THE WORKSPACE FOR SECURITY RESEARCHERS

Don’t lose the thread.

Recon turns up a host. Traffic reveals a parameter. A hunch becomes a test. Vigihunt keeps the evidence connected as you move.

northstar / investigationIllustrative workspace

PROJECT / NORTHSTAR

Follow a lead

In scope
TARGET IN FOCUSstaging.northstar.example
+ new in recon
Evidence trail03 linked records
01RECONstaging.northstar.example discovered
02REQUESTGET /api/fetch?url=
03PLANReview URL fetch behavior
One target. Every step in context.
✳INVESTIGATION NOTE# 018

Which endpoints on this host accept a URL?

Two observed routes accept a URL value. /api/fetch has the clearest request history to inspect first.

GROUNDED IN
↗ 12 captured requests 14:41
↗ Recon run today
NEXT STEPReview a test plan
Sample project showing recon, an HTTP request, a test plan, and a source-linked investigation note.
BUILT AROUND YOUR INVESTIGATION01 / 04   FROM FIRST SIGNAL TO FINAL WRITEUP

THE WORKFLOW

Good work happens
between the tools.

The useful part is the connection: what changed, what you observed, what you still need to verify. Vigihunt gives that work a place to live.

01

Recon

A new host appears

02

Traffic

A URL parameter stands out

03

Test plan

A lead becomes a checklist

04

Finding

Evidence stays attached

01 / SEE THE SURFACE

Know what changed.
Know where to look.

Keep assets and recon runs together. When a host appears or a service changes, its history is already next to the target you’re investigating.

ASSET HISTORYnorthstar.example
api.northstar.exampleexisting
staging.northstar.examplenew host ↗
cdn.northstar.exampleexisting
RECON RUN 024 → 1 NEW ASSET
02 / TRACE THE REQUEST

Ask about what
you actually saw.

Bring captured traffic into the same investigation. Answers point back to requests, so you can check the source before you act.

GET /api/fetch?url=
↳ URL input observed in 12 requests
VIEW SOURCE REQUEST
03 / WORK THE LEAD

Turn a hunch into
a deliberate test.

Draft a plan for an endpoint, work through it at your own pace, and keep the result beside the evidence that led you there.

Review accepted URL schemes
Check redirect handling
Inspect internal address behavior

BUILT FOR HUMAN JUDGMENT

Your tools can move fast.
Your judgment sets the pace.

01

Inspect the source. Follow answers back to the requests and recon records behind them.

02

Choose the next action. Work from a suggested plan and decide what to test.

03

Keep the proof. Carry your notes and evidence through to the finding.

READY WHEN YOU ARE

Pick up the next lead.
Keep the whole story.

Give your next investigation a home for the details that matter.

Create a workspace Explore plans