We scout your attack surface before attackers do.

The Mangudai scouted the enemy before the battle began. Your attack surface deserves the same intelligence. Stop leaks, secure DNS, audit headers, and inspect certificates.

Get Started Free

Try Demo Scan Download Sample PDF

BUILT ON OPEN SECURITY TOOLS & PUBLIC DATA SOURCES

NMAP

SUBFINDER

NIKTO

CRT.SH

NVD / CVE

XPOSEDORNOT

CISA KEV

GEMINI AI

NMAP

SUBFINDER

NIKTO

CRT.SH

NVD / CVE

XPOSEDORNOT

CISA KEV

GEMINI AI

NMAP

SUBFINDER

NIKTO

CRT.SH

NVD / CVE

XPOSEDORNOT

CISA KEV

GEMINI AI

NMAP

SUBFINDER

NIKTO

CRT.SH

NVD / CVE

XPOSEDORNOT

CISA KEV

GEMINI AI

MANGUDAI VULNERABILITY REPORT - demo-target.comLIVE

0SCORE

SECURE

Mapped Subdomains:18

Open Ports:3 (80, 443, 22)

SSL/TLS Certificate:Valid

Vulnerability Analysis:2 Medium Risk

$ mangudai scan --quick target.com

[+] Scanning DNS subdomains... 18 hosts resolved

[+] Port scanner: 80 (nginx), 443 (nginx)

[!] SSL scan: Expiring in 18 days

[!] Security Header: Missing Content-Security-Policy

[+] Surface analysis completed.

Test Your Attack Surface in Real Time

The Mangudai Legacy

The Mangudai cavalry never entered battle without scouting the enemy first. We audit your system before attackers do — the same reflex, in the digital age.

Your Journey: From Scout to Khan

DISCOVER

Scout

Discover the perimeter. Initiate basic scans and analyze initial security posture.

Scout

DISCOVER

01 — DISCOVER

STATUSACTIVE

FIGHT

Warrior

Fight vulnerabilities. Conduct active scan modules and regular security checks.

Warrior

FIGHT

02 — FIGHT

STATUSACTIVE

MANAGE

Commander

Manage operations. Access AI analysis, dark web checks, and multiple integrations.

Commander

MANAGE

03 — MANAGE

STATUSACTIVE

DOMINATE

Khan

Dominate the attack surface. Execute unlimited scans with white-label executive reporting.

Khan

DOMINATE

04 — DOMINATE

STATUSACTIVE

Scout

Mangudai Scanning Engine Core

1. Forgotten Asset Discovery

Detects old, forgotten, or staging subdomains to prevent unauthorized access and perimeter leaks.

CORE ENGINEACTIVE

2. Open Port & Service Audit

Scans for exposed databases and open service ports, blocking entry points for ransomware.

CORE ENGINEACTIVE

3. Web Availability Probing

Validates HTTP and HTTPS availability, handling protocol fallback without false positives.

CORE ENGINEACTIVE

4. Security Header Audit

Evaluates HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy.

CORE ENGINEACTIVE

5. Critical File & Data Leak Guard

Inspects exposed .git repositories, backup archives, env files, and sensitive directory listings.

CORE ENGINEACTIVE

6. SSL/TLS Certificate Inspector

Checks expiration dates, self-signed certificates, hostname mismatches, and weak TLS protocol versions.

CORE ENGINEACTIVE

7. Email Security (SPF/DMARC)

Audits DNS TXT records for missing or weak SPF policies and checks DMARC authentication protocols.

CORE ENGINEACTIVE

8. Nikto Vulnerability Scanner

Audits target hosts using Nikto to discover common web vulnerabilities and misconfigurations.

CORE ENGINEACTIVE

9. SQL Injection Heuristic Check

Appends safe canary characters to query parameters to search for database leaks in responses.

CORE ENGINEACTIVE

Enterprise Security at SMB Scale

Enterprise solutions demand days of installation and cost thousands of dollars. Mangudai offers a budget-friendly, high-value alternative for SMBs and MSSPs with instant setup.

PRICING

Starting at $29/mo

• Enterprise Tools: $2.400 - $93.000/yr

• DIY Scanning: Free (Takes time)

LOCALIZED PDF REPORTS

✅ Yes (Full Translation)

• Enterprise Tools: ❌ No (English only)

• DIY Scanning: ❌ Manual translation

AI EXECUTIVE SUMMARIES

✅ Yes (Gemini Powered)

• Enterprise Tools: ❌ Hard to digest

• DIY Scanning: ❌ None

SETUP SPEED

✅ Under 30 Seconds

• Enterprise Tools: Days of sales calls

• DIY Scanning: Hours of manual config

POWERING CYBERSECURITY DEFENSIBILITY FOR TECH TEAMS

NMAP

SUBFINDER

GEMINI PRO

NIKTO ENGINE

Flexible and Fair Plans

Take control of your attack surface. Choose a plan tailored to your needs.

2 Months Free on Annual Billing (Coming Soon)

Scout

Try Mangudai for free

5 scans per month
1 project, 1 target
Basic scan modules
SPF/DMARC/SSL check
Critical findings hidden
PDF reports
AI analysis
Continuous monitoring

Start Free

Warrior

Essential tools for proactive defense

$29/mo

20 scans per month
5 projects, 20 targets
Port, Web, Header & File Scan
Email notifications
PDF report exports in 6 languages
Continuous monitoring
Dark web check
AI analysis
API access
Slack + email notifications

Get Warrior

Commander

For security teams and companies

$59/mo

50 scans per month
Unlimited projects & targets
KVKK & Leak/Dark Web Scan
PDF report exports in 6 languages
AI analysis (Gemini)
Continuous monitoring
Slack + email notifications
API access
White-label reports

Get Commander

Khan

For consultancies managing multiple clients

$299/mo

150 scans per month
All 9 scan modules (Nikto & SQLi included)
White-label PDF reports
Client portfolio view
API & Integration Access
Priority support

Get Khan

Frequently Asked Questions

Mangudai is an Attack Surface Management (ASM) SaaS platform. It discovers your public subdomains, open ports, SSL/TLS certificates, exposed files, security headers and email authentication (SPF/DMARC) from the outside, and tells you what an attacker would see first.

Scans are designed to be low-impact: requests are rate-limited, exploitation is never attempted and form submissions are not sent. Active checks (web vulnerability and SQL injection heuristics) run only after you prove ownership of the domain with a DNS TXT record or file.

Passive checks (DNS, TLS, headers, email security) can run on any domain you are authorized to assess. Active checks require ownership verification so Mangudai is never used against systems you do not control.

Mangudai reports technical gaps that auditors ask about, such as missing HSTS/CSP headers, expired certificates, exposed services and missing cookie or privacy disclosures. It supports readiness work but is not a certification or legal advice.

Scout lets you scan 1 domain up to 5 times per month with subdomain discovery, SSL/TLS, security headers and SPF/DMARC checks. Remediation steps for critical and high findings are available on paid plans.

Most scans finish in 1 to 3 minutes. Progress and findings stream live to your dashboard.