The Crossfyre Blog
How distributed recon actually works, offensive-security methodology, and honest comparisons with the tools you already use.
RSSCrossfyre is in open beta
Crossfyre is a hosted control plane for distributed offensive security: enrol your own machines as nodes, orchestrate recon engines across them, and get raw output turned into ranked findings. Here is what is live today, what is coming, and how to start free.
Read the post →Distributed port scanning across a fleet with pulse
Scanning a large IP range from one host is slow and conspicuous. See how Crossfyre fans a pulse scan across a node fleet: splitting CIDR ranges, choosing SYN vs connect, detecting services, pacing the scan for you, and resuming a big sweep crash-safe.
Jun 16, 2026 · 8 min →ProductWhat we are building next
A candid look at where Crossfyre is going: a dedicated vulnerability-scanning engine, Mission Planner, an expanded Valkyrie, an extension marketplace, and a self-hosted control plane. These are directions, not ship dates.
Jun 15, 2026 · 6 min →CapabilitiesAutomating recon with .cfx playbooks
A .cfx playbook is a Python file that chains engines and extensions into one repeatable, parametrized workflow. Here is what a playbook looks like, how it pipes voyage into pulse into mach, and how the same file runs locally or across your whole fleet.
Jun 14, 2026 · 8 min →CapabilitiesHow Crossfyre scans survive a crashed node
A node reboot, a dropped SSH session, a rate-limit timeout: most recon tooling loses the run. Crossfyre does not. Here is how crash-safe execution works, and why you are never billed for work that did not finish.
Jun 12, 2026 · 6 min →CapabilitiesValkyrie: turning the scanner firehose into ranked findings
Raw recon output is a firehose of mostly noise. Valkyrie is the triage layer that reads it, ranks what matters by severity, and tells you why each finding is worth your time. Here is what it does, what it costs, and what it does not do yet.
Jun 11, 2026 · 6 min →CapabilitiesThe nine-layer stack we built from scratch
Most "distributed recon" is a shell script gluing other people's tools across SSH. Crossfyre is a nine-layer platform built from the runtime up: node fleet, provisioning, package management, networking, engines, workflows, orchestration, control plane, and results. Here is each layer and why it matters.
Jun 10, 2026 · 9 min →MethodologyContent discovery at scale without getting rate-limited
Large content-discovery runs trip rate limits and WAFs when they all leave from one address. Crossfyre spreads a mach job across your own nodes and proxy routes and paces it for you, so a big scan gets broad coverage with far fewer blocks, and resumes cleanly if it breaks.
Jun 9, 2026 · 7 min →CapabilitiesOPSEC by design: proxy chains and VPN-isolated nodes
Where your scan traffic comes from is a scope question before it is anything else. Crossfyre gives you layered proxy chains and VPN-isolated tunnels per node and manages them for you, so authorized tests leave from exactly the IP you intend and stay in-scope.
Jun 7, 2026 · 5 min →MethodologySubdomain enumeration that does not miss: passive plus active with voyage
Thorough subdomain discovery means running passive OSINT and active DNS brute-forcing together, then handling wildcards and validating what you found before you act on it. Here is the methodology, with voyage commands, for scopes you are authorized to test.
Jun 5, 2026 · 8 min →GuidesFrom install to your first findings in 10 minutes
A real quickstart: install the CLI, log in, enrol a node, launch a subdomain enumeration against an authorized target, and watch findings stream in. With the exact commands.
Jun 3, 2026 · 7 min →MethodologyA repeatable recon methodology for bug bounty
Recon that pays off is not a one-off blast of tools, it is a staged pipeline you can run again and again. Here is a repeatable methodology mapped onto Crossfyre workflows: scope, enumerate, validate, scan, discover, triage, and schedule it to stay fresh.
May 30, 2026 · 8 min →GuidesHow Crossfyre billing works (scanning is free, credits are for AI)
Your plan sets your limits and unlocks capabilities, and scanning within them is unlimited. Credits are a separate wallet that fuels upcoming AI features. No per-scan fees, no metered minutes.
May 27, 2026 · 5 min →CapabilitiesMeet mach, voyage, and pulse: the Rust recon engines
Crossfyre ships three in-house recon engines written in Rust: mach for content discovery, voyage for subdomain enumeration, and pulse for port and host scanning. Here is what each one does, why we built them in Rust, and how they run standalone or orchestrated across a fleet.
May 22, 2026 · 7 min →GuidesNodes, workflows, operations, findings: the Crossfyre mental model
A five-minute explainer of the four nouns that make Crossfyre make sense: the hosted control plane, the nodes that do the work, the workflows you launch, and the findings that stream back.
May 20, 2026 · 5 min →How Crossfyre compares
Crossfyre vs Axiom
A managed recon platform vs a DIY cloud-fleet framework.
Read the comparison →VSCrossfyre vs Trickest
Two takes on workflow-driven offensive recon, at very different price points.
Read the comparison →VSCrossfyre vs reNgine (HailBytes ASM)
Self-hosted ASM priced per compute hour vs hosted recon priced per seat.
Read the comparison →VSCrossfyre vs Amass
A best-in-class subdomain tool vs a full distributed recon platform.
Read the comparison →VSCrossfyre vs BBOT
A modular recursive OSINT framework vs a managed distributed recon platform.
Read the comparison →VSCrossfyre vs Nuclei
A template-based vulnerability scanner vs the distributed recon that feeds one.
Read the comparison →