Scope

Scope is a menu bar app for macOS that gathers a whole security toolkit into one console. It follows an assessment the way a penetration test runs, from the first lookup to the write-up, across eleven workspaces: Dashboard, Recon, Vuln, Web, Access, Wireless, Traffic, Exploit, Analysis, Report and Settings. Over a hundred modules sit in those workspaces, each with its target and a place in the flow.

Scope is a frontend. It shows the toolkit as an interface and runs nothing. A module marked Preview shows illustrative, written sample output; a module marked Layout shows its design only. Either way no module reaches a network, scans, attacks or touches any system, and nothing about any target leaves the Mac. The tool names shown in each module (nmap, hashcat, aircrack and the rest) are references to the real tools in the field, which Scope neither includes nor runs. Use any real tool, obtained separately, only on systems you own or are expressly authorized to test.

#Requirements and installation

• macOS 13 Ventura or later.
• A Mac with Apple silicon (M1 or later). Intel Macs are not supported.
• About 15 MB of disk space.

#Installing

1. Download the .pkg from leonardoaguiar.com/scope.
2. Open it and follow the installer. It puts the app in /Applications/Scope.app.
3. At the end, Scope opens by itself, with its window (just the bar, every tab closed) and its icon in the menu bar.

Note: Scope is not notarized by Apple yet. If macOS stops the installer, open System Settings › Privacy & Security, find the message about it and click Open Anyway. This is only needed the first time.

Installing a new version over an existing one keeps your settings. If the app is running, the installer closes it and opens it again at the end.

#Where your data lives

• Settings and the default target are kept in the app's preferences (~/Library/Preferences/com.scope.app.plist).
• ~/Library/Application Support/Scope is reserved for the app's own files.
• Scope keeps nothing about any target: the targets, inputs and results shown are illustrative sample data, held only to draw the interface.

#Uninstalling

1. Quit Scope with ⌘Q, or the power button in the menu bar panel.
2. Drag Scope from Applications to the Trash.
3. To remove its data too, delete ~/Library/Application Support/Scope.

#Getting started

On first launch Scope opens its window, with just the bar and every tab closed, and adds its icon to the menu bar. It asks for no permission, connects to nothing but the update check, and runs nothing.

The Dashboard opens the first time you pick it. A reminder at the top says what Scope is and is not; I Understand hides it. It is a reminder, not a gate: Scope does nothing to anyone either way.

#The bar

Every workspace is a tab along the metal bar at the top of the window, Dashboard first and Settings last. The bar also has:

• the app's name and version on the plate in the middle, with an i that opens About;
• Search (⌘F), a field over everything the app holds: every workspace, every module, and the support pages. It also lists what the sibling apps by leonardoaguiar.com hold, and opens a result in its app.
• the square update button with two arrows, which checks for updates and lights while one is waiting;
• the close button, which puts the window away and leaves the menu bar icon.

#The workspaces

Each workspace is a sidebar of modules on the left and the chosen module's workbench on the right. In the sidebar, a module with an orange bar is Layout only; the rest are Preview. A module's workbench has its name and what it does, a Target to type into, a Run Preview button (or a locked one, for layout), its result, and the real-world tools it maps to.

• Dashboard - the command centre: the assessment pipeline from recon to report, the risk score from the sample findings, module coverage across the steps, an assessment-activity trace, the latest findings, the CVE feed and a tile for every workspace.
• Recon - reconnaissance and OSINT: DNS, zone transfer, WHOIS, subdomains, host and port scanning, OS and service fingerprinting, banner grabbing, SMB, SNMP, SMTP, LDAP and RPC enumeration, TLS certificates, cloud buckets, email and name harvesting, document metadata, search operators, social recon and IP geolocation.
• Vuln - vulnerability scanning and intelligence: network and web vulnerability scans, CMS checks, a TLS configuration audit, outdated services, patch audit, a known-CVE check and a CVE feed.
• Web - web application testing: an intercepting proxy, spider, directory and parameter fuzzing, the injection classes (SQLi, XSS, CSRF, SSRF, LFI/RFI, command injection, XXE, deserialization), authentication and session checks, login brute force, API analysis and file upload testing.
• Access - passwords and credentials: online brute force, offline hash cracking, dictionary and rule attacks, rainbow tables, GPU cracking, a wordlist generator, memory and database credential dumps, pass-the-hash and Kerberoasting.
• Wireless - Wi-Fi, Bluetooth, radio and hardware: handshake capture, WPA and WPS attacks, deauth, rogue access points, captive portals, sniffing and monitor mode, hidden networks, war driving, Bluetooth and BLE, SDR, RF capture, signal analysis, NFC and RFID, JTAG/UART/SPI, serial, USB fuzzing, HID injection and IoT testing.
• Traffic - man in the middle and traffic analysis: ARP, DNS and DHCP spoofing, SSL strip, packet sniffing, protocol analysis and capture, credential capture, session hijacking, LLMNR/NBT-NS poisoning, NTLM relay and packet manipulation.
• Exploit - exploitation, post-exploitation, command and control, social engineering and evasion. Every module here is Layout only.
• Analysis - forensics, reverse engineering and cryptography: disk imaging, file recovery and carving, memory analysis, timelines, registry and browser artifacts, hashing, log analysis, read-only mounts, disassembly, debugging, decompilation, static and dynamic analysis, binary patching, firmware analysis, a hash identifier, encode/decode, a classic cipher breaker, crypto implementation tests and randomness analysis.
• Report - the write-up: the findings in one list worst first, the risk score with its breakdown, the remediation for each finding, the recon-to-report pipeline, the pentest report sections, a training lab and a purple-team view.

#Preview and Layout

A Preview module shows illustrative output when you click Run Preview. First a Result read - a one-line verdict, a few readouts and a small chart (a bar of open services, a severity share, a confidence ranking or a grade dial) - then the written output below it, revealed a line at a time: a port list, a certificate chain, a DNS dump. Nothing runs to make it: all of it is sample data. A Layout module shows its workbench as a design: its parameters laid out, the action locked, and a plain, bracketed results surface that says nothing runs. The offensive areas (exploitation, cracking, spoofing, wireless and radio attacks, C2, social engineering and evasion) are all Layout.

#The menu bar

Scope lives in the menu bar. Click its icon for a quick panel: the app, the risk at a glance, a tile for every workspace that opens the window there, and the way in and out. Settings › Show icon in the menu bar hides it; to get the window back, open Scope again from Spotlight.

#Stack Windows

With more than one of the Mac apps by leonardoaguiar.com open, their windows stack as one. The app menu › Stack Windows chooses how: Compact, Full Bars, Accordion or Separate Windows.

#Updates

Scope checks leonardoaguiar.com for a new version once a day. This is on from the start; turn it off in Settings › Check for updates automatically.

• The small square button with two arrows on the bar, right of the i, checks for updates when clicked. While a new version is waiting, it lights orange with a lamp at its corner, and its tooltip names the version.
• Check for Updates… in the app menu does the same.
• Install updates automatically (off until you turn it on) downloads updates in the background and installs them when Scope quits, or right away from the notice it shows.
• Every update is signed by the developer and refused if the signature doesn't match.

#Help and bug reports

The Help menu and the Help plate on About have:

• Scope Documentation (also Documentation in the app menu): this page.
• Changelog: every version and what changed in it, read from leonardoaguiar.com, so it includes versions newer than the one installed. The same list is at leonardoaguiar.com/scope/changelog.
• Report a Bug… (also in the app menu, under Check for Updates…): a form that sends a report to the developer.

#Report a Bug

Send Report (⌘↩) is ready once there's a title and a description. It sends everything as one report and shows its number. Sending takes a moment of the Mac's work first, which keeps the site from being flooded with automated reports.

#Your Reports

The reports sent from this Mac are listed next to the form, with their status and an orange lamp when there's a reply you haven't read. Click a report to read the conversation and add details.

#Usage statistics and privacy

Scope sends anonymous usage statistics to leonardoaguiar.com once a day. They're on by default and help decide what to fix and improve. Settings › Send anonymous usage statistics turns them off, and whatever was waiting to be sent is discarded.

What goes: the app's version, the macOS version, the Mac's model identifier (such as Mac15,3), the processor type, the language, a few settings that are on or off, how many times the app was opened, the minutes its window was open, and how many times each workspace was opened, counted per day. With it goes an identifier that is random, made by the app and used only for this.

What never goes: a target, an input, a result, or anything you type. The site records the country the statistics come from, not the IP address.

Besides the statistics, Scope connects to leonardoaguiar.com only to check for and download updates, to show the changelog, and to send a bug report when you write one and to check its replies. It never reaches any other network or host.