Attack Surface Management

01Overview

EASM Scanner is a comprehensive External Attack Surface Management platform written in pure Python, inspired by commercial solutions like CyCognito, Censys and Mandiant ASM. From a single command it runs a fully automated 14-step pipeline that ingests seeds (domains, IPs, CIDRs, ASNs), discovers and maps internet-facing assets, enriches them, assesses them for vulnerabilities, and produces risk-scored findings — turning an unknown, sprawling internet footprint into a prioritized, actionable inventory.

Its defining design choice is zero hard dependencies on external tooling. The scanner wraps high-performance Go tools from ProjectDiscovery (subfinder, httpx, dnsx, naabu, nuclei, tlsx, asnmap, gowitness) as optional accelerators, but ships a pure-Python fallback for every capability — so it works out of the box with only `requests` and `dnspython`. Every module is self-contained with its own dataclasses, making the codebase easy to read, test and extend.

What sets it apart from a plain scanner is the blue-team and intelligence tooling built on top. It performs unknown-asset discovery (siblings, subsidiaries, shadow IT) via five passive pivots with confidence scoring; cross-references your own surface against six free threat-intel feeds; and pairs every exposure with its defensive counterpart — MITRE ATT&CK technique tags plus ready-to-deploy Sigma rules. Findings flow into a multi-factor risk score with auto-escalation, and out through a FastAPI dashboard, multi-channel alerts, SIEM/STIX exports and Jira ticketing.

It is built for security engineers, red/purple teams and SOC leaders who need to continuously see what an attacker sees — with diff-based scheduling and risk-trend-over-time so they can answer the question every CISO asks: 'is our footprint actually shrinking?'

02Key Capabilities

03Architecture

A single orchestrator (easm_scanner.py) drives a 14-step, four-phase pipeline over self-contained modules that each return their own dataclass results. Assets and Findings are the shared data model, persisted through a SQLite-backed asset store; every phase enriches the same in-memory inventory. Go/ProjectDiscovery tools are optional accelerators, each fronted by a pure-Python fallback, and results fan out to a FastAPI/dashboard layer and to alerting, SIEM, STIX and Jira exporters.

04Project Structure

05Security Controls

06Technology Stack

Language

Python 3.10+ (pure Python, ASCII-safe for cross-platform)

Required deps

requests >= 2.31.0, dnspython >= 2.4.0

API/Dashboard

FastAPI >= 0.104.0 + Uvicorn >= 0.24.0 (optional, --serve mode)

Optional Go tools

ProjectDiscovery subfinder, httpx, dnsx, naabu, asnmap, tlsx, nuclei, gowitness

Optional cred-test libs

paramiko, mysql-connector-python, psycopg2-binary, pymongo

Storage

SQLite (asset store, scan history, trend metrics)

Testing

pytest — 93 deterministic, network-free tests

CI

GitHub Actions matrix on Python 3.10-3.13 (byte-compile + pytest + --help smoke test)

07Quick Start

$ pip install -r requirements.txt
$ python easm_scanner.py -d example.com --org "ACME Corp" -v
$ python easm_scanner.py -d example.com --html report.html --json scan.json
$ python easm_scanner.py -d example.com --threat-intel --sigma-out ./sigma
$ python easm_scanner.py -d example.com --org "ACME Corp" --discover-related --intel-expand
$ python easm_scanner.py -d example.com --serve --port 8888

08Compliance & Frameworks

09Integrations & Outputs