Three new tools are launched with the site and existing tools like Wordlists have been enhanced

DefCon, Las Vegas & Brisbane, Australia - August 11, 2025

Searchlight Cyber has launched a new site where security professionals can access all of its popular open source tools in one place. Publicly announced at DefCon, the Searchlight Cyber Tools Site is live with seven tools developed by the security research team at Assetnote (now a Searchlight Cyber company). Three of the tools are brand new for the launch of the site and four existing tools have been given substantial updates to make them easier to use and configure, making them an even more powerful resource for bug bounty hunters and offensive security professionals.

Assetnote's programmatic approach to cybersecurity research has led to the development of a number of proprietary technologies over the years, which it has made publicly available to other cybersecurity practitioners as open source tools. Many of these tools - such as Wordlists, Newtowner, and Surf - are already extremely popular with bug bounty hunters and offensive security professionals, despite historically requiring some manual setup work.

The new Searchlight Cyber Tools Site was created to provide one central hub to access all of the tools and to make them more accessible to the wider cybersecurity community. Each of the tools now comes with a compatible REST API so that users can plug it into their automation and have been updated to make them extremely accessible - as simple as putting in targets or queries and receiving the results in the browser.

Michael Gianarakis, SVP of ASM at Searchlight Cyber said: “Earlier this year we came to the decision that we would create a completely free tools website that opens up all of our best open source tools to the public. Being a part of the bug bounty community is in our DNA and many of these tools come directly from our team's participation in high stakes, competitive environments, such as live hacking events. Making them easily accessible and as simple as possible to set up and use is our way of giving back to the cybersecurity community and supporting others in their cybersecurity research.”

The three new tools launched with the site include:

• Domain Search: A free-form domain search tool, utilizing an internal Assetnote dataset to search with any keyword.
• Expired Domain Checker: A tool for checking domain expiration dates to identify potential takeover opportunities.
• Subdomain Takeover: A tool that checks against DNS records pointing to unclaimed services to identify subdomain takeover opportunities.

The four existing tools now available on the Searchlight Cyber Tools Site include:

• Wordlists: Curated security wordlists for penetration testing, bug bounty hunting, and reconnaissance.
• Surf: Advanced SSRF detection tool that identifies unreachable hosts and potential SSRF candidates.
• Newtowner: IP-based whitelist bypass testing for various cloud providers like Cloudflare and AWS.
• Nowafpls: WAF bypass detection tool that tests various evasion techniques and payload obfuscation.

Shubham Shah, SVP of Research and Engineering at Searchlight Cyber said: “It has been incredibly rewarding to see the uptake of our tools by the security community over the years. Our Wordlists in particular continue to generate great enthusiasm and the idea behind this new site was to help security professionals get even more out of them. Where there was previously a setup required for some of the tools, now there's no longer a need to spend time configuring locally, as they are readily available to use on the Searchlight Cyber Tools Site!”

The Searchlight Cyber Tools Site can be accessed here.

ENDS

About Searchlight Cyber

Searchlight Cyber was founded in 2017 with a mission to stop threat actors from acting with impunity. Its External Cyber Risk Management Platform helps organizations to identify and protect themselves from emerging cybercriminal threats with Attack Surface Management and Threat Intelligence tools designed to separate the signal from the noise. It is used by some of the world's largest enterprises, government and law enforcement agencies, and the Managed Security Service Providers at the forefront of protecting customers from external threats. Find out more at www.slcyber.io.