Stage 1
Passive Subdomain Discovery
Queries Certificate Transparency logs and resolves live A (IPv4) and AAAA (IPv6) records without touching target hosts directly.
discovery.py, resolver.pyDefensible external attack surface reconnaissance.
Continuous subdomain discovery, active probing, port scanning, and risk triage for verified infrastructure.
The visibility gap
Unverified scans produce noise. Blind spots produce breaches.
Organizations accumulate forgotten subdomains, exposed test databases, and deprecated TLS configurations. Scanning without verified ownership creates authorization liabilities, while ad-hoc testing misses newly exposed ports and configuration drift.
Architecture
Structured five-stage reconnaissance pipeline
Stage 2
Active Host Probing
Validates HTTP/HTTPS availability on ports 80/443 with SSRF defenses blocking private/loopback IP ranges and a 64 KB response streaming cap.
prober.py, scan_common.py
Stage 3
Lightweight TCP Port Scanning
Connects asynchronously across sixteen default service ports to classify open states and collect non-intrusive service greetings.
portscan.py
Stage 4
TLS & Header Inspection
Evaluates TLS certificate validity, deprecation, and defensive security headers like HSTS, CSP, and X-Content-Type-Options.
tls_inspect.py, headers_inspect.py
Stage 5
Heuristic Risk Scoring
Groups findings into severity tiers from Critical to Info, ordered by severity tier, score impact, then host.
scoring.pyCapabilities
Built for operational security rigor
Automated Change Detection
Differential engine compares consecutive scans to detect new subdomains, newly open ports, and certificate problems (expired, untrusted, self-signed, hostname mismatch).
Scheduled Cadences
Configurable automated scan intervals from 6 hours to 720 hours (30 days) with randomized execution jitter to disperse network load.
Transactional Email Alerts
Transactional outbox delivery issues notification digests to up to 5 configured recipients upon new risk discoveries.
Append-Only Audit Log
Append-only audit log: a database trigger blocks updates, deletes and truncates from the application.
Multi-Tenant Isolation
Role-based access control with owner, admin, and viewer ranks, enforced by tenant-scoped database queries and anti-enumeration defenses.
Authorization Gate
Ownership verification before active scanning
Active scans run only on domains you have verified with a DNS TXT record at _exposight-challenge.<domain>. A time-limited operator override exists for exceptional cases.
DNS TXT VERIFICATION RECORD
_exposight-challenge.example.com IN TXT "exposight-verify=<your-token>"
Monitor your organization's perimeter
Access your domain inventory, configure scan schedules, and triage findings.