Introduction to XnoleX

Automated VAPT and advanced web reconnaissance platform for security professionals.

What is XnoleX?

XnoleX is an automated VAPT (Vulnerability Assessment and Penetration Testing) and web reconnaissance platform. It discovers your attack surface, correlates reconnaissance data, validates security findings, prioritizes risk, and drives remediation through a continuous workflow.

XnoleX integrates real security tools including subfinder, httpx, nuclei, and nmap to perform actual reconnaissance and vulnerability scanning against your targets.

Core Workflow

Every scan in XnoleX follows a five-stage intelligence workflow:

DISCOVER

Map the attack surface using subdomain enumeration, DNS resolution, and port scanning.

CORRELATE

Connect subdomains, endpoints, and services into a unified view.

VALIDATE

Identify meaningful security findings using nuclei template scanning.

PRIORITIZE

Classify findings by severity (critical, high, medium, low, info).

ACT

Generate reports with remediation guidance and correlated intelligence.

Key Concepts

Targets — Domains you want to scan. Each target is a domain name associated with your account.

Scans — An execution of a scan engine against a target. Scans produce subdomains, endpoints, and vulnerabilities.

Engines — The tool pipeline used for scanning. XnoleX supports three engines: full, subdomain, and nuclei.

Findings — Security issues discovered during a scan, classified by severity level.

Scheduled Scans — Recurring scans configured via cron expressions that run automatically.

Quick Start

1. Account Setup

XnoleX uses admin-controlled onboarding. Request access through the registration page. An administrator will review and approve your account. Once approved, you will receive an activation email with a link to set your password.

2. Create Your First Target

Navigate to Targets in the dashboard sidebar. Enter a domain name to add it as a scan target.

Supported target format

example.com
api.example.com
subdomain.example.org

Note

Targets are validated against a domain format regex. Localhost, internal IPs, and xnolex.com domains are blocked. Each target is scoped to your account.

3. Start Your First Scan

Navigate to Scans and click New Scan. Select your target and choose a scan engine:

full — Complete pipeline: subfinder, nmap, httpx, nuclei. Best for comprehensive assessments.

subdomain — Subdomain discovery and HTTP probing: subfinder, nmap, httpx.

nuclei — Vulnerability scanning on discovered endpoints: httpx, nuclei.

4. Understanding Your Results

Once a scan completes, open it to view detailed results organized into tabs:

Overview — Scan metadata, progress, and summary statistics.

Subdomains — Discovered subdomains with IP addresses.

Endpoints — HTTP endpoints with methods and status codes.

Vulnerabilities — Security findings with severity, description, and remediation.

Correlated Intel — Cross-referenced data: host-vulnerability mapping, attack surface analysis.

Info

Real-time scan progress is delivered via WebSocket. The progress bar and findings counts update live as the scan executes.