Is the tooling actually free?

It will be. No tool has been released yet. Each one will ship under the MIT licence with its source on GitHub, so commercial use is permitted and no paid tier holds features back. Running a scan will still cost whatever the machine and the bandwidth cost - that part is yours, not ours.

Do I need to install anything on the systems I scan?

No. A tool runs from your own machine or your CI runner. Nothing is deployed to the systems you are testing.

Is this one product or several?

Nothing has shipped yet. When a tool does, it gets its own repository, its own README and its own releases.

What do I need before I run these?

Written authorisation for the scope you are testing. These are offensive tools, and they belong on assets you own or have been contracted to assess.

Can I use this on a paid engagement?

Yes. The MIT licence permits commercial use, and building an assessment pipeline on open tools is standard practice.

Where is the documentation?

Documentation ships with each tool as it is released, and every repository will carry a README with the full flag reference. Watch the GitHub organisation to catch the first ones.

SoonThe first tools are on the way

Break it before they do.

0xExploit Labs builds open-source tools for the people who test infrastructure for a living.

Follow the build Get in touch

The work these tools are built for

Asset discoverySubdomain enumerationDNS resolutionHTTP probingService fingerprintingExposure testingAttack surface monitoring

How we build

Three things every tool has to be.

Built by practitioners
Written by people who run this work for a living, and used the way it ships: from a terminal, against a real, authorised scope.
Readable end to end
MIT licensed, and public from the moment it ships. Whatever a tool concludes about your infrastructure, the code that reached that conclusion is there to read.
Made to be scripted
Built for a terminal, a pipeline and a scheduled job before anything else. If a result cannot be piped into the next thing, it is not finished.

How this is built

What every repository here commits to.

Open source, always
Every tool is MIT licensed and developed in public. Read the code before you point it at your infrastructure.
No agents to deploy
Nothing is installed on the systems you test. A tool runs from your machine or your CI runner and leaves nothing behind on the other end.
Nothing you cannot inspect
A finding is only worth acting on if you can see how it was reached. The code that produced it is public, so the answer is never that the tool said so.
Terminal first
Designed to be run by a script and read by another program, not to be driven through a dashboard someone else hosts.
Built for real scopes
The target is a whole external surface rather than one host, and the work is planned around that from the start.
Built in the open
Repositories go public as they reach a state worth running. Issues and pull requests are the roadmap, and there is no private branch where the real work happens.

MIT License

Copyright (c) 0xExploit Labs

Permission is hereby granted, free of
charge, to any person obtaining a copy
of this software and associated
documentation files (the “Software”), to
deal in the Software without
restriction, including without
limitation the rights to use, copy,
modify, merge, publish, distribute,
sublicense, and/or sell copies of the
Software, and to permit persons to whom
the Software is furnished to do so,
subject to the following conditions:

The above copyright notice and this
permission notice shall be included in
all copies or substantial portions of
the Software.

THE SOFTWARE IS PROVIDED “AS IS”,
WITHOUT WARRANTY OF ANY KIND, EXPRESS
OR IMPLIED, INCLUDING BUT NOT LIMITED
TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND
NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE
FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF
CONTRACT, TORT OR OTHERWISE, ARISING
FROM, OUT OF OR IN CONNECTION WITH THE
SOFTWARE OR THE USE OR OTHER DEALINGS
IN THE SOFTWARE.

MIT License

Copyright (c) 0xExploit Labs

Permission is hereby granted, free of
charge, to any person obtaining a copy
of this software and associated
documentation files (the “Software”), to
deal in the Software without
restriction, including without
limitation the rights to use, copy,
modify, merge, publish, distribute,
sublicense, and/or sell copies of the
Software, and to permit persons to whom
the Software is furnished to do so,
subject to the following conditions:

The above copyright notice and this
permission notice shall be included in
all copies or substantial portions of
the Software.

THE SOFTWARE IS PROVIDED “AS IS”,
WITHOUT WARRANTY OF ANY KIND, EXPRESS
OR IMPLIED, INCLUDING BUT NOT LIMITED
TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND
NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE
FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF
CONTRACT, TORT OR OTHERWISE, ARISING
FROM, OUT OF OR IN CONNECTION WITH THE
SOFTWARE OR THE USE OR OTHER DEALINGS
IN THE SOFTWARE.

MIT

Every tool, in the open, from the moment it ships.

Star us on GitHub

The difference

What you give up with a closed scanner.

Closed scanners

Detection logic you are not allowed to read
Agents to deploy, patch and keep alive
Per-asset pricing that punishes discovery
One vendor's release schedule, whatever you need next
PDF reports where machine-readable output should be
Results locked inside a dashboard you do not control

0xExploit labs

Every line of it is public and MIT licensed
Nothing installed on the systems you test
The tooling costs nothing; the compute is yours to run
No release calendar to wait on; a tool ships when it is ready
Output meant to be read by the next program in the chain
Runs on your laptop, your CI, or your own box

Coming soon

Built in the open, one tool at a time.

Nothing is released yet. Repositories go public as they reach a state worth running, and this page will list them the day they do. No waitlist, no early access. Just watch the organisation.

Public from the moment it ships
First repositories coming. Watch the organisation on GitHub.
MIT, every time
Every tool ships under the MIT licence. No paid tier, no source-available carve-out.
Shaped by issues and pull requests
Once something ships, issues and pull requests decide what's next.
One tool at a time
Each tool ships on its own timeline.

Watch on GitHub Talk to us

Community

Built in the open, from the moment it ships.

Repositories are public as they reach a state worth running, and issues and pull requests are the roadmap once they are. There is no private branch where the real work happens.

Public repositories: 1
GitHub stars: 1
MIT licensed: 100%

Contribute on GitHub

FAQ

You have questions. We have answers.

The surface keeps changing. So should your recon.

Nothing is published yet. Watch the organisation on GitHub and the first releases will show up there before anywhere else.

Watch on GitHub

A week of one surface

+ci.example.com:8080new host

~api.example.comcert renewed

-admin.example.com:22resolved

+beta.example.comnew host

~www.example.comstack changed

+vpn.example.com:443new service

-old.example.comretired

~stage.example.comnow behind a WAF

Break it before they do.

Three things every tool has to be.

Built by practitioners

Readable end to end

Made to be scripted

What every repository here commits to.

Open source, always

No agents to deploy

Nothing you cannot inspect

Terminal first

Built for real scopes

Built in the open