Exposight

Invite-only · scheduled scans

Know every host you expose. Scan only what you own.

Exposight finds the subdomains, open ports and weak TLS on domains you have proven you control, and tells you when something changes.

example.com Sign in to verify & scan
  • CT logs: crt.sh + CertSpotter
  • 16 TCP ports · HTTP/HTTPS 80, 443
  • DNS TXT ownership check
Scan of example.com Example
  1. scanexample.com, scheduled run
  2. discovercrt.sh + CertSpotter: 6 names
  3. resolvedb.example.com A 198.51.100.12
  4. probehttps://api.example.com 200
  5. portsdb.example.com 3306/tcp open (mysql)
  6. tlsstaging.example.com certificate expired
  7. scoreCRITICAL db.example.com Confirmed Exposed Database Service

Attack surface

From apex domain to exposed subdomains

Discovery reads Certificate Transparency logs for names under your apex domain and resolves their A and AAAA records. Each host is then probed, port-scanned, inspected and scored.

Topology Example
example.com
  • www.example.com
  • api.example.com
  • staging.example.com
  • mail.example.com
  • db.example.com 3306 open
Inventory, ordered by severity Example
HostAddressOpen portsTop findingSeverity
db.example.com198.51.100.123306Confirmed Exposed Database ServiceCritical
staging.example.com198.51.100.722, 443Expired TLS CertificateHigh
mail.example.com198.51.100.3025Cleartext Protocol ServiceMedium
api.example.com192.0.2.24443Certificate Expiring Soon (<=30 Days)Medium
www.example.com192.0.2.1080, 443Missing Content-Security-Policy (CSP)Low

How it works

From domain to alert in four steps

  1. Step 01

    Add a domain

    Add the apex domain you want to watch to your organization. Owners and admins manage the domain list; viewers can read it.

  2. Step 02

    Prove you own it

    Active scans run only on domains you have verified with a DNS TXT record at _exposight-challenge.<domain>. A time-limited operator override exists for exceptional cases.

  3. Step 03

    Scan on demand or on a schedule

    Each scan runs discovery, probing, a port scan, TLS and header inspection, then scoring. Schedules run from every 6 hours to every 30 days.

  4. Step 04

    Get told what changed

    Each scan is compared with the previous one. New subdomains, newly open ports and certificate problems are emailed to up to 5 recipients.

Scan stages

What a scan checks

  1. 01

    Passive subdomain discovery

    Queries Certificate Transparency logs through crt.sh and CertSpotter, and resolves A (IPv4) and AAAA (IPv6) records without touching target hosts directly.

    discovery.py, resolver.py
  2. 02

    Active host probing

    Checks HTTP and HTTPS on ports 80 and 443. Private and loopback addresses are refused, and responses are capped at 64 KB.

    prober.py, scan_common.py
  3. 03

    Lightweight TCP port scan

    Connects to sixteen common service ports to classify them as open or closed and to read non-intrusive service greetings.

    portscan.py
  4. 04

    TLS and header inspection

    Evaluates certificate validity, expiry and deprecated TLS, and checks security headers such as HSTS, CSP, X-Frame-Options and X-Content-Type-Options.

    tls_inspect.py, headers_inspect.py
  5. 05

    Risk scoring

    Groups findings into severity tiers from Critical to Info, ordered by tier, score impact, then host.

    scoring.py

Features

Built for the people who answer for the perimeter

Change detection

Consecutive scans are compared to find new subdomains, newly open ports and certificate problems: expired, untrusted, self-signed or hostname mismatch.

Scheduled scans

Pick an interval from 6 to 720 hours. Start times get random jitter so scans do not all run at once.

Email alerts

Alerts are written to an outbox in the database and sent by the worker, with retries, to up to 5 recipients per domain.

Audit log

Append-only audit log: a database trigger blocks updates, deletes and truncates from the application.

Tenant isolation

Every query is scoped to the organization, and another tenant's ids return 404.

Roles and invites

Owner, admin and viewer roles. Organizations are created by allow-listed accounts; everyone else joins by invite.

Ownership verification

Scan only what you own

Before any active scan, you publish a TXT record with a token from the dashboard. Exposight looks it up through public resolvers, never the server's own, and keeps scanning only while the record checks out.

Probing and port scanning touch real hosts. Tying them to DNS control keeps Exposight pointed at your own infrastructure, not someone else's.

DNS TXT verification record _exposight-challenge.example.com IN TXT "exposight-verify=<your-token>"

Watch the domains you own.

Sign in to see your domain inventory, set scan schedules and work through findings.

Sign in to the dashboard