and takeover conditions — from a public, unauthenticated internet vantage point.
Fix what matters
Findings ranked by severity, each with the observation behind it and concrete remediation.
Verify the fix
Recheck re-runs the affected test in seconds and reports resolved, still exposed or inconclusive — it never turns a failed probe into a green tick.
Why it's different
A scanner that admits what it doesn't know
A tool that cries wolf gets ignored, and one that hides uncertainty gets trusted when it shouldn't be. These four rules are engineered into the scanner, not marketing.
Uncertainty is reported, not hidden
No response after retries is filtered; conflicting evidence is unknown. Folding either into "closed" manufactures a false all-clear — the most dangerous way a scanner can be wrong.
Versions judged by patch level, not banner
Debian and Ubuntu backport fixes without changing the upstream version. When a service exposes its distribution package revision, Tottle judges that exact revision against the distribution's advisory instead of the upstream number alone — and says so when the revision isn't exposed.
OpenSSH_9.2p1 → revision not exposed, patch status unknown
Coverage is stated, limits are named
Every report says how many hosts and endpoints were actually checked, and names anything skipped by a per-run limit. A clean result you can size is worth more than a clean result you can't.
Context beats pattern-matching
Scanning an IP reaches a proxy's default site, not yours — so certificate and header findings from that path are marked informational instead of inflating the count.
Scope
What a clean result does not mean
Tottle is a bounded external audit, not a continuous full-spectrum inventory. Knowing where the edges are is what makes the findings inside them worth trusting.
Tested
- Publicly reachable, unauthenticated surface
- TCP over IPv4
- 1,181 ports per IP (1–1024 + 159 infrastructure)
- Hosts discoverable from the domain you supply
- Response content, not just status codes
Not tested
- IPv6 — AAAA records are not resolved or scanned
- UDP services (DNS, SNMP, VPN endpoints…)
- All 65,535 TCP ports — only the 1,181 above
- Authenticated application paths and business logic
- Internal-only infrastructure
- Assets not discoverable from the supplied domain
- Origins behind a CDN — the edge is what answers, and Tottle does not attempt to infer the origin from it
Safety
What our traffic will and won't do
Tottle performs non-destructive reconnaissance and validation only. Concretely, against your systems it does not:
No exploitation
Misconfigurations are identified, never weaponised — no exploit payloads, no code execution, no destructive injection. Diagnostic values (a probe Origin, a marker redirect parameter) are sent only to observe how a response is formed.
No credential use
No guessing, no spraying. Tottle performs the normal unauthenticated handshake needed to identify a service (for example SMTP EHLO/STARTTLS) and stops before any credential is sent.
No state changes
Retrieval-oriented requests only — never submits forms, uploads, deletes or invokes known mutating operations, and records out-of-scope redirects rather than following them. Response bodies are read to a hard cap, so a large artefact is identified from its headers, not downloaded.
Tottle is intended only for infrastructure you own or are authorised to assess. Audits are rate-limited to 3 audits per day, attributed to an authenticated account and logged — controls that deter abuse and support investigation.
Find out what you're exposing
One domain, a few minutes, no setup — 3 free audits a day. Most people are surprised by at least one thing.