A local desktop workspace for penetration testing and security research.
Connect recon results, observations, hypotheses, findings and next checks in one project — and return with your reasoning intact.
Download for Linux · v0.11.0 · Quick start · See it in action · Русский
An assessment leaves more than scanner output: a response worth checking, a hypothesis that did not hold, an unfinished note, a finding with evidence. Dragontrip keeps those pieces connected to their sources and to the work that comes next.
Built for practicing pentesters, independent security researchers and people learning in authorized labs.
- Follow the source. Import Nmap, Burp and Nuclei results; move from infrastructure and web endpoints to the observations and original files behind them.
- Turn observations into work. Create a linked note, hypothesis, draft finding or task. Keep unsuccessful checks alongside the leads you pursue.
- Resume with context. Restore project navigation, selections, filters and editor drafts. Resolve conflicting edits with both versions in view and recover replaced text.
- Keep your workspace local. SQLite and evidence files live on your machine. No Dragontrip account or hosted project database is required.
- Set a goal and boundaries. Use Plan to describe the investigation goal. Record included and excluded targets. Import existing results with a preview, or approve live recon through supported tool profiles.
- Explore what you observed. Follow hosts, services and applications in the graph; inspect method-specific endpoints and source observations.
- Form a hypothesis. Create a linked record, collect evidence and decide what needs manual verification. An imported observation alone does not confirm a vulnerability.
- Check and record. Track follow-up tasks, manual methodology decisions and finding retests. Saved recon sequences can advance automatically after a full preview and approval, with pause, cancel and explicit retry.
- Continue or share. Reopen the project with its working context, transfer it as
.dtproj, or export selected work as Markdown, standalone HTML or an evidence ZIP.
Reports are one possible result. A useful next check, a disproved hypothesis and a recoverable research notebook are results too.
Switch between English and Russian in Settings → Interface language. The choice is saved automatically for all projects; project names and authored content retain their original text. Tabs and appearance changes use short transitions. Reduce motion previews immediately; use Save appearance to keep it. The Low performance profile and the system's reduced-motion preference also disable animations.
- Authorized pentest: bring together Nmap service inventory, Burp endpoint observations and Nuclei HTTP results. Link a suspected access-control issue to its source, plan a manual check and record the outcome before confirming a finding.
- Independent research: keep a hypothesis, its supporting responses and the checks that ruled it out; return later without reconstructing the investigation from terminal history.
- Lab or training: work through an HTB or similar authorized machine, preserve your reasoning across sessions and keep your own methodology notes.
Short recorded walkthrough · Full gallery, including light theme
Inspect an endpoint and its original observation
Connect a hypothesis to its source and follow-up work
Screenshots and the recording use the real application with an isolated, explicitly authored fictional project (192.0.2.10, portal.example.test). No target requests were sent. New projects start empty; the built-in fictional demo is a separate opt-in project.
0.11.0 adds Russian and smoother navigation. Switch between English and Russian in Settings without reopening your project. Short tab and appearance transitions respect Reduce motion, the Low rendering profile and system preferences. Existing projects, evidence and authored text keep their original content. Release notes · Validation.
Download dragontrip_0.11.0_amd64.deb and its SHA-256 file into the same folder. GitHub's “Source code” archives are for developers.
If upgrading, close Dragontrip and back up the complete data directory before installing.
sha256sum --check dragontrip_0.11.0_amd64.deb.sha256
sudo apt update
sudo apt install ./dragontrip_0.11.0_amd64.deb
dragontripCreate a project and set its goal in Plan. Choose Import results, preview a supported export and open Research. For a guided example without your own data, choose Create fictional demo on Dashboard or Projects. First-project guide →
For live recon on Kali, install the tools you want to use:
sudo apt install nmap whatweb httpx-toolkit ffufThe .deb bundles the frontend and Python backend; Node.js, Rust, pip and Docker are not needed to run it. Recon tools are separate system executables. The httpx adapter needs ProjectDiscovery httpx (httpx-toolkit on Kali), not the Python library.
Current download: 0.11.0 is a prerelease (early MVP), with English/Russian interfaces and a Linux x86_64 installer. The release installer is checked on Ubuntu and installed on Kali before publication; see build verification. A real 4 GB VirtualBox acceptance remains separate. Installation, updates and troubleshooting → · Инструкция для Kali →
The workspace also includes manual review methodologies, an infrastructure graph, evidence attachments and source history, a task board, an encrypted credential vault, portable projects and configurable reports. Full capabilities and current limits → · What changed in 0.11.0 →
- Live recon uses Nmap, WhatWeb, ProjectDiscovery httpx and ffuf, with individual IPv4 targets or IPv4 web origins depending on the adapter. Offline domain/CIDR/IPv6 support does not enable live scanning of those forms.
- Imports support specific Nmap XML, Burp XML and HTTP Nuclei JSONL exports. There is no built-in Nuclei runner, arbitrary shell runner or automatic exploitation.
- Ordinary project data is not encrypted. The vault encrypts credentials separately. Research drafts and retained recovery text travel in
.dtprojv6; review them before sharing. Report composition stays local. Storage, backups and recovery → - Reports export Markdown, HTML or ZIP with explicitly selected evidence (100 files / 32 MiB); native PDF/DOCX export is not available. Windows, macOS and ARM installers are not provided.
Use Dragontrip only for testing you are authorized to perform. Recon sends traffic to the targets you approve; methodologies and investigation paths record manual work. Security policy →
Documentation index · User guide · Imports · Recon sequences · Drafts and recovery · Changelog · Roadmap
Built with Tauri 2 · React/TypeScript · Python/FastAPI · SQLite.
To build from source, install the development dependencies and pinned toolchain, then:
git clone https://github.com/coldvisixn/dragontrip.git
cd dragontrip
bash scripts/setup.sh
npm run desktop:devContributions, reproducible bug reports and usability feedback are welcome. Please use fictional or redacted data. Report implementation vulnerabilities through SECURITY.md.
MIT licensed. Separately installed recon tools retain their own licenses.