Phantom Scanner
Find web vulnerabilities before attackers do.
An autonomous web security scanner with a live UI: recon, port scan, crawling and 63 vulnerability checks, each scored with CVSS and verified to cut false positives.
The story.
Phantom runs in phases — OSINT and recon, port scan, spider plus headless DOM rendering, then 63 vulnerability modules covering the OWASP Top 10 and beyond.
Every finding gets a CVSS v3.1 score and a false-positive verification pass, and related issues are linked into multi-step attack chains. It needs no paid API or LLM — it is pure Python. Use it only on sites you own or are authorised to test.
What it does.
Out-of-band engine
Confirms blind SSRF, RCE and XXE through real callbacks.
Adaptive payloads
Learns which mutations get past a target’s filters.
Business-logic tests
Race conditions, coupon replay and quantity tampering.
Headless browser
Renders SPAs for DOM-XSS confirmation.