Insomnia in action
36 short walkthroughs across scanning, exploitation, the AI red team, proxy tooling and platform integrations.
Insomnia — the full walkthrough
A complete voiced tour of Insomnia end to end — scanning, exploitation, the AI red team, proxy tooling and reporting.
▸ Commands & details
Everything below in one pass — start with `insomnia scan <target>` and let the engine chain recon, exploitation and reporting.
insomnia scan example.cominsomnia scan example.com --full -A --reportNo demos match your search.
Scanning & Discovery
Point Insomnia at a target and let it map, scan and fingerprint the attack surface.
Web Scanner
Crawl and scan a web app for the full OWASP class set — injection, auth, disclosure and more.
▸ Commands & details
The crawler maps the app first, then runs the module set against every reachable parameter; `--full` adds CVE + 1-day coverage.
insomnia scan https://example.com
insomnia scan https://example.com -m xss,sqli,lfi,ssrf
insomnia scan https://example.com --full -A --report
Network Scanner & Internal Mapper
Port scan, 80+ protocol scanners and service CVEs, plus internal attack-surface mapping.
▸ Commands & details
`network` runs the protocol scanners and service CVE checks; feed a CIDR to sweep and map an internal segment.
insomnia network 10.0.0.0/24
insomnia portscan 10.0.0.5 --vuln
insomnia network target --report
Port Scanner
Fast TCP/UDP port discovery with service and version detection.
▸ Commands & details
Top-1000 by default; `-p all` for every port, `--udp` to include UDP, `--vuln` to CVE-check the services it finds.
insomnia portscan example.com
insomnia portscan example.com -p all --udp
insomnia portscan 10.0.0.0/24 -o scan.csv
Scan Config — Presets & 614 Models
Pick a preset and route scans/triage through 614 AI models for broad coverage.
▸ Commands & details
Presets scope the module set (quick/standard/full/web/api/stealth); AI triage can fan findings across many models for resilient verdicts.
insomnia scan target --preset web
insomnia scan target --preset api
insomnia scan target --fast
Subdomain Scan & Takeover
Enumerate subdomains and flag dangling records vulnerable to takeover.
▸ Commands & details
Enumerates subdomains, then checks each dangling CNAME/record against known takeover fingerprints.
insomnia subdomain example.com
insomnia scan example.com -m subdomain_takeover
Recon Tools
Directory brute-force, passive recon, cloud enumeration and WAF / admin-finder / dorks.
▸ Commands & details
Low-noise recon first — directory brute, passive fingerprinting, cloud-asset discovery and WAF/admin detection via dorks.
insomnia scan target --preset stealth
insomnia scan target -m dirbrute,waf_detect,admin_finder
Alive Checker
Quickly triage which hosts and services in a target list are live.
▸ Commands & details
A fast liveness sweep over a target list so you only scan what actually answers.
insomnia portscan 10.0.0.0/24 -p 80,443,22
insomnia network targets.txt
Host Security Audit
Audit a live host's security posture — reachable services, exposure and misconfiguration — in one pass.
▸ Commands & details
Fingerprints every open service, then flags weak configs and exposure against the host's real surface; results stream per host.
insomnia network 192.168.1.10
insomnia network 10.0.0.0/24 -o host_audit.json
insomnia surface example.com --tech --risk
External Attack Surface
Map an org's internet-facing surface — subdomains, live hosts, ports, TLS, tech and takeover risk — keyless.
▸ Commands & details
A staged keyless pipeline (subdomains -> resolve -> ports/banners -> TLS/tech -> takeover + cloud buckets) with every finding evidenced.
insomnia surface example.com
insomnia surface example.com --subdomains --ports --tech
insomnia surface -f targets.txt --output surface_map.json
Exploitation
Confirm findings by safely exploiting them — from injection to out-of-band callbacks.
Exploitation — SQLi, LFI, CLI
Confirm and exploit SQL injection, LFI / path traversal, and drive it all from the CLI.
▸ Commands & details
The `sqli` exploiter fingerprints the DBMS then enumerates DBs/tables and can pop an OS shell or read files — all scriptable from the terminal.
insomnia sqli "https://site/item?id=1" --dbs
insomnia sqli "https://site/item?id=1" --dump --db app --table users
insomnia sqli URL --file-read /etc/passwd
XSS Exploitation
Prove reflected, stored and DOM XSS with real payload execution.
▸ Commands & details
Confirms reflected/stored/DOM XSS with context-aware payloads and real execution evidence, not just a reflected string.
insomnia scan https://example.com -m xss,dom_xss
insomnia scan https://example.com -m xss --report
1-Day Exploit Scanner
Fire 21,000+ real PoCs at the target to confirm known CVEs.
▸ Commands & details
Active PoC engine — fingerprints the stack, then fires matching 1-day exploits with OOB confirmation.
insomnia scan target --full
insomnia cve target --all
Out-of-Band Testing
Catch blind RCE, SSRF and injection via out-of-band (OAST) callbacks.
▸ Commands & details
Spins up an OAST listener so blind RCE/SSRF/SSTI/XXE are confirmed by the callback, not a guess.
insomnia scan target --full
insomnia scan target -m ssrf,blind_sqli_time --report
API & GraphQL
Test REST and GraphQL APIs for authorization, injection and schema flaws.
API Testing & GraphQL
Test REST APIs against the OWASP API Top 10 and audit GraphQL endpoints.
▸ Commands & details
Seed from an OpenAPI/Swagger spec (or auto-discover it) for REST; introspect and audit resolvers for GraphQL.
insomnia api --spec swagger.json -t https://api.example.com
insomnia api --discover https://api.example.com
insomnia graphql https://example.com/graphql
MCP Server Pentest
Audit an AI Model Context Protocol server for prompt injection, tool abuse and credential leakage.
▸ Commands & details
Enumerates the MCP tool/resource surface then probes each for injection and leakage; the anti-prompt-injection firewall can be toggled and live-fired.
insomnia --mcp-audit http://127.0.0.1:8899/sse
insomnia --mcp-audit http://127.0.0.1:8899/sse --mcp-report scan.html
AI Pentesting
Let the AI red team drive the engagement, triage findings and talk you through it.
Autonomous Pentest
An AI red team plans and runs a full engagement end to end.
▸ Commands & details
Give it a target and a goal; the AI red team plans, runs and adapts the engagement, then writes it up.
insomnia ai https://example.com
insomnia ai https://example.com --goal "Focus on auth bypass"
AI Assistant (Text & Voice)
Ask the assistant to explain findings or draft payloads — by text or hands-free voice.
▸ Commands & details
Ask it to explain a finding, draft a payload or run the next step — the same assistant works by text or by voice.
insomnia ai https://example.com --goal "explain the top finding"
Security Auditors
Specialized AI auditors review a target against focused security checklists.
▸ Commands & details
Focused AI auditors grade a target against specific checklists (auth, headers, exposure) and explain each gap.
insomnia ai target --goal "audit auth and session security"
Insomnia War Room
A live command center for running and watching an engagement unfold.
▸ Commands & details
A live dashboard to launch, watch and steer an engagement as findings land in real time.
insomnia scan target --full --report
insomnia report --last
Code Security
Shift left — scan source, review code with an AI team, and catch exposed secrets.
Code Analysis & Secrets
SAST, AI code review, SCA dependency scanning and a leaked-API-keys catalog.
▸ Commands & details
`sast` runs source analysis + SCA; the AI code-review team flags security and quality issues, and exposed keys get validated against 26 services.
insomnia sast /path/to/project
insomnia sast /path --report -o ./out
insomnia apikey "ghp_xxxxxxxx"
Proxy & Request Tooling
The hands-on toolkit — intercept, replay, mutate and analyze requests like a pro.
Proxy Suite
Intercepting proxy, Repeater, Replacer and AI proxy analysis in one workflow.
▸ Commands & details
Intercept traffic, replay a request in Repeater, mutate it in Replacer, and let AI flag the interesting ones — mostly a GUI flow, backed by the proxy.
insomnia proxy --port 8080
# then set your browser proxy to 127.0.0.1:8080
Rules, Compare & Fuzzing
Define match/replace rules, diff responses, and fuzz parameters at scale.
▸ Commands & details
Write match/replace rules, diff two responses to spot the change, and fuzz a parameter across a wordlist.
insomnia scan "https://site/search?q=FUZZ" -m fuzz
insomnia proxy --port 8080
Proxy & Tor
Route all traffic through a custom proxy, SOCKS or Tor for anonymity.
▸ Commands & details
Point every request through a custom HTTP/SOCKS proxy or Tor for anonymity or scope control.
insomnia scan target --proxy socks5://127.0.0.1:9050
insomnia scan target --tor
Red Team & Load
Go beyond the app — social engineering and availability stress testing.
Social Engineering
Build and run phishing and social-engineering campaigns against a target.
▸ Commands & details
Compose a campaign, host the lure and track interactions — for authorized awareness testing only.
insomnia phish --help
insomnia serve # host a lure / rogue service
Stress Tester
Load- and stress-test a target to probe availability limits.
▸ Commands & details
Ramp controlled load against a target you own to find its availability ceiling.
insomnia stress https://example.com
insomnia stress https://example.com --help
Protocol Bruteforce
Credential bruteforce across SSH, FTP, RDP, SMB, MySQL and HTTP forms — native, no external tools.
▸ Commands & details
Per-protocol auth attempts with a cooperative governor; a hit is confirmed by a real authenticated session, never a banner guess.
insomnia brute ssh 192.168.1.1
insomnia brute rdp 192.168.1.1
insomnia brute http http://example.com
Command & Control
Stand up a C2 listener, generate a cross-platform agent, and drive deployed implants from the console.
▸ Commands & details
The wizard walks listener -> agent -> deploy; the server exposes a listener URL and one-liners, and agents report into a persisted state.
insomnia c2 setup
insomnia c2 server 8443 --https
insomnia c2 generate --os windows --host 1.2.3.4 --port 8443 -o agent.ps1
Monitoring
Keep watch on a target over time.
Monitoring — Availability & Defacement
Track uptime and watch for unauthorized content changes / defacement.
▸ Commands & details
Baseline a target, then watch for downtime or unauthorized content changes and get alerted.
insomnia monitor https://example.com
insomnia scan target -m defacement_detection
Forensics & IR
Packet-capture analysis, host artifact review and rootkit/IOC hunting.
PCAP Forensics
Analyze a packet capture (or live traffic) for credentials, DNS exfiltration and C2 beaconing.
▸ Commands & details
Reconstructs sessions and extracts secrets/IOCs from the capture; beaconing and DNS-exfil heuristics surface covert channels.
insomnia pcap traffic.pcap
insomnia forensics capture.pcap --extract-creds
insomnia forensics capture.pcap --dns-exfil --beaconing
Rootkit Detection
Hunt host-level compromise — persistence, suspicious memory strings and malware IOCs — via forensic artifact analysis.
▸ Commands & details
Runs over a memory image / host artifacts with string and YARA scanning plus persistence checks to flag rootkit and implant indicators.
insomnia forensics --memory dump.raw --strings --yara rules/
insomnia forensics access.log
Platform & Integrations
Take Insomnia everywhere — CLI, CI/CD, IDE, mobile and reporting.
Command-Line Interface
The full scanner from your terminal — scriptable and CI-ready.
▸ Commands & details
The whole engine is a single `insomnia` binary — every scan, exploit and report is scriptable and exits with a usable status for CI.
insomnia scan target --report -o report.html
insomnia --help
DevSecOps — CI/CD & IDE Plugin
Gate every build with a scan and review findings without leaving your editor.
▸ Commands & details
Drop the CLI into a pipeline to gate builds, or use the IDE plugin to scan and triage from your editor.
insomnia sast . --report -o ./out # in CI
insomnia scan $TARGET --fast # fail the build on findings
Mobile Security
Analyze APK/IPA mobile apps for security flaws.
▸ Commands & details
Static analysis of an APK or IPA — secrets, insecure storage, exported components and more.
insomnia mobile app.apk
insomnia mobile app.ipa
Report Studio
Turn findings into a polished, client-ready report.
▸ Commands & details
Every scan can emit a polished HTML/PDF report; open the last one instantly or style it for a client.
insomnia scan target --report -o report.html
insomnia report --last
Knowledge Base
Look up techniques, payloads and remediation guidance in-app.
▸ Commands & details
Search techniques, payloads and remediation guidance without leaving the tool.
insomnia cve --search "rce"
insomnia cve --list-tech
OSINT Canvas
A visual canvas for domain, IP, email and username intelligence.
▸ Commands & details
Pivot across domains, IPs, emails and usernames on a visual graph; `--preset full` runs every module.
insomnia osint example.com --preset full
insomnia osint -email [email protected]
insomnia osint -user johndoe