See your attack surface the way an attacker does.
Give it your domain. It continuously discovers everything you have exposed to the internet, tests it the way a bug hunter or an attacker would, and hands you every finding. It runs on your infrastructure — your attack surface never leaves your servers.
What makes it different
Every finding shows its work
Most scanners tell you something is wrong and ask you to trust a score. This one hands you the evidence and the exact command, so verifying a finding takes ten seconds instead of an afternoon.
The server echoed our arbitrary Origin back in
Access-Control-Allow-Origin and set
Access-Control-Allow-Credentials: true. Any website a logged-in user
visits can therefore read authenticated responses from this host.
Reproduce it yourself
Calibrated, not maximised
A reflected origin without credentials is Low, not High. A bare
* is not reported at all — it is how every public API works, and
flagging it would bury the real ones. Alert fatigue is a security failure too.
It says what it did not find
Skipped a module? It tells you which one and why. Nothing quietly returns zero and lets you assume you are clean.
No invented urgency
A single finding is never dressed up as an "attack chain". A chain needs two or more stages of a real attack on the same host, and every step links to its evidence.
The workflow
How it works
The same flow every time, no domain is ever touched without going through all four steps.
Add a domain
Point ExactSurface at a domain you own or are contractually authorized to test.
Verify ownership
A DNS TXT record or an HTTP file, proof only the real owner could place.
Authorize scanning
Confirm the authorization record. Dedicated IP ranges are checked against your domain's real announced ASN before anything aggressive runs.
Watch continuously
Subdomains, then live hosts, then exposures, findings arrive progressively and re-scan on your schedule.
The modules
What it actually finds
Every module below runs in the product today. Detection only, nothing here ever attempts exploitation.
Subdomain discovery
subfinder + certificate transparency, resolved and probed for what's actually alive.
Cloud asset inventory
Asks your own AWS/GCP/Azure/DigitalOcean accounts what they're running, the load balancer nobody named.
Reverse-DNS sweep
PTR-sweeps ASN-confirmed ranges for hosts that exist but were never published in DNS.
Hidden parameters
Finds undocumented parameters a URL silently accepts, without submitting a hostile value.
JavaScript mining
Extracts endpoints, internal paths and secrets referenced in shipped JS bundles.
Content discovery
Finds hidden paths and files on hosts confirmed to be dedicated to you.
Crawling & archives
Live crawler and Wayback Machine history sweeps to recover historical and hidden assets.
API & path disclosure
Discovers robots.txt, sitemaps, Swagger/OpenAPI schemas, and GraphQL introspection endpoints.
Vulnerability scanning
Nuclei detection templates, with a safe policy that always excludes DoS, intrusive and fuzzing tags.
Exposed secrets
Scans endpoint responses for leaked credentials, stored masked, never in the clear.
CORS, redirects & WAF
Misconfigured cross-origin policy, open redirects, and which CDN/WAF actually fronts each host.
Subdomain takeover
Dangling CNAMEs and dangling A-records pointed at infrastructure nobody controls anymore.
Cloud storage exposure
Checks S3/GCS/Azure bucket names derived from your domain for public access.
TLS inspection
Certificate chain and expiry across every alive host.
Broken-link hijacking
Finds dead outbound links and unclaimed social handles that an attacker could hijack.
Domain intelligence
Email spoofability (SPF/DMARC/DKIM) and registration risk, fully passive.
CVE watch
Matches fingerprinted technology against new CVE and CISA-KEV feeds.
Dependency confusion
Internal package names referenced in your code that nobody has claimed on the public registry.
Lookalike domains
Registered typosquats set up to phish your staff and customers, checked for live mail.
Public code leaks
Searches public repositories for secrets referencing your domain.
Risk correlation
Chains related findings across modules into a prioritized attack path, not a flat list.
Continuous change alerts
Alerts you immediately to new subdomains, ports, and exposures as your surface shifts.
The methodology
A run a bug hunter would recognise
Not a checklist. The actual sequence of a black-box engagement, automated and run continuously — each stage feeding the next, so the surface it tests keeps growing from what it learns.
↳ permutation guessing, DNS-confirmed only → +12 (staging-api.*)
↳ live probe + technology fingerprint → 36 alive · Next.js + nginx
↳ crawl + web archives → mine the JavaScript bundles → /api/internal/v2/users
↳ robots.txt, sitemap, OpenAPI schema, GraphQL introspection → the whole documented API
↳ hidden parameters, content discovery, ports, Nuclei, secrets → leaked API key in a bundle
↳ CORS, open redirect, 403 bypass → admin panel reachable
↳ "one exposed staging host leads to admin"
Deployment
Runs on your infrastructure. Full stop.
There is no vendor cloud holding your attack surface data. Every finding, every scan log, every credential you configure stays inside your own deployment.
Three pre-built images, no source code required. Install is a single compose file.
- MongoDB and Redis never publish a port to the host
- TLS terminated automatically via Let's Encrypt
- Politeness rate cap on every scan, so it never looks like an attack to your own monitoring
- Images pinned to a version, nothing changes under a running scan
# three containers, one compose file curl -O https://exactsurface.com/docker-compose.yml cp .env.example .env # set passwords & domain docker compose up -d # open http://localhost:3000, done
The guardrails
Aggressive at finding. Conservative at everything else.
Nobody can point it at a domain they have not verified
Nothing is scanned until the domain is proven, a DNS record or a file only its owner could place, and IP-level scanning is restricted to ranges confirmed yours. That applies to every user of the product, including your own team and anything holding an API key. It is enforced centrally rather than per-module, because one module missing the check would be a scan of somebody else's network.
What we do not claim: because you host it, whoever administers your deployment also owns its database and could write a verification record by hand. No self-hosted software can prevent that, and we would rather say so than imply a guarantee we cannot keep. What the authorisation record gives you there is evidence, who authorised what, when, and under which terms.
Detection only, never exploitation
It reads a header, compares a response, resolves a name. It never exploits, never writes, never claims a resource. Probe payloads use reserved example domains, so a probe that escapes lands on a host nobody controls.
Polite by construction
Every request passes a rate limiter with a per-host ceiling. A security tool that takes a customer's site down has caused the outage it was bought to prevent.
Secrets are never stored in the clear
A leaked key is shown masked, hashed for deduplication, and purged on a retention clock. Finding a secret must not create a second copy of it.
Where it runs
On your infrastructure. Not ours.
Every hosted attack-surface vendor asks a security team to hand over a live map of their weakest points, the single most valuable document an attacker could steal, and keep it in someone else's cloud. ExactSurface removes the question, and removes the vendor breach from your threat model.
# three containers, one compose file curl -O https://exactsurface.com/docker-compose.yml cp .env.example .env # set passwords & domain docker compose up -d # open http://localhost:3000, add your domain, prove you own it, done
| ExactSurface | Hosted EASM | |
|---|---|---|
| Where your attack surface lives | Your infrastructure | Their cloud |
| Air-gapped deployment | Supported | No |
| Priced by | Free and open source (Apache-2.0) | Assets they discover, or scan credits |
| Bill grows as your surface grows | No | Yes |
| Evidence behind a finding | Full request + reproduction | A severity score |
| If the vendor is breached | Your data is not there | Your surface map is |
100% Free Self-Hosted Edition
Free and open source under Apache-2.0 — your deployment runs on your own infrastructure, with no keys, no limits and nothing phoning home. You are never charged more for discovering more of your own surface, and never metered per scan.
Includes unlimited domains, unlimited members, unlimited API keys, and all 28+ detection modules fully unlocked out of the box.
| Metric / Feature | Self-Hosted Edition |
|---|---|
| Domains | Unlimited |
| Users & Members | Unlimited |
| API Keys | Unlimited |
| Re-scan cadence | Unlimited (customizable schedules) |
| On-demand 403 bypass & Reports | Included |
| Detection Modules | All 28+ modules included and togglable |
Includes TLS inspection, service fingerprinting, hidden parameter discovery, lookalike domain tracking, cloud bucket exposure, cloud asset inventory, new template watch, dorking, internet-index search, and all future modules.
Getting started
Your own attack surface, in about an hour
1 · Deploy
Three containers via Docker Compose on a small VM. No agents, nothing to install on the assets themselves.
2 · Prove the domain
A DNS TXT record or a file at a known path. Nothing is scanned before this, including by you.
3 · Watch it work
The first full run streams live. You will see hosts you had forgotten. Everyone does.
Self-hosted, continuous attack surface management with zero recurring subscription enforcement.