What is Attackgrid.io?

Attackgrid.io is a fast, lightweight, open-source checklist manager for penetration testing engagements. It lets you efficiently organize and track your work using the OWASP Security Testing Guides and/or your own custom checklists, with a focus on speed and simplicity during real-world assessments.

How does it work?

For each engagement, create a project and add your target systems or URLs. When working through an assessment, use the checklist to mark each step as you complete it; this makes it easy to track your progress and see what’s left to do, even if you work over several days.

For each item, you can mark it as passed, failed, or issues, and also add notes, procedures, findings, or reminders as you go. These notes are saved securely with your project, so you can refer back to them later, or during reporting.

Is my data sent anywhere?

Never! This entire application is a single HTML file: a completely static, client-side app. There is no backend and no data is ever sent to any server. Projects, targets, checklist statuses, notes, templates, audit logs, and everything else are encrypted with AES-GCM and stored locally in your browser.

It is impossible for anyone except you (or whoever has access to your browser's data) to see your data.

Using AttackGrid Offline

If you don't trust any hosted version, you can download and run it offline: press Ctrl+S to save it locally, then open the saved file directly from disk.

Hosting and Deployment

Because it's just static files, it can be hosted almost anywhere: an AWS S3 bucket, GitHub Pages, GitLab Pages, Cloudflare Pages, Netlify, Vercel, Azure Static Web Apps, Google Cloud Storage static hosting, Firebase Hosting, a simple nginx/Apache static site, or even served from a local folder with python -m http.server and ngrok, for example.

Backups & Security

Backups are encrypted. You can export an encrypted backup file and restore it later (or move it between machines). If you clear your browser storage or site data, your local projects will be lost—so make encrypted backups regularly. To move your data to another device or browser, export a backup and restore it there.

This application protects data at rest in the browser. It does not protect you from a compromised device/browser, malicious extensions, or a weak password.

Disclaimer: Attackgrid.io is not affiliated with, sponsored by, or endorsed by the OWASP® Foundation.