Skip to content
SoonThe first tools are on the way

Break it before they do.

0xExploit Labs builds open-source offensive security tooling — recon, scanning and continuous exposure testing that runs wherever you do.

Follow the buildGet in touch

One toolkit, the whole recon-to-report pipeline

Subdomain enumerationPort scanningHTTP probingTemplate detectionSecret discoveryCVE trackingResult diffing

What we build

Three things the toolkit does well.

  • Map what you actually own

    Enumerate subdomains, resolve them, probe the live hosts and fingerprint the stack. The full external surface, in one pass.

  • Detect with rules, not guesses

    Detections are readable YAML you can fork and audit. Every finding traces back to a rule, not a vendor black box.

  • Wire it straight into CI

    One static binary per tool, structured JSON out of each. Drop it into a pipeline, a cron job, or a shell one-liner.

Why this toolkit

Everything you need to test what you expose.

  • Open source, always

    Every tool is MIT licensed and developed in public. Read the code before you point it at your infrastructure.

  • No agents to deploy

    Single static binaries that run from your machine or your CI runner. Nothing gets installed on the systems you scan.

  • Auditable detections

    Detection logic is plain YAML in a public repository, not a proprietary rule set you are asked to take on faith.

  • Built for pipelines

    Structured JSON out of every tool, so results feed dashboards, tickets and alerts without a layer of glue code.

  • Fast on large scopes

    Concurrency, rate limiting and timeouts are first-class flags, tuned for wide surfaces rather than single targets.

  • Community driven

    Rules, integrations and fixes come from the researchers who actually run these tools against real scopes.

MIT

Every tool. Every rule. In the open.

Star us on GitHub

The difference

What you give up with a closed scanner.

Closed scanners

  • Detection logic you are not allowed to read
  • Agents to deploy, patch and keep alive
  • Per-asset pricing that punishes discovery
  • Weeks between a CVE landing and a check shipping
  • PDF reports where machine-readable output should be
  • Results locked inside a dashboard you do not control
0xExploit labs
  • Every rule is plain YAML in a public repository
  • Static binaries, nothing installed on the targets
  • Free and unmetered, so scan the whole surface
  • New detections land while the exploit is still news
  • Structured JSON from every tool, pipe it anywhere
  • Runs on your laptop, your CI, or your own box

Coming soon

Built in the open, one tool at a time.

Nothing is released yet. Repositories go public as they reach a state worth running, and this page will list them the day they do. No waitlist, no early access — just watch the organisation.

  1. Discover

    Find the assets that exist before deciding what to test.

  2. Enrich

    Turn a raw host list into something with context attached.

  3. Detect

    Match known-bad conditions against what you found.

  4. Report

    Make the results diffable, routable and readable.

Watch on GitHubTalk to us

Community

Built in the open, by people who run it.

The rules, the integrations and most of the fixes come from researchers using these tools against real scopes. Issues and pull requests are the roadmap.

Public repositories
0
GitHub stars
0
MIT licensed
100%
Contribute on GitHub

FAQ

You have questions. We have answers.

Is 0xExploit Labs actually free?

Yes. Every tool is MIT licensed, the source is on GitHub, and commercial use is permitted. There is no paid tier holding features back.

Do I need to install anything on the systems I scan?

No. The tools are single static binaries that run from your machine or your CI runner. Nothing is deployed to the targets themselves.

What do I need before I run these?

Written authorisation for the scope you are testing. These are offensive tools, and they belong on assets you own or have been contracted to assess.

How do detections get written?

As plain YAML rules in a public repository. Anyone can read one, fork it, or contribute a new one, and every match traces back to a rule you can inspect.

Can I use this on a paid engagement?

Yes. The MIT licence permits commercial use, and building an assessment pipeline on open tooling is standard practice.

Where is the documentation?

Documentation ships with each tool as it is released, and every repository will carry a README with the full flag reference. Watch the GitHub organisation to catch the first ones.

The surface keeps changing. So should your recon.

Nothing is published yet. Watch the organisation on GitHub and the first releases will show up there before anywhere else.

Watch on GitHub

A week of one surface