// TOOLS
Standalone tools for bug bounty researchers, built from real offensive work and run on your own authorized targets. Want it handled for you instead? See Services.
A Windows desktop assistant that grades your bug bounty report drafts before you submit them: a completeness checklist, an evidence-versus-speculation read on your writeup, tone flagging, a full CVSS v3.1 calculator, HackerOne severity mapping, and a Bugcrowd VRT-based priority estimate. It catches what is missing or too theoretical before a triager does.
One-time purchase: $31.99
A single pipeline chaining subfinder, httpx, dnsx, naabu, katana, and nuclei across your own in-scope targets: enumeration, liveness, port and service discovery, crawling, and scanning, then diffed against your last run so you only see what changed.
Points at your own domain and checks for missing security headers, weak TLS, exposed
.env or .git files, open storage buckets, and DNS misconfigurations,
then hands back a plain-English report on a schedule so you catch regressions early.
These are software tools for use only within engagements and bug bounty programs you are personally authorized to test. The tools are do-it-yourself software; Xocipher does not run offensive testing, penetration testing, or red team work on other people's systems. Defensive privacy and hardening work is offered separately under Services.