Koruqan
Offensive security and pentest platform for web and infrastructure.
Koruqan is a self-hosted offensive security platform that brings source code, live web, dependency and infrastructure testing together in a single engine. Then we went further. Our platform actually exploits findings to give you hard proof, backed by AI validation and reports you can hand straight to leadership.
Authorized security testing only. Self-hosted. Your data never leaves your network.
A live scan summary, from target to proven findings.
One engine across source code, live web, dependencies and infrastructure — with real exploit proof, not guesses.
Most tools test a single slice of your attack surface. We run the whole chain, from a line of source code to a proven root shell, and we correlate every result so nothing slips through.
Our 31 static modules trace injection sinks, weak crypto, hardcoded secrets and unsafe patterns directly in your code.
116 dynamic modules cover SQLi, XSS, SSRF, IDOR, XXE, auth and JWT, request smuggling, cache poisoning, GraphQL and current n-day CVEs.
We scan your libraries for known CVEs and map every hit to the CISA KEV, NVD, GHSA and EPSS feeds.
We test Ubuntu privilege escalation to root, multi-tenant isolation breakout, and hardening for nginx, SSL, databases, mail and SSH.
We surface leaked keys, tokens and credentials across your code and build artifacts before an attacker finds them.
Our 68 offensive modules do not stop at flagging a risk. They exploit it: login bypass, shell access, file read and write, database pivot, root. You get real proof, not a maybe.
173 registered modules, spread across the five layers we run on every engagement.
We give you an n8n-style canvas to chain modules, raw commands, AI and conditions into your own attack flow. Save it, run it, and watch each node light up live.
Our Gemini integration turns raw findings into an executive summary and guided exploit suggestions. Every command passes through a security gate before it runs.
We ship nuclei, sqlmap, nikto, ffuf, semgrep, grype, MobSF and around 40 more tools in a Docker sidecar. Your host stays clean and a single flag switches engines.
We match the versions we detect against CISA KEV, NVD, GHSA and EPSS, so you see the CVEs that are actually being exploited in the wild. A Tenable Nessus bridge is built in.
We detect your stack, whether it is PHP, Node, Java, Go or WordPress, and run only the modules that matter. Less noise, and faster, cleaner scans.
We build a methodology knowledge base from disclosed HackerOne reports and enrich your findings with the context real attackers use.
Point Koruqan at a URL or a codebase, choose a profile, and set your scope. Smart selection handles the rest.
We run the five layers in parallel with rate limiting and circuit breakers, streaming progress to you live.
Offensive modules and AI-guided steps confirm each issue and capture concrete, reproducible proof.
You get a branded HTML report plus JSON and SARIF, ready for the client and the pipeline alike.
Drag nodes onto the canvas and wire them together. Trigger a target, run any of our 170+ modules, drop in a raw Kali command, ask the AI, branch on a condition, then publish the proof.
We send every finding to Gemini for an executive summary, a priority ranking, a remediation roadmap and false-positive flags. Then we validate the exploit with a success check and attach concrete proof.
We produce branded HTML with AI commentary, a hardening plan, root-cause analysis and a scan-to-scan diff. For your pipeline, we also export machine-readable JSON and SARIF.
Every module lives in a single console — from launching a scan to triaging findings, driving exploits and shipping the report.
A live dashboard of active scans, risk grade and top findings.
Point at a URL or codebase, pick a profile, and smart selection does the rest.
Interactive, guarded exploitation with real command output and proof capture.
Triage every issue with severity, CWE, CVSS and reproducible evidence.
Match detected versions against live CISA KEV, NVD, GHSA and EPSS feeds.
Search findings and methodology by meaning, not just keywords.
A methodology knowledge base built from disclosed real-world reports.
Pull Tenable Nessus findings straight into your correlated report.
Cover more ground on every engagement and deliver proof-backed, branded reports faster.
Gate your CI/CD with SARIF and fail-on thresholds, and correlate SAST with live findings.
Audit multi-tenant isolation, privilege escalation and service hardening at scale.
Chain modules, AI and Kali tools into recon-to-exploit workflows you can repeat.
Koruqan is a self-hosted offensive security platform that combines source code analysis, live web testing, dependency scanning and infrastructure assessment in a single engine. It runs 173 registered modules and roughly 50 Kali Linux tools across five layers of the attack surface, then validates findings through automated exploitation rather than reporting them as possibilities. Read the full guide to self-hosted pentest platforms.
A vulnerability scanner flags what might be exploitable. Koruqan's 68 offensive modules go further and actually exploit the finding: login bypass, shell access, file read and write, database pivot, privilege escalation to root. Each result is attached to the report as reproducible proof, which removes the false positives a scanner leaves behind.
Koruqan is deployed inside your own network. Targets, scan results and proof-of-exploit artifacts never leave your infrastructure, which is why it fits regulated environments that cannot send target data to a third-party SaaS platform.
Five: source code (31 static modules for injection sinks, weak crypto and hardcoded secrets), live web (116 dynamic modules covering SQLi, XSS, SSRF, IDOR, XXE, auth and JWT, request smuggling, cache poisoning, GraphQL and current n-day CVEs), dependencies (CVEs mapped to CISA KEV, NVD, GHSA and EPSS), server and infrastructure (Linux privilege escalation, multi-tenant isolation breakout, nginx, SSL, database, mail and SSH hardening), and secrets (leaked keys, tokens and credentials in code and build artifacts).
Koruqan sends findings to Gemini for an executive summary, priority ranking, remediation roadmap and false-positive flags, and can suggest guided exploit steps. Every command passes through a security gate before it runs, so destructive or out-of-scope commands are rejected by default. Blind SSRF and RCE are confirmed out-of-band through interactsh.
Yes. Alongside the branded HTML report, Koruqan exports machine-readable JSON and SARIF, so you can gate a pipeline with fail-on severity thresholds and surface findings in your existing code scanning UI. A scan-to-scan diff shows what is new and what has been fixed.
Around 50 tools ship in an isolated Docker sidecar, including nuclei, sqlmap, nikto, ffuf, semgrep, grype and MobSF. The host system stays clean and a single flag switches engines.
Penetration testing firms that need broader coverage and faster proof-backed reporting, AppSec and DevSecOps teams gating CI/CD with SARIF, hosting and VDS providers auditing multi-tenant isolation and service hardening at scale, and bug bounty hunters chaining modules, AI and Kali tools into repeatable recon-to-exploit workflows.
We host nothing for you and your data never leaves your network. Book a live walkthrough and we will run a full scan-to-proof cycle end to end.
Send us a note and we will set up a live walkthrough on a system you own or are authorized to test.