The bench is
the website now.

A working pentest bench in your browser — and an entire operating system one click past it.

17 bench tools427 OS commands207 working verbs in the OS3 resolvers per DNS answer0 trackers — local tools stay local

This used to be a brochure for nightjar, the native network instrument for iPhone and Mac. Brochures don't pentest anything — so the site became the tool. Everything nightjar's Blacksite bench does from a phone, rebuilt for the browser, plus everything a browser and an edge network can honestly do. Set a target above and run the battery, or pick a tool. Need the native app? Build nightjar from source with Xcode on iPhone or Mac (iOS signing/provisioning applies) — releases · get started.

DNS

One question, three independent resolvers. Disagreement between them is the finding: split-horizon DNS, stale caches, and lame delegations all show up as a row that doesn't match.

PTR works too — give an IP and ask for PTR. ALL sweeps the ten record types that matter most.

TLS Inspector

A hand-rolled ClientHello flies from the edge and the certificate flight is parsed byte by byte — the chain exactly as a client receives it, not as a database remembers it. TLS 1.3 encrypts its Certificate message; when that happens the inspector says so instead of inventing a chain.

HTTP Audit

One GET per redirect hop (each hop re-checked against the public-target guard), then everything graded: security headers scored A–F, every cookie's flags read, a foreign-Origin CORS probe, and a fingerprint from what the server volunteers.

Connect Check

nightjar's connect scan, from the edge: a full TCP connection either opens, is refused, or times out. No stealth claims — a connect is a knock, and the other side's logs will show it. Results are from a Cloudflare point of presence; a port can read differently from your network.

Custom lists are capped at 32 ports per check. This is a bench instrument, not a sweep cannon.

Domain Recon

Before touching a target, read what it already published. Registration (RDAP), every name it ever put on a certificate (Certificate Transparency via crt.sh), and its well-known public files — assembled into one picture.

crt.sh is a volunteer-run ledger and rate-limits; a timeout there is their throttle, not your target hiding.

Email Security

Can anyone send mail as this domain? The anti-spoofing ledgers answer: SPF says who may send, DMARC says what to do with fakes, DKIM signs, MTA-STS enforces encrypted delivery. Graded like the EAZY battery grades them.

Subdomain Census

Every certificate ever issued for a domain is public, and each one names its hosts. This reads the ledger and lists them all — the attack surface the domain itself published.

JWT Inspector

Decode the token, read its claims against the clock, red-flag the classic verifier traps (alg=none, kid traversal, remote key URLs, no expiry), and — for HMAC tokens — verify the signature against a secret you supply. Tokens can be credentials: this tool runs locally precisely so you can paste one safely.

Vault

Codecs + Regex

Subnet Math

The arithmetic under every scope document. The class field tells you which space an address lives in — and the private, loopback, and link-local classes are exactly the ones this bench's edge probes refuse to touch.

Certificate Decoder

Paste a certificate — PEM, base64 DER, or hex — and read it with a hand-rolled ASN.1 parser. The local twin of the TLS Inspector, for certs you already hold.

PQC Scanner

Paste a config, an SSH banner, a TLS report, a code fragment — anything with cryptography in it. The scanner (a web cut of snoot) flags classical algorithms and names the NIST post-quantum replacement for each. Harvest-now-decrypt-later is the threat: ciphertext recorded today opens the day a capable quantum machine exists.

Runs entirely in your browser — nothing you paste leaves the page. The full snoot walks codebases and emits CBOM (CycloneDX); this is its front door.

Payload Bench

Build the bytes before you send them anywhere: enter text, hex, or base64 and get every representation back with length, CRC32, entropy, and SHA-256 — the same discipline as nightjar's Send tab, where you see both sides of an exchange before it happens.

Mirror

Every probe on this bench can be turned around. This is your own EMCON picture: what this server saw, what your browser volunteers, what WebRTC hands to any page, and what the radios around you are offering.

Report

Every probe you run lands here, in order. Export it as JSON or Markdown before you close the page — the bench keeps nothing server-side, mirroring nightjar's rule that the evidence belongs to the operator.