I audit infrastructure before attackers

I audit infrastructure before attackers do.

Most security tools are either bloated enterprise suites that cost ten grand a year or one-off Python scripts that fall over on anything modern. I built AetherScan to sit in the middle — a lightweight, async security auditor that crawls your application, maps the attack surface, and actively tests every input with real payloads.

What it does:

Web spidering — Crawls your site up to N levels deep, maps every link, form, and parameter automatically

Active scanning — Fires 100+ payloads across 8 categories: SQL injection, XSS, path traversal, command injection, NoSQL, LDAP, XML injection

Smart analysis — Detects SQL errors, reflected XSS, stack traces, and timing anomalies. No blind guessing

Risk scoring — Every finding gets a severity level based on actual evidence, not CVSS voodoo

Unified JSON reports — One structured file with metadata, sitemap, findings, and risk breakdown

Tested live:

Table

TargetResultscanme.nmap.orgPort 22 (SSH) + Port 80 open, banner extractedhttpbin.org2 pages crawled, 1 form found, 9 XSS reflections detected

Repo: https://github.com/mercury-systems/aetherscan

Typical engagements:

Pre-deployment security audits for web applications

API endpoint hardening assessments

Continuous security monitoring for DevOps pipelines

Replacing manual pentest checklists with automated scanning

Important: I only perform security testing against systems you own or have explicit written permission to test. No gray-hat shit.

What I need from you: A target URL and a description of what you're worried about — exposed inputs, injection points, or general hardening. I'll return a sample audit report in 24 hours — structured JSON, no cost, no commitment.