See What Attackers See
OpenEASD stands for Open External Attack Surface Discovery. Run it yourself against your own domain. No forms, no data collection, no waiting on a vendor to email you a report.
Clone the Repo
Pull the source from GitHub or the Docker image from the registry
Run Against Your Domain
Point it at your own infrastructure. External, non-intrusive reconnaissance only
Review Findings Locally
Results stay on your machine as CSV and PDF, ranked critical to informational
11 Attack Vectors, One Report
Findings across infrastructure, DNS, email, TLS, SSH, web layer, and known vulnerabilities. Ranked critical to info, delivered as PDF and CSV.
Subdomain Discovery
Passive and active enumeration of forgotten staging servers, dev environments, and shadow IT that attackers find first
Open Ports & Exposed Services
TCP scan across resolved IPs, flagging publicly accessible services, admin panels, and databases
DNS Security
DNSSEC, CAA records, wildcard DNS, zone transfer (AXFR) exposure, and lame delegation checks
Email Security
SPF, DKIM, DMARC, MTA-STS, TLS-RPT, and BIMI. Detects spoofing risk and TLS downgrade on inbound mail
TLS and SSL Configuration
Certificate expiry, weak or export ciphers, deprecated protocols, and HTTPS downgrade risks
SSH Configuration Audit
Weak key exchange and cipher algorithms, exposed SSH services, and deprecated protocol versions
Known Vulnerability Detection
CVE scanning via Nmap NSE vulners and 319 Nuclei network templates for protocol vulnerabilities
Domain Registration Health
Expiry tracking plus transfer, delete, and update lock status at your registrar via RDAP
Web Probing & URL Discovery
httpx live web probing across discovered hosts. Captures status codes, technologies, redirects, and reachable URLs
Web Vulnerability Scanning
Nuclei community templates run against discovered web URLs to identify known web application CVEs and misconfigurations
HTTP Security Headers, Cookies & CORS
CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, cookie flags (Secure, HttpOnly, SameSite), CORS misconfiguration, and server version disclosure
Plus scheduled scans (one-time, recurring, daily), Slack and Microsoft Teams alerts, real-time scan progress, and stop/cancel mid-scan. Follow the repo for release notes.
Trust by Inspection, Not Marketing
Black-box scanners ask you to trust the vendor. OpenEASD lets you read every line of code, pin a specific version, and run it on your own infrastructure.
No Data Collection
Findings never leave your network. No telemetry, no upload, no cloud dependency.
Auditable Code
Every check is MIT licensed and readable on GitHub. Fork it, extend it, audit it.
Scan on Your Schedule
Run weekly in CI, run before a release, run ad hoc. No quota, no throttle, no sign-up.
Ran OpenEASD and Found Issues?
Get a founder to walk through your findings, explain the risk, and help you prioritise fixes. Four hours of founder-led work via Security on Demand, fully refundable if we cannot help.
Prefer to run it yourself? Everything you need is on GitHub.