Watch your own perimeter the way an attacker does — exposed ports, domains and TLS certificates, with new exposure flagged the moment it appears
You cannot defend what you do not know is exposed. soc-attack-surface scans your own
estate for reachable ports, live domains and certificate details, stores each result, and
compares it to the last run — so the thing that matters (a new open port, a service that
appeared over the weekend, a cert about to expire) is highlighted instead of buried.
Part of a self-hosted SOC fleet: a small, dependency-light Python service with a web dashboard, a JSON API and a built-in manual. No agents, no cloud, no telemetry.
- Scan a target for exposed ports, domains and certificate details
- Track findings over time and highlight new exposure against the previous run
- Severity-tagged findings list so the important changes surface first
- Pushes results to soc-intel via the bulk intel API for STIX 2.1 storage
cp .env.example .env
env $(cat .env | grep -v '^#' | xargs) python3 app.py
# → http://localhost:8092
Python 3.8+. Standard library only — nothing to pip install.
Only PORT (default 8092). Copy .env.example to .env to change it.
| Path | Purpose |
|---|---|
/ |
Dashboard (HTML) |
/api/scan |
Trigger a scan (JSON) |
/api/stats |
Exposure stats (JSON) |
/manual |
Built-in user manual |
Pairs with soc-passive-dns (what names exist) — this answers what those names actually expose.
MANUAL.md — full user guide (also served at /manual, via the ? button in the UI).
Authorised use only. Only scan infrastructure you own or are authorised to test.
attack surface management · ASM · external attack surface · exposed ports · TLS certificate expiry · asset discovery · perimeter monitoring · shadow IT · blue team · self-hosted
MIT — see LICENSE.