RedKit · Infrastructure Scanner

RedKit is mlab's infrastructure scanning engine. It lets you run targeted security assessments on domains you own, combining reconnaissance, vulnerability detection and compliance checks in a single configurable scan.

What is RedKit

RedKit is an automated security scanner that runs a suite of modular checks against your web infrastructure. Unlike standard domain scans, RedKit performs deep, active testing with configurable modules across three categories:

• Recon - passive and active discovery (subdomains, ports, technologies, DNS, WAF detection)
• Vulnerability - active testing for common web vulnerabilities (SQLi, XSS, SSRF, open redirects, etc.)
• Compliance - verification of security best practices (CSP, DNSSEC, TLS ciphers, cookie flags, etc.)

Each scan produces a detailed report with findings categorized by severity, exportable as a PDF document.

Domain verification

Before scanning, you must prove ownership of the target domain by adding a DNS TXT record. This prevents unauthorized scanning of third-party infrastructure.

Verified domains persist across scans. You only need to verify a domain once.

Scan modules

RedKit ships with 24 modules across three categories. You can enable or disable individual modules before each scan.

Recon (8 modules)

• HTTP Headers
• Subdomains
• Port Scan
• Tech Detect
• WHOIS
• DNS Records
• WAF Detection
• Crawl

Vulnerability (16 modules)

• SSL/TLS
• CORS
• SQL Injection
• XSS
• Directory Scan
• CVE Detection
• Open Redirect
• SSRF
• LFI
• Clickjacking
• HTTP Methods
• Host Header
• CRLF Injection
• WebSocket
• JWT Analysis
• GraphQL

Compliance (8 modules)

• Cookies
• CSP Policy
• DNSSEC
• Email (SPF/DKIM/DMARC)
• TLS Ciphers
• CAA Records
• SRI
• Mixed Content

Running a scan

Once your domain is verified, you can launch a scan from the RedKit dashboard:

Scans run asynchronously. You can close the page and come back later - the results page auto-refreshes every 30 seconds until the scan completes.

Scan quotas depend on your plan: Free (1 lifetime), Pro (5/month), Team (20/month), Enterprise (unlimited).

Results & reports

When a scan completes, findings are presented as individual cards grouped by module. Each finding includes a severity level:

• Critical
• High
• Medium
• Low
• Info

Each finding card shows the module name, a description of the issue, and evidence data when available.

• A severity summary bar at the top provides a quick overview
• The full scan history is available at RedKit → History
• Click Export PDF to generate a printable report with cover page, severity breakdown and detailed findings

Quotas & plans

RedKit scans consume quota based on your subscription plan. The remaining quota is displayed on the scan configuration page before launch.

• Free - 1 scan (lifetime)
• Pro - 5 scans per month
• Team - 20 scans per month
• Enterprise - Unlimited

Visit Pricing for full plan details.