Reconnaissance, Attack-surface Visibility & Evidence Navigator
By TRUSTTECH CybersecuritySelect an existing task to keep working on it, or create a new one. Each task groups its own discovery + deep-analysis runs in its own folder.
Terminate fully kills the system process (nmap, ZAP, msfconsole…), not just the scan. Partial results already captured are kept.
Generate evidence snapshots
For every tool artifact captured during this deep run (NSE, external tools, Impacket, service probes), render a PNG "terminal capture" of the output. Read-only post-process. The original .txt/.json artifacts are not modified.
Will render: — PNG(s)
Output:
<run>/<host>/_evidence_snaps/
Without this option, files that already exist on disk are skipped.
Create finding from image
Pick the target analysis, then register a new finding (choose a finding type) or complement an existing one. The image is attached as an independent evidence copy.
Toggle which deep-scan and CVE plugins are active. Disabled modules are skipped automatically by every scan. Modules requiring a higher license tier appear locked.
Offensive Metasploit testing requires a signed engagement on record. Each engagement defines the client + contract reference + target scope + authorized-until date. No offensive scan can run without an active engagement; targets outside scope are rejected; every scan writes to an immutable audit log.
Loading…
Register offensive engagement
All fields except notes are required. Attach the signed PDF — RAVEN stores only its SHA-256 hash as the cryptographic anchor that ties every audit row to this contract version. The raw PDF stays in your document management.
Run offensive Metasploit scan
Local calculators and utilities. Every operation runs in the browser — no input is sent over the network.
New client
Task relations
Group specific tasks of this client into a named relation. Its dashboards and reports aggregate and deduplicate exactly like Global Status, but only over the selected tasks.
Client detail
Delete client
This action is IRREVERSIBLE. It will permanently remove:
Create and manage RAVEN users (administrators, pentesters, analysts), set each role, and scope which clients they can work on. Each user sets their own password on first login.
| Name | Surnames | Roles | Clients | MFA | Active | Actions |
|---|
New user
You set this password and share it with the user; they must change it on first login.
Administrators see every client by default. Choose "Only assigned" to confine this administrator to the client(s) selected below.
Pick the client(s) this user belongs to. Administrators manage only users within their own client(s).
Password reset
Share these credentials with the user. They must change the password on first login.
Configure what each role can access. Tick the sidebar blocks, sections and functions a role may use. The built-in Operator and Administrator have full, immutable access. Changes take effect on each user's next page load.
New role
Lowercase letters, numbers and underscores. Cannot match a built-in role.
Manage the catalog of clients tied to your engagements. Full CRUD with cascade delete protection (typed-name confirmation), CSV export, and associated tasks listed in the detail view.
| Name | Slug | Phone | RUT | Industry | Tasks | Created | Actions |
|---|
Configure third-party intelligence service keys here. When a key is set, RAVEN uses the paid tier for richer data; when empty, it falls back to the free path (still functional, lower coverage). Keys are stored locally and never shipped in a distribution.
Issue per-client API keys so external systems can read InfoStealer results or ingest tasks into ACTIUM. A key is scoped to ONE client and ONE endpoint. The token is shown only once at creation (stored hashed) — copy it immediately. Operator only.
Configure the SMTP account RAVEN uses to send emails, and the automatic ACTIUM alerts.
Outgoing mail account used for all RAVEN emails. The password is stored encrypted and never shown again.
Alerts trigger automatically from ACTIUM data. Per-client alerts go to the client's registered email; responsible-summary alerts go to each responsible's email.
Tune internal RAVEN defaults — timeouts, dimensions, intervals, parallelism. RAVEN uses its shipped defaults for every variable until you set an override; reset returns the variable to default. The "Reset all" button wipes every override at once.
Host detail
Choose target directory
Detail
Detail
Control
Select a client
Choose the client you want to work with.
Add vulnerability
Calculator
New analysis
Configure a session password and Multi-Factor Authentication (TOTP) for the local UI. Both are stored in raven.db. When MFA is enabled, you will need an authenticator app (Google Authenticator, Microsoft Authenticator, 1Password, etc.) and one of the recovery codes shown at setup time.
Loading…
Personalise the interface — colour palette, light/dark mode and UI font. These settings are private to your account and load only after you sign in; the sign-in screen and un-customised users always use the default look.
Loading…
Detail
New task
Loading task creation context…
Delete task
This will permanently remove the task, all its runs in the database, and the entire folder on disk including every Excel, log, screenshot and exported state. This action cannot be undone.
Export to cloud
This zips the task and sends it to your configured ACTIUM target. The client name must match an existing ACTIUM client.
My account
RAVEN
Reconnaissance, Attack-surface Visibility & Evidence Navigator
by TRUSTTECH Cybersecurity
Version
—