The scanner appeared to work . It launched a login screen, allowed a "trial reset," and even scanned a test site for SQLi. The user would never know they were owned.