Scan Modes

A mode tells the swarm what kind of engagement you're running. It shapes the objective the agents pursue (recon, exploitation, and reporting all follow the objective), and for ASM it also switches off active exploitation so the run stays a pure surface map.

Pick one in the interactive launcher (pentestswarm run → Scan mode) or with --mode on scan:

pentestswarm scan example.com --scope example.com --mode bugbounty --swarm

The modes

Mode	What it does	Use it when
manual (default)	General pentest — find and prove all vulnerabilities across the surface.	You want broad coverage of a target.
bugbounty	Steers toward reportable findings: prove exploitability with evidence, prioritize by severity, and avoid duplicates.	You're hunting on a bug-bounty program and need submission-ready results.
ctf	Goal-driven: gain an initial foothold → escalate privileges → capture flags (flag{...}, user & root flags).	You're solving a CTF box or a boot-to-root challenge.
asm	Attack-surface mapping only — enumerate hosts, endpoints, technologies and exposures, with active exploitation turned off.	You want a non-intrusive inventory / continuous monitoring of what's exposed.

How a mode changes the run

• Objective steering. Each mode sets a default objective the swarm pursues (for example, CTF mode pursues foothold → privesc → flags). Because the whole swarm — recon, classification, exploitation, reporting — is guided by the objective, the mode meaningfully changes what the agents go after.
• ASM is recon-only. asm turns off the active attack tools (the dalfox / sqlmap / nikto / ffuf class of probes) so it maps the surface without exploiting anything. It's the safe choice for inventory and monitoring.

Overriding the objective

A mode only fills in the default objective. If you pass your own --objective, it always wins — the mode's other behavior (like ASM's recon-only toggle) still applies:

# custom objective, still recon-only because of asm
pentestswarm scan example.com --scope example.com --mode asm \
  --objective "inventory all subdomains and exposed admin panels"

You can also force active scanning back on in ASM if you really want it:

pentestswarm scan example.com --scope example.com --mode asm --active-scan=true

tip

Not sure which to pick? manual is the right default for most targets. Reach for bugbounty when you need clean, deduped, severity-ranked results to submit, ctf for capture-the-flag boxes, and asm when you must not touch the target.