AmanKak doesn't invent its own attacks — it runs two trusted, widely-used security scanners
(OWASP ZAP and Nuclei) against a target you choose, then translates what
they find into plain language.
Enter a target — the URL you're allowed to test (staging is safest).
Pick a mode — Passive just looks and listens; Active also pokes at it with test payloads.
Run the scan — watch live progress as ZAP and Nuclei do their work (can take a few minutes).
Read the results — each finding is explained in plain language with a severity level and a suggested fix.
Export — download an XLSX report to share with your team.
1 Choose what to scan
Passive only observes how the site responds normally — it never sends anything resembling
an attack, so it's safe to run against almost anything, including production.
⚠️ Active mode sends real test payloads to the target — the same kind of requests a real
attacker might try (but non-destructive). Only run this against staging or a system you are explicitly
authorized to test. Never run Active mode against production or anything you don't own.