Scope

Scope is a menu bar app for macOS that gathers a security toolkit into one console. It follows an assessment the way a penetration test runs, from the first lookup to the write-up, across seven workspaces of modules - Recon, Vuln, Web, Access, Wireless, Traffic and Analysis - with a Dashboard that ties them together, a Report and Settings. The catalogue holds 146 modules; the ones that can run on your Mac appear, each with its target and its place in the flow.

Scope runs for real. A module makes a real network request or runs a standard command-line tool against the target you enter, and keeps the output. The built-in modules (subdomains from certificate transparency, CVE lookups from the NIST NVD, the web and crypto checks, hashing) need nothing installed; the rest run a tool already on your Mac - nmap, dig, whois, tcpdump, otool and the like - so a module appears only when its tool is present. Your targets, inputs and results stay on the Mac. Run assessments only on systems you own or are expressly authorised to test.

#Requirements and installation

• macOS 13 Ventura or later.
• A Mac with Apple silicon (M1 or later). Intel Macs are not supported.
• About 15 MB of disk space.

#Installing

1. Download the .pkg from leonardoaguiar.com/scope.
2. Open it and follow the installer. It puts the app in /Applications/Scope.app.
3. At the end, Scope opens by itself, with its window (just the bar, every tab closed) and its icon in the menu bar.

Note: Scope is not notarised by Apple yet. If macOS stops the installer, open System Settings › Privacy & Security, find the message about it and click Open Anyway. This is only needed the first time.

Installing a new version over an existing one keeps your settings. If the app is running, the installer closes it and opens it again at the end.

#Where your data lives

• Settings and the default target are kept in the app's preferences (~/Library/Preferences/com.scope.app.plist).
• The assessment history - the targets, inputs and results of the modules you run, and any packet captures you save - is kept in ~/Library/Application Support/Scope, on this Mac only.
• Nothing about your targets or results leaves the Mac, apart from the requests a module makes to the target and public services you point it at.

#Uninstalling

1. Quit Scope with ⌘Q, or the power button in the menu bar panel.
2. Drag Scope from Applications to the Bin.
3. To remove its data too, delete ~/Library/Application Support/Scope.

#Getting started

On first launch Scope opens its window, with just the bar and every tab closed, and adds its icon to the menu bar. It asks for no permission and, until you run a module, connects to nothing but the update check.

The Dashboard opens the first time you pick it. A reminder at the top says to run assessments only on systems you are allowed to test; I Understand hides it. It is a reminder, not a gate: keeping to authorised targets is yours to do.

#The bar

Every workspace is a tab along the metal bar at the top of the window, Dashboard first and Settings last. The bar also has:

• the app's name and version on the plate in the middle, with an i that opens About;
• Search (⌘F), a field over everything the app holds: every workspace, every module, and the support pages. It also lists what the sibling apps by leonardoaguiar.com hold, and opens a result in its app.
• the square update button with two arrows, which checks for updates and lights while one is waiting;
• the close button, which puts the window away and leaves the menu bar icon.

#The workspaces

Each workspace is a sidebar of modules on the left and the chosen module's workbench on the right. A module's workbench has its name and what it does, a Target to type into, a Run button, the captured output with a short Result read above it, and the real-world tools it maps to. Only the modules that can run on your Mac are listed; install a module's tool and it appears.

• Dashboard - the command centre: the authorisation reminder, the numbers that matter (modules, completed, findings, observed risk), the assessment pipeline from recon to report, the risk score weighted from your findings, module coverage across the steps, a 24-hour activity trace, the latest findings, a live CVE feed and a tile for every workspace.
• Recon - reconnaissance: DNS and zone transfers, WHOIS, subdomains from certificate transparency, host and port scans, service and OS fingerprinting, banner grabbing, SMB, SNMP, SMTP, LDAP and RPC enumeration, TLS certificates and traceroute. Built-in checks run on their own; the rest use dig, whois, nmap and curl.
• Vuln - vulnerabilities and intelligence: service and TLS audits with nmap, a patch check for this Mac, a known-CVE lookup and a live CVE feed, both from the NIST National Vulnerability Database. An open port or a banner is evidence to review, not a confirmed vulnerability.
• Web - web application checks over HTTP or HTTPS: a same-origin spider, a response and session review that flags missing security headers, and an API response inspector. JavaScript is never executed and forms are never submitted.
• Access - a built-in wordlist generator. Online and offline credential attacks are not run from Scope; obtain and run those tools yourself, on systems you are authorised to test.
• Wireless - a read of this Mac's Bluetooth controller and known devices (system_profiler). Wi-Fi, radio and hardware attacks are not run from Scope.
• Traffic - packet sniffing, protocol analysis and capture, with tcpdump. A capture can be written to a file in the assessment folder.
• Analysis - forensics, reverse engineering and cryptography on files on your Mac: hashing and integrity, log and timeline reads, read-only mounts, Mach-O disassembly and static analysis (otool, file, strings, and radare2, binwalk or volatility where installed), and a crypto bench - a hash identifier, encode and decode, cipher shifts and randomness analysis. Nothing here reaches a network.
• Report - the write-up: the findings in one list worst first, the risk score with its breakdown, the remediation for each finding, a chained recon-to-report pipeline, a pentest report you export to PDF or Markdown, a training lab of targets built to be broken, and an assessment-evidence view.

#What runs, and what does not

Every module either runs a built-in check or a standard command-line tool. The built-in modules need nothing installed. A tool-backed module appears only when its tool is present on your Mac; without it, the module stays out of the list. Some capabilities in the catalogue - exploitation, password cracking, spoofing, Wi-Fi and radio attacks - are not run from Scope at all; use the real tools for those, obtained separately, only on systems you own or are authorised to test. Either way, Scope keeps the output, a short read of it and any findings it raised in the local assessment history.

#The menu bar

Scope lives in the menu bar. Click its icon for a quick panel: the app, the risk at a glance, a tile for every workspace that opens the window there, and the way in and out. Settings › Show icon in the menu bar hides it; to get the window back, open Scope again from Spotlight.

#Stack Windows

With more than one of the Mac apps by leonardoaguiar.com open, their windows stack as one. The app menu › Stack Windows chooses how: Compact, Full Bars, Accordion or Separate Windows.

#Updates

Scope checks leonardoaguiar.com for a new version once a day. This is on from the start; turn it off in Settings › Check for updates automatically.

• The small square button with two arrows on the bar, right of the i, checks for updates when clicked. While a new version is waiting, it lights orange with a lamp at its corner, and its tooltip names the version.
• Check for Updates… in the app menu does the same.
• Install updates automatically (off until you turn it on) downloads updates in the background and installs them when Scope quits, or right away from the notice it shows.
• Every update is signed by the developer and refused if the signature doesn't match.

#Help and bug reports

The Help menu and the Help plate on About have:

• Scope Documentation (also Documentation in the app menu): this page.
• Changelog: every version and what changed in it, read from leonardoaguiar.com, so it includes versions newer than the one installed. The same list is at leonardoaguiar.com/scope/changelog.
• Report a Bug… (also in the app menu, under Check for Updates…): a form that sends a report to the developer.

#Report a Bug

Send Report (⌘↩) is ready once there's a title and a description. It sends everything as one report and shows its number. Sending takes a moment of the Mac's work first, which keeps the site from being flooded with automated reports.

#Your Reports

The reports sent from this Mac are listed next to the form, with their status and an orange lamp when there's a reply you haven't read. Click a report to read the conversation and add details.

#Usage statistics and privacy

Scope sends anonymous usage statistics to leonardoaguiar.com once a day. They're on by default and help decide what to fix and improve. Settings › Send anonymous usage statistics turns them off, and whatever was waiting to be sent is discarded.

What goes: the app's version, the macOS version, the Mac's model identifier (such as Mac15,3), the processor type, the language, a few settings that are on or off, how many times the app was opened, the minutes its window was open, and how many times each workspace was opened, counted per day. With it goes an identifier that is random, made by the app and used only for this.

What never goes: a target, an input, a result, or anything you type. The site records the country the statistics come from, not the IP address.

Besides the statistics, Scope connects to leonardoaguiar.com only to check for and download updates, to show the changelog, and to send a bug report when you write one and to check its replies. It never reaches any other network or host.