SmokeMont Egress
Validate outbound network behavior from a Windows endpoint across DNS, HTTPS, WebSocket, UDP/443, HTTP/2, HTTP/3-style probes, and SSH-over-443 paths.
Windows portable | AGPLv3 source license | reserved SmokeMont branding
Authorized security validation
Portable security tools for field operators.
SmokeMont creates native utilities for authorized teams: validate outbound paths with Egress, review endpoint appearance with Persona, and collect incident material with Material on Windows or macOS.
Products
Each SmokeMont app is a native tool with explicit operator action, clear evidence, and no service install workflow.
SmokeMont Persona
Assess endpoint appearance with profile fit scoring, local network fingerprint reporting, public egress identity review, session comparison, and PDF reporting.
Windows portable | AGPLv3 source license | reserved SmokeMont branding
SmokeMont Material
Collect read-only incident-response material from Windows or macOS endpoints, including system identity, network posture, processes, persistence indicators, security posture, and recent log signals.
Windows portable EXE + macOS app | AGPLv3 source license | reserved SmokeMont branding
SmokeMont Egress
Egress validates what can leave a Windows endpoint through controlled, benign probes across common outbound paths.
Path validationRun DNS, HTTPS, WebSocket, UDP/443, HTTP/2 target, HTTP/3-style UDP/443, and SSH-over-443 checks.
Adapter controlUse automatic routing or bind checks to a specific IPv4 adapter for clearer path attribution.
Run evidenceCapture endpoint profile, target, adapter, status, timing, evidence tier, and exportable Markdown/PDF reports.
SmokeMont Material
Material helps responders gather host evidence quickly during authorized triage without installing an agent or changing endpoint configuration.
Local collectionGather system identity, adapters, DNS, gateways, TCP summary, running processes, startup entries, macOS launch items, security posture, and recent log or event signals.
Case contextAttach case name, analyst, location, notes, collection depth, timestamps, and a report identifier to each collection run.
Evidence reportsExport Markdown or print-friendly PDF reports with executive summaries, category sections, review counts, alert counts, and branding.
Material is observational software. It does not remediate, quarantine, terminate processes, delete files, or modify host configuration.
SmokeMont Persona
Persona helps operators answer a practical security question: from local configuration, traffic metadata, and public egress identity, what does this endpoint appear to be?
Profile scoringCompare observed endpoint traits against Corporate Windows Laptop, MacBook Business Person, Android Phone, iPad, and Thin Client profiles.
Posture reviewReview OS family, hostname context, adapters, private IPs, gateways, DNS servers, public IP, network owner, and approximate region.
Evidence reportsExport a PDF report with engagement metadata, fit score, latest-run comparison, generated profile traits, and safety boundaries.
Persona is observational software. It does not spoof, randomize, or mutate host settings; it provides a shared evidence trail for endpoint identity, exposure, and engagement reporting.
Downloads
Current official SmokeMont builds are available below. Always run tools only on systems and networks where you have permission.
Capabilities
Across all three tools, SmokeMont emphasizes controlled execution, field portability, and reporting that stands up in technical review.
Controlled Operation
Actions run only after explicit operator input, with visible scope and conservative collection behavior.
Evidence-Driven Output
Reports document selected modes, observed signals, result meaning, timestamps, and operator context.
Portable Deployment
Native Windows and macOS builds support field use on authorized systems without a service install or heavyweight runtime workflow.
Brand Integrity
Official SmokeMont releases use reserved branding so teams can distinguish maintained builds from modified internal versions.
License And Branding
SmokeMont code is licensed under the GNU AGPLv3. The SmokeMont name, logo, icon, and related branding are reserved so users can distinguish official releases from modified builds.