Scope Checker
Paste a pentest or bug bounty scope, then check hosts, URLs and IPs: in scope, out of scope or excluded, with the rule that decided.
Runs in your browser Your input never leaves your device.
| Checked | Result | Why |
|---|
Names are compared as text; nothing is looked up, so a host name that points at an in-scope IP is not matched. Schemes and query strings are ignored, ports only when a rule has one, paths match whole segments (exclusion paths ignore case). An excluded plain host name also excludes its subdomains. Everything stays in your browser; nothing is uploaded.
Report a problem with this tool
About this tool
Before you touch a target you need to know whether it is allowed. This tool reads scope text the way programs write it and decides each host, URL or IP you give it: IN, OUT or EXCLUDED, and it names the rule and line that decided. Scope text can have In scope and Out of scope sections, lines starting with ! or - or the word exclude, comments after #, bullets and numbered lists. It understands plain host names, wildcards such as *.example.com, URLs with a path prefix, single IPs, CIDR blocks, and ranges written as 1.2.3.4 - 1.2.3.9. Exclusions always win, and an excluded plain host name also excludes its subdomains; exclusion paths ignore case, double slashes and percent-encoding. A wildcard matches any depth of subdomain (a.example.com and a.b.example.com) but not example.com itself, and never evil-example.com or example.com.evil.net. A plain host name means exactly that host, unless you tick include subdomains. Candidates are read the way a browser reads them: in https://[email protected]/ the host is evil.net, upper case and a trailing dot do not matter, Unicode names are converted to punycode, odd IPv4 spellings such as 0x7f.1 or 2130706433 become 127.0.0.1, and ::ffff:1.2.3.4 is compared as IPv4. Ports are ignored unless a rule names one; a path rule such as /api matches /api and /api/x but not /apiary, and dot segments are resolved first. Schemes and query strings are ignored. Host names are compared as text and never resolved, so a name that points at an in-scope IP is not matched. Words on a scope line that are not rules are listed as skipped notes, and lines that look like rules but are broken are reported with a reason. Up to 100,000 scope lines and 20,000 candidates are processed.
How to use it
- Paste the scope text, or press Load an example.
- Paste the hosts, URLs or IPs you want to check, one per line.
- Tick include subdomains if your plain host names should cover their subdomains.
- Press Check, read the rule behind each result, then copy or download the table.
Common problems
- A host I expected to be in scope shows OUT
- Read the Why column. It says when a wildcard does not cover the bare domain, when a plain host needs include subdomains, and when only the port or path differs.
- A scope line was not turned into a rule
- Check the problems list for broken rules and the skipped notes for prose. Wildcards are only supported as the first label, and paths take a prefix such as /api/, not a pattern.
- A name that resolves to an in-scope IP is OUT
- Names are never looked up here. Add the name as a rule, or check the IP address itself.