Does this tool need CORS on the target host?

No. The checker uses no-cors fetch probes and only checks whether the browser can complete the HTTPS request. It does not read response bodies, headers or HTTP status.

How is a host considered valid?

A host is shown when the browser can complete a no-cors HTTPS fetch to https://host/. Browser-blocked TLS/certificate failures, DNS failures, connection failures and timeouts are not shown.

Browser HTTPS Scanner

Subdomain checker

Build host candidates, filter them with a regex mask, and check HTTPS reachability through parallel browser no-cors probes.

Target domain Regex mask Regex target Workers 8 Timeout, ms Retries

Subdomain wordlist

Average -

Checked 0

Found 0

Elapsed 0.0s

Idle

Valid hosts

Results

0 candidates

Host	Time	Probe	Signal
Start a scan to see timing results.

Browser only

No CORS dependency

The scanner uses fetch() with mode: "no-cors". A host is shown only when this browser can complete the HTTPS request.

Parallel checks

Worker pool

The selected worker count controls how many browser Web Workers process external HTTPS probes at once. Higher values are faster but heavier on the network.

Disclaimer

Use only with permission

This tool is intended for domains you own or are explicitly authorized to test. Probe requests are sent from your browser and network, so you are responsible for consent, scope, rate limits and compliance with applicable rules.

Liability

No warranty

Results depend on browser TLS policy, DNS, redirects, network reachability and target-side filtering at scan time. The tool is provided as-is; PWN-ALL is not liable for service disruption, blocked access, data loss, legal claims or other consequences from use or misuse.