ShadowSecurityScanner

What ShadowSecurityScanner is

ShadowSecurityScanner is a free, open-source desktop tool for penetration testing and network vulnerability scanning. It runs locally on Windows, macOS and Linux, and can scan network hosts, servers, web applications and network appliances. Its checks combine port scanning with service and operating-system fingerprinting and thousands of active network and web-application security checks. Findings receive FIRST.org EPSS scoring and are flagged against the CISA Known Exploited Vulnerabilities catalog. Scan comparison can identify findings that are new, regressed or resolved since an earlier scan. Reports can be exported as PDF, HTML, SARIF, XML or CSV; SARIF is described as suitable for GitHub code scanning. Its audit catalog refreshes from a signed update feed that includes daily CISA KEV updates, Nuclei and curated advisories. The application has no cloud component or telemetry, stores its database in the user's profile, and is distributed as one self-contained desktop app without agents or a database server. Listed requirements include Windows 10/11, macOS 11 or later for Apple Silicon, and Linux x64 or ARM64. The maker says to use it only for authorized security testing; denial-of-service tests are excluded.