Codename Sonar
Tool Description: A browser-based defensive reconnaissance suite for blue-team operators and authorised penetration testers.
Codename Sonar
Quick Overview
What it does
Provides permission-first discovery and exposure validation for approved hosts, with TCP/UDP profiling, TLS and web reconnaissance, timing templates, and analyst-style briefing outputs.
How to use it
Enter an approved target, choose a conservative recon profile, run the checks, review findings, and export or share the resulting briefing for remediation.
Cost
Partially Free.
Account required
No account required to view the public site; access requirements may vary by deployment.
Cookies
First-party cookies for website functionality and legal/consent preferences.
Ownership
Artisan Technical Computer Services, LLC (Codename Sonar).
Use in Reporting
Can document externally observable network, DNS, web, TLS and security characteristics of authorised infrastructure.
What does Codename Sonar do?
Codename Sonar supports defensive host discovery and service-exposure review for approved environments. It combines TCP/UDP profiles, TLS and web reconnaissance, timing templates, and concise analyst briefings so blue teams and authorised testers can validate exposure and prioritise remediation.
The lowdown: It’s a defensive reconnaissance and attack-surface assessment tool, rather than a conventional passive OSINT search engine.
Important Note: Targets must be systems the operator owns or has current written permission to test.
How to Use:
1. Define the authorised scope and target assets then open Codename Sonar and choose a conservative TCP/UDP, TLS, or web recon profile.
2. Run the checks only against approved systems, then review evidence and analyst briefing output.
3. Record findings and remediation actions. Never use it for unauthorised scanning.
Cost
Free tier available alongside Pro subscription.
Data Processing
Account Required:
No account required to view the public site; access requirements may vary by deployment.
Cookies:
Codename Sonar uses first-party cookies for website functionality and legal/consent preferences. The 2026_codename_sonar_tos cookie stores the version of the Terms of Service accessed and the associated access timestamp. The captured __cf_bm cookie belongs to .grok.com and is a Cloudflare Bot Management/security cookie used to help distinguish legitimate browser activity from automated traffic.
Use in Reporting
Use cases include:
Authorised attack-surface inventory.
Service exposure validation.
TLS/web review.
Remediation documentation for blue teams.
Example: Assess approved company assets after a change, then attach the resulting briefing to an internal ticket. Do not scan third-party systems without permission.
Capabilities
Limitations
Defensive host discovery within approved scope.
Requires explicit authorisation and a defined scope.
TCP and UDP service profiling.
Results depend on target configuration and network visibility.
TLS and web reconnaissance signals.
Not a substitute for a complete penetration test or asset inventory.
Conservative timing templates.
Findings should be validated before remediation decisions.
Analyst-style exposure briefings.
Running active scans can generate traffic, trigger IDS/IPS alerts or potentially affect target systems.
Permission-first workflows for blue teams and authorised testers.
Some reporting, archival and export capabilities are restricted to the paid tier.
Summary
Codename Sonar best fits the discovery → collection → verification → analysis stages of the OSINT workflow, with particular value for technical reconnaissance and external attack-surface assessment. It can then support reporting by providing structured evidence of publicly observable infrastructure, services, and security characteristics.
Ownership
Owned and maintained by Artisan Technical Computer Services, LLC for Codename Sonar. Product site: https://codenamesonar.app. It is presented here as a defensive tool for authorized blue-team and assessment workflows.
Ethical Considerations
Obtain explicit permission and document scope before use.
Minimise collection and avoid unnecessary personal data.
Respect robots, rate limits, terms, and organisational policy.
Validate findings before attributing exposure.
Protect reports and redact sensitive details.
Never use for harassment, intrusion, or unauthorised scanning.
Related Tools:
Nmap
Amass
RustScan
Httpx
testssl.sh
OWASAP Amass
Sources
With thanks to Kent Borgos for submitting this tool to the OSINT Tool Library.
Last updated
Was this helpful?