The all-in-one Linux penetration testing platform built for serious security professionals. Start free with 4 tools — upgrade to Pro for unlimited access to all 12.
No credit card required · Linux only (.deb / .rpm) · Install in under 60 seconds
Not another wrapper around existing tools. A fully integrated platform designed from the ground up for real-world pentesting workflows.
Aggregate scan results from all 12 tools in one real-time view. CVE trends, CVSS scores, severity breakdowns, and remediation priority — at a glance.
HMAC-signed keys, Ed25519 payload signatures, and CPU/motherboard fingerprinting. Remote revocation and kill-switch if a key is compromised.
Single .deb or .rpm install — no Docker, no VM, no dependencies. Tauri-based desktop UI with Rust backend. Ubuntu, Kali, Fedora, RHEL all supported.
Generate auditor-ready PDF and HTML reports for OWASP Top 10, PCI-DSS, HIPAA, and NIST. Export findings with evidence, CVSS scores, and remediation steps.
Claude API integration for automated attack chain generation, scan result analysis, and post-exploitation guidance. Pro and Enterprise plans included.
Signed update packages with SHA256 verification, staged rollout (10% → 50% → 100%), automatic rollback, and real-time heartbeat monitoring.
Every install is cryptographically bound and centrally controlled — the same engineering rigour you expect from the targets you test.
Enter your HMAC-signed license key. The app validates against the license server and issues a short-lived JWT for tool access.
A non-reversible hardware fingerprint (CPU + motherboard + disk) binds the license to one device. Move it anytime via deactivate.
Tools run locally; the dashboard aggregates results. Heartbeat monitoring lets you revoke or kill-switch a compromised key in seconds.
Production-grade scanners, OSINT engines, and exploitation frameworks — integrated in one licensed package.
Web app vulnerability scanning — SQL injection, XSS, CSRF, auth flaws. OWASP Top 10 mapped findings.
Deep port scanning, service enumeration, CVE detection. Nmap + vulnerability DB.
REST/GraphQL security testing. Auth bypass, injection attacks, rate limiting flaws, IDOR detection.
Dictionary and hybrid attacks — SSH, FTP, HTTP Basic, custom services. Hydra-powered with smart throttling.
Domain recon, email harvesting, social graphs. Shodan, WHOIS, DNS and certificate transparency integration.
Payload generation for authorized engagements. msfvenom-compatible with evasion options and listener setup.
Authorized phishing simulations with real-time click/credential tracking and employee awareness metrics.
Graphical Metasploit interface. Manage sessions, payloads, modules, and post-exploitation from a unified UI.
Passive intelligence gathering. Shodan, HaveIBeenPwned, Censys, email harvesting with graph visualization.
mitmproxy-based HTTP/HTTPS intercept. Live request editing, replay, injection, and traffic export.
Metadata extraction from documents, images, and binaries. EXIF, GPS, author info, and hidden properties.
ARP spoofing, DNS poisoning, MAC flooding for internal assessments. Raw socket, requires root privileges.
Start free. Upgrade to Pro when you need the full arsenal.
Scorpion is built and maintained by a working security professional. Tried it? Share your feedback below — every review is read.
"I built Scorpion because I was tired of juggling a dozen disconnected tools on every engagement. One licensed platform, one dashboard, native on Linux — this is the toolkit I always wanted. We ship fixes fast and listen to every piece of feedback."
Used Scorpion? Tell us what you think — your review helps other security teams.
Download Scorpion and use 4 tools immediately — no account, no credit card. Upgrade to Pro anytime for full access to all 12 tools.