ThreatWing Tools · Manual 1.0
ThreatWing Tools user manual
Use your iPhone for remote access, network diagnostics, Safety Check, command review, and profile export without secrets. The app is in pre-release; check your build’s release notes for available features.
1. Before you begin
Use only systems and networks you own or have permission to access. Keep another way to reach a remote machine before changing it. Have the address, port, account details, and expected host-key fingerprint ready. Read the Acceptable Use Policy.
2. First launch and permissions
The app explains each permission before iOS asks for it. You can decline and still enter destinations manually or use offline tools. Change permissions later in iOS Settings.
- Local Network
- Lets the app reach local devices when you start discovery, a connection, or Safety Check.
- Location while using
- Allows Wi-Fi name and router matching against a saved network. This feature does not track your location in the background.
- Face ID or Touch ID
- Confirms your presence when you use a key configured to require it.
3. Saved hosts and credentials
- Open Connect and add a destination, or select a device you have permission to use.
- Check its address and protocol with the owner. A discovered service name alone cannot identify a device.
- Choose a password or supported SSH key. Secrets are stored separately in Apple Keychain.
- Save the profile. Folders, tags, and favorites help organize it; they do not grant access to another system.
Profile exports leave out credentials, private keys, and host-trust decisions, as well as scan and activity history. Add the required secrets locally after importing a profile.
4. SSH
Open a saved SSH host. On first use, compare the complete SHA-256 host-key fingerprint with a value you obtained through a trusted, separate channel. Reject a mismatch. If a previously trusted key changes, check with the owner before reconnecting.
The terminal supports VT100/xterm-style sessions and a row of quick keys (Esc, Tab, Ctrl, arrows). Terminal output is held in memory only and is not saved to history. Generated and saved commands go through command review before they run.
5. Remote desktop
ThreatWing supports VNC (RFB 3.8), with a raw framebuffer display, touch or trackpad controls, and view-only mode. The gesture coach pauses remote input while it is open.
Check the server’s protection mode each time. An unprotected session asks for approval on every attempt. Unsupported security modes are refused. Clipboard sharing and file transfer are unavailable in the current build.
6. Discovery and network tools
Discovery runs only while the app is in the foreground and only when you start it. Refresh a known address or choose a private Wi-Fi range you are authorized to check. An incomplete result may mean a device did not respond.
Network tools include DNS lookup, TCP connection checks, HTTP HEAD requests, TLS certificate inspection, and connection timing. Subnet calculation and Rule Lab work offline. Wake-on-LAN sends three local packets when you request it.
A DNS answer, open port, or certificate describes what responded at that time. Confirm the device and context before drawing a security conclusion.
7. Safety Check
Select an authorized private-network target and confirm permission for this run. Read the preset’s ports, pacing, time limit, and retry settings before starting. Custom settings require the same review. If a run stops early, read its reason before deciding whether to try again.
“Run Again with More Time” asks you to review a new plan. Reports are available as sanitized, private, or SARIF exports; inspect any export for sensitive host information before sharing it.
Run a Safety Check on your own network →
8. Command review and AI handoffs
Offline templates need no provider connection. Private API mode uses a backend you control and keeps API credentials on that backend. A ChatGPT handoff lets you copy or share filtered text, then paste a response back yourself. No AI output runs automatically.
- Check the selected host.
- Read the whole command and its explanation.
- Resolve the listed risks before approving.
- High or unknown risk requires a second confirmation.
- Review again if the host or command changes.
9. WireGuard imports
The app checks imported WireGuard configuration and stores private keys in Keychain. WireGuard activation is unavailable in the current build: tunnels cannot be started without a signed network extension. A successful import only means the configuration was accepted.
10. Export, sharing, and deletion
Open Settings → Subscription & Data → Delete Local Connection Data to clear saved connection data. Read what will be removed, confirm, and check whether the app reports anything it could not verify as deleted. Files already shared are unaffected.
Review every export before sharing it. Before uninstalling, use the app’s deletion control to remove saved credentials as well as its local files; iOS backup and Keychain behavior can differ from app-container deletion.
11. Subscription recovery
The app is not yet on the App Store. In builds with StoreKit purchase support, Restore Purchases checks prior purchases after a reinstall or device change. Manage Subscription opens Apple’s renewal and cancellation controls. Losing paid access does not block support, profile export, local-data deletion, or the legal pages.
12. Current limits
Features depend on the build and its enabled entitlements. WireGuard activation, unsupported SSH or VNC protection modes, arbitrary macros, and automatic AI execution are unavailable. Beta access and App Store availability are listed on the product page.