Platform Overview

XnoleX automates vulnerability assessment through a five-stage intelligence workflow powered by real security tools.

DISCOVER → CORRELATE → VALIDATE → PRIORITIZE → ACT

Every scan progresses through five stages. Each stage produces structured data that feeds the next, building a complete picture of your target's security posture.

DISCOVER

subfinder enumerates subdomains via passive DNS sources. nmap performs host discovery (-sn, --open, -T4). dig resolves each discovered subdomain to its IP address.

CORRELATE

httpx probes all discovered subdomains and the root domain for live HTTP services. Maps subdomains to endpoints with status codes, page titles, and technology fingerprints.

VALIDATE

nuclei runs vulnerability templates (CVEs, misconfigurations, exposures) against every discovered endpoint. Templates cover critical, high, medium, low, and informational severity levels.

PRIORITIZE

Results are classified by severity: critical, high, medium, low, info. Each finding is deduplicated by template ID and matched URL to avoid noise.

ACT

Reports are generated with severity breakdowns, remediation guidance, host-vulnerability mapping, and attack surface analysis (critical paths, auth endpoints, admin endpoints, API endpoints).

Data Entities

A scan produces four types of data entities, each stored in the database and returned in API responses:

Targets — Domains you want to scan. Each target is owned by the creating user and validated against a domain format regex.

Scans — An execution of a scan engine against a target. Tracks status (pending, running, completed, failed, cancelled), progress percentage, and finding counts by severity.

Subdomains — Discovered subdomains of the target domain. Each record includes the subdomain name, resolved IP address, and active status.

Endpoints — Live HTTP services discovered by httpx. Each record includes the full URL, HTTP method, and response status code.

Vulnerabilities — Security findings from nuclei. Each record includes name, severity, template ID, affected host, matched URL, description, and remediation guidance.

Scan Engines

XnoleX supports three scan engines, each running a different combination of tools:

full

The complete pipeline. Runs subfinder for subdomain enumeration, nmap for host discovery, merges results, probes all targets with httpx, then scans all endpoints with nuclei. Best for comprehensive security assessments.

Pipeline stages

subfinder   (5-25%)   Passive subdomain enumeration
nmap        (25-40%)  Host discovery and open port detection
merge       ───────── Deduplicate subdomains from both tools
httpx       (40-65%)  HTTP probing with status codes, titles, tech detection
nuclei      (65-92%)  Vulnerability template scanning
100%        ───────── Scan complete

subdomain

Subdomain discovery and HTTP service mapping without vulnerability scanning. Runs subfinder, nmap, merges results, then probes with httpx. Use this when you only need attack surface mapping.

Pipeline stages

subfinder   (5-50%)   Passive subdomain enumeration
nmap        (50-70%)  Host discovery and open port detection
merge       ───────── Deduplicate subdomains
httpx       (70-90%)  HTTP probing with status codes and tech detection
100%        ───────── Scan complete

nuclei

Direct vulnerability scanning on a single domain. Probes the root domain with httpx first, then runs nuclei against discovered endpoints. Use this when you already know the target and want fast vulnerability detection.

Pipeline stages

httpx       (10-35%)  Probe root domain for HTTP services
nuclei      (35-90%)  Vulnerability template scanning
100%        ───────── Scan complete

Note

All engines use the same underlying tools: subfinder v2.6.7, httpx-pd v1.6.10, nmap v7.99, and nuclei. The "full" engine is recommended for initial assessments. Use "subdomain" for attack surface mapping and "nuclei" for quick re-checks on known targets.

Infrastructure

The platform uses a worker-based architecture with a pending scan queue:

Workers: 3 concurrent scan workers process jobs from the queue.

Queue: Maximum 100 pending scans. Scans beyond this limit are rejected.

Global limit: Maximum 10 scans running concurrently across all users.

Stuck recovery: Scans running longer than 2 hours are automatically marked as failed.

Real-time updates: WebSocket connections deliver progress percentages and findings counts as scans execute.