27 offensive tools. Automated exploitation validation. Delta reports that show exactly what changed. Built for SMBs who need real scanning, not dashboards.
How it works
Dhara runs an opinionated 8-stage scan pipeline purpose-built for offensive security. No tuning, no false-positive triage, no security expertise needed.
| Profile | Duration | Ports | URL cap | Templates |
|---|---|---|---|---|
| Quick | ~30 min | Top 20 | 500 | Crit/High/Med |
| Standard | ~2 hr | Top 100 | 1,000 | All severity |
| Deep | Overnight | Top 1,000 | 2,000 | All templates |
Features
From subdomain enumeration to exploitation validation, Dhara handles the full offensive security workflow.
Template-driven scanning across all severity levels. CVE detection, misconfigs, exposed panels, default credentials.
Optional offensive mode: XSS, command injection, LFI, credential brute-force, service exploitation. Confirm, don't persist.
Compare scans over time. See new findings, resolved issues, risk score changes. Know if your posture is improving or degrading.
Daily, weekly, or custom cron. Automated alerting when new critical or high-severity findings appear.
Scan data never leaves your infrastructure. No vendor lock-in, no cloud dependency. Your security posture stays yours.
Time-limited, HMAC-signed report links. Share with auditors, clients, or stakeholders without giving them system access.
Compliance
Dhara reports map directly to the evidence your compliance framework requires. Continuous scanning replaces point-in-time pen tests.
CC6.1 / CC7.1 — continuous vulnerability assessment evidence with audit trail and timestamps.
A.12.6 — systematic technical vulnerability management with scheduled scanning and delta tracking.
Requirement 11.2 — quarterly vulnerability scans with risk-scored reports and remediation tracking.
164.308(a)(8) — periodic technical evaluation of security controls and infrastructure posture.
Control 7 — continuous vulnerability management with automated discovery and prioritization.
RA-5 — vulnerability monitoring and scanning with risk-based remediation prioritization.