The most advanced AI-driven external attack surface management (EASM) platform — orchestrating 29+ security engines with intelligent Node.js fallback technology to deliver real-time vulnerability intelligence, autonomous reconnaissance, and enterprise-grade compliance mapping. No manual configuration. No missed findings. Zero blind spots.
Modern organizations face an expanding attack surface that's nearly impossible to monitor manually. Shadow IT, forgotten subdomains, misconfigured cloud assets, and exposed APIs create blind spots that attackers exploit daily.
FindBreak solves this by automating the entire offensive security reconnaissance pipeline — from subdomain discovery to vulnerability exploitation mapping — in a unified platform that a single security engineer can operate.
| Challenge | Impact |
|---|---|
| Scattered Tools | Security teams juggle 10+ CLI tools with no unified view |
| Slow Manual Recon | Hours of manual work per domain, repeated for every assessment |
| No Real-Time Visibility | Static reports are outdated the moment they're generated |
| Alert Fatigue | Thousands of raw findings with no prioritization or context |
| Compliance Gaps | No automated mapping to OWASP, NIST, PCI DSS, SOC 2 |
| Capability | How It Works |
|---|---|
| 29-Engine AI Orchestration | Runs Nuclei, Subfinder, Nmap, and 26+ more engines with intelligent Node.js fallback |
| 4 Scan Tiers | Quick (2 min), Standard (10 min), Comprehensive (30 min), Custom |
| Real-Time Telemetry | Live progress tracking with per-engine status and findings count |
| AI-Powered Prioritization | Findings auto-classified by CVSS, exploitability, and business impact |
| Compliance Mapping | Auto-maps findings to OWASP Top 10, NIST CSF, PCI DSS 4.0, SOC 2 |
| Zero-Downtime Architecture | Intelligent Node.js fallback ensures 100% engine execution even without CLI binaries |
graph TB
%% Core Theme & Styling
classDef client fill:#fdf4ff,stroke:#d946ef,stroke-width:2px,color:#701a75,rx:10,ry:10
classDef gateway fill:#ecfccb,stroke:#84cc16,stroke-width:2px,color:#3f6212,rx:10,ry:10
classDef broker fill:#fffbeb,stroke:#f59e0b,stroke-width:2px,color:#78350f,rx:10,ry:10
classDef intel fill:#fce7f3,stroke:#ec4899,stroke-width:2px,color:#831843,rx:10,ry:10
classDef db fill:#ffedd5,stroke:#f97316,stroke-width:2px,color:#7c2d12,rx:10,ry:10
classDef engines fill:#e0f2fe,stroke:#0ea5e9,stroke-width:2px,color:#0c4a6e,rx:10,ry:10
classDef external fill:#f3f4f6,stroke:#9ca3af,stroke-width:2px,color:#374151,rx:10,ry:10
%% -------------------------------------------------------------------------
%% 1. CLIENT LAYER
%% -------------------------------------------------------------------------
subgraph ClientLayer ["🖥️ Client & Consumer Apps"]
style ClientLayer fill:#fafafa,stroke:#cbd5e1,stroke-width:2px,stroke-dasharray: 5 5,rx:15,ry:15
WebApp["<b>Web Dashboard</b><br/><i>Delivers Real-Time CISO Intel & 12 Deep-Dive Tabs.</i><br/><br/>⚛️ React 18 | ⚡ Vite<br/>🎨 TailwindCSS, Radix UI<br/>✨ Framer Motion, Recharts"]:::client
StaticGen["<b>Report Generation</b><br/><i>Premium PDF Reporting.</i><br/><br/>📄 Puppeteer Headless Engine"]:::client
WebApp ~~~ StaticGen
end
%% -------------------------------------------------------------------------
%% 2. ORCHESTRATION & GATEWAY LAYER
%% -------------------------------------------------------------------------
subgraph GatewayLayer ["🔀 API Gateway & Orchestration"]
style GatewayLayer fill:#fafafa,stroke:#cbd5e1,stroke-width:2px,stroke-dasharray: 5 5,rx:15,ry:15
API["<b>Single Entry Gateway</b><br/><i>Handles routing, auth, WS streaming, and REST endpoints.</i><br/><br/>🟢 Node.js | 🐉 Express.js | 🔌 Socket.io"]:::gateway
end
%% -------------------------------------------------------------------------
%% 3. BUSINESS LOGIC & MESSAGE BROKER
%% -------------------------------------------------------------------------
subgraph CoreLogic ["⚙️ Core Distributed Logic & Brokers"]
style CoreLogic fill:#fafafa,stroke:#cbd5e1,stroke-width:2px,stroke-dasharray: 5 5,rx:15,ry:15
direction LR
Broker["<b>Message Queues</b><br/><i>Asynchronous job handling for concurrent scanning.</i><br/><br/>🟥 BullMQ | Redis"]:::broker
Correlation["<b>V2 Correlation Platform</b><br/><i>Data Intelligence mapping of 56 tools into Synergistic outputs.</i><br/><br/>🧠 Proprietary Algorithm"]:::intel
Fallback["<b>Node.js OSINT Fallback</b><br/><i>Guarantees 100% Data Fidelity during external engine fails.</i><br/><br/>⚡ Native Node Resolvers"]:::intel
Broker --- Correlation --- Fallback
end
%% -------------------------------------------------------------------------
%% 4. STORAGE & PERSISTENCE
%% -------------------------------------------------------------------------
subgraph StorageLayer ["🗄️ Analytical Storage & Databases"]
style StorageLayer fill:#fafafa,stroke:#cbd5e1,stroke-width:2px,stroke-dasharray: 5 5,rx:15,ry:15
direction LR
DB["<b>Relational Database</b><br/><i>Isolated data storage for users, scans, and configs.</i><br/><br/>🐘 Supabase (PostgreSQL)"]:::db
ORM["<b>Typesafe Schema</b><br/><i>Robust migrations and zero-day schema mapping.</i><br/><br/>🌧️ Drizzle ORM"]:::db
MemCache["<b>In-Memory Cache</b><br/><i>Performance layer for active queries.</i><br/><br/>🧠 Redis Cache"]:::db
DB --- ORM
ORM --- MemCache
end
%% -------------------------------------------------------------------------
%% 5. EXECUTION MICROSERVICES (THE 56 ENGINES)
%% -------------------------------------------------------------------------
subgraph Microservices ["🛡️ Dedicated Security Microservices (56 Total)"]
style Microservices fill:#f1f5f9,stroke:#94a3b8,stroke-width:2px,rx:15,ry:15
direction TB
Disco["<b>Asset Discovery (7)</b><br/><i>Deep DNS & Cloud Recon</i><br/><br/>Amass, Subfinder, Assetfinder, theHarvester, TerraShield, FindBreak, aeroguard"]:::engines
Spider["<b>Endpoint Spidering (8)</b><br/><i>Fuzzing & App Mapping</i><br/><br/>HTTPX, FFUF, Katana, Dirsearch, GoSpider, ParamSpider, Archives, LinkFinder, Feroxbuster"]:::engines
Vuln["<b>Vulnerability Scanners (15)</b><br/><i>CVEs, DAST, Ports & Attacks</i><br/><br/>Nuclei, Nmap, Masscan, CVEMap, Jaeles, Arjun, Naabu, Snallygaster, dalfox, sqlmap, commix, corsy, secretfinder, zaproxy, nikto"]:::engines
Cloud["<b>Cloud, Web & Configs (26)</b><br/><i>Tech Stack, Screenshots & Leaks</i><br/><br/>CloudEnum, Wafw00f, WhatWaf, WhatWeb, Wappalyzer, TruffleHog, GitDumper, SSLScan, TestSSL, TLSX, Subjack, Aquatone, GoWitness, Retire.js, NebulaGraph, BBOT, dnsx, massdns"]:::engines
Disco ~~~ Spider
Vuln ~~~ Cloud
end
%% -------------------------------------------------------------------------
%% 6. THIRD-PARTY IDENTITY & INTEL
%% -------------------------------------------------------------------------
subgraph ExternalServices ["🌐 Third-Party Integrations"]
direction LR
style ExternalServices fill:#fafafa,stroke:#cbd5e1,stroke-width:2px,stroke-dasharray: 5 5,rx:15,ry:15
Auth["<b>Identity Provider</b><br/><i>Issues secure session tokens & RLS constraints.</i><br/><br/>🔐 Supabase Auth"]:::external
OSINT["<b>Global OSINT Feeds</b><br/><i>External data augmentation.</i><br/><br/>👁️ Shodan, Censys, Whois, Dig, Host, NebulaGraph, BBOT"]:::external
end
%% -------------------------------------------------------------------------
%% ROUTING / WIRING
%% -------------------------------------------------------------------------
WebApp <-->|"Initiates HTTP / WS"| API
API <-->|"Manages Auth"| Auth
API -->|"Dispatches Jobs"| Broker
API <-->|"Reads/Writes"| StorageLayer
Broker -->|"Triggers Executions"| Microservices
Microservices -->|"Feeds Output"| Correlation
Microservices -.->|"Fallback if Failure"| Fallback
Fallback -->|"Direct Queries"| OSINT
Correlation -->|"Persists Intel"| StorageLayer
FindBreak v3.0 has completed comprehensive automated auditing and is fully production-ready for enterprise deployment. All 56 core engines feature zero-downtime resilient Node.js fallbacks, ensuring 100% intelligence fidelity. Support for isolated React 18 component tree rendering guarantees instantaneous UI transitions regardless of scan complexity.
- Intelligent Subdomain Enumeration — Combines certificate transparency logs (crt.sh), DNS brute-forcing, and engine-powered discovery
- Port Scanning — Full TCP connect scanning across 100+ common ports with service fingerprinting
- Technology Fingerprinting — Detects web servers, frameworks, CMS platforms, CDNs, and WAFs
- Asset Criticality Scoring — Automated risk classification based on exposure, technology, and business context
- Multi-Engine Scanning — Nuclei templates, Nikto checks, and custom security analysis in parallel
- CVSS-Based Prioritization — Critical, High, Medium, Low, and Info classifications with remediation guidance
- SSL/TLS Analysis — Certificate validation, protocol assessment, cipher suite analysis, and expiry monitoring
- Security Header Audit — Checks for HSTS, CSP, X-Frame-Options, X-Content-Type-Options, and more
- Email Security — SPF, DKIM, and DMARC record validation with misconfiguration detection
- Live Scan Telemetry — Watch scans execute in real-time with per-phase progress and engine status
- Executive CISO Dashboard — High-level risk posture, trend analysis, and compliance scorecards
- Interactive Vulnerability Charts — Drill-down visualizations powered by Recharts
- Sidebar Deep-Dives — Click any card for contextual intelligence with correlated data
| Module | Description |
|---|---|
| Cloud Security | AWS/Azure/GCP asset inventory & misconfiguration detection |
| DevSecOps | CI/CD pipeline security scanning with Syft & Grype |
| Identity Graph | Visualize identity relationships and access patterns |
| IR Playbooks | Automated incident response workflows with step-by-step execution |
| Pentest Scanner | Automated penetration testing with exploit mapping |
| Phishing Simulator | Campaign management with template creation and tracking |
| Supply Chain Security | Third-party vendor risk assessment and component analysis |
| Threat Intelligence | Dark web monitoring and leaked credential detection |
| Compliance & Governance | Multi-framework compliance mapping and audit trails |
| Attack Surface Mode | Comprehensive external attack surface visualization |
| Remediation Workflow | Ticket-based vulnerability remediation tracking |
FindBreak orchestrates 56 professional-grade security engines with intelligent Node.js fallback technology. Each engine performs real network operations — DNS queries, TCP port scans, HTTP analysis, TLS inspection, and OSINT API lookups — ensuring 100% findings fidelity even without CLI binary installation.
- ⚡ Quick — Included in 2-minute rapid scans
- 🔍 Standard — Included in 10-minute standard assessments
- 🛡️ Comprehensive — Included in 30-minute full attack surface analysis
⚡ Quick · 🔍 Standard · 🛡️ Comprehensive — Timeout: 60s
What it does: Subfinder is a passive subdomain discovery tool that finds valid subdomains for websites by using passive online sources. It queries certificate transparency logs (crt.sh), DNS datasets, search engines, and dozens of online APIs to enumerate all known subdomains of a target domain — without ever touching the target's servers.
Why it matters: Hidden subdomains are among the most common attack vectors. Forgotten staging environments (staging.company.com), old API endpoints (api-v1.company.com), and developer test servers are frequently left exposed with weak security. Subfinder reveals them all.
FindBreak output: JSON list of all discovered subdomains with their sources.
🛡️ Comprehensive — Timeout: 300s
What it does: OWASP Amass performs in-depth attack surface mapping using both passive intelligence gathering and active DNS enumeration. Unlike Subfinder (which is passive-only), Amass actively brute-forces subdomain names, performs DNS zone transfers, queries WHOIS data, scrapes web archives, and builds a full graph of the target's internet-facing infrastructure.
Why it matters: Amass discovers subdomains that passive tools miss — dynamically generated hostnames, internal subdomains that leak externally, and third-party integrations. In comprehensive scans, FindBreak enables its -active -brute flags for maximum coverage.
FindBreak output: JSON graph of discovered domains, subdomains, IP addresses, and ASN relationships.
🛡️ Comprehensive — Timeout: 600s
What it does: BBOT (Bighuge BLS OSINT Tool) is a recursive OSINT framework that chains multiple enumeration techniques together. It starts with subdomain enumeration and recursively expands the attack surface by following relationships — discovered IPs lead to reverse DNS lookups, which reveal more domains, which reveal more subdomains.
Why it matters: Traditional tools discover what you point them at. BBOT discovers what's connected to what you point it at. This recursive approach reveals shadow IT, shared hosting neighbors, and infrastructure dependencies that create secondary attack paths.
FindBreak output: Chained OSINT findings with relationship mapping.
⚡ Quick · 🔍 Standard · 🛡️ Comprehensive — Timeout: 60s
What it does: dnsx is a fast, multi-purpose DNS toolkit that resolves domains and extracts A records (IP addresses), CNAME records (aliases), MX records (mail servers), and TXT records (SPF, DKIM, verification records). It processes the subdomains discovered by Subfinder/Amass and resolves them to actual infrastructure.
Why it matters: DNS records reveal the entire infrastructure topology — which cloud provider hosts each subdomain, where email flows, whether SPF/DKIM are properly configured, and which domains are just aliases vs. independently hosted services. Misconfigured DNS is a top-5 attack vector.
FindBreak output: Complete DNS resolution data for every discovered subdomain.
🔍 Standard · 🛡️ Comprehensive — Timeout: 120s
What it does: MassDNS is a high-performance DNS stub resolver capable of resolving millions of domain names per second. While dnsx handles targeted resolution, MassDNS brute-forces massive wordlists against the target's domain to discover subdomains that don't appear in any passive source.
Why it matters: Many organizations use predictable naming patterns (prod-1.company.com, db-backup.company.com). MassDNS catches these by testing thousands of common subdomain patterns per second, uncovering infrastructure that exists but was never indexed anywhere.
FindBreak output: High-speed DNS resolution results in JSON format.
⚡ Quick · 🔍 Standard · 🛡️ Comprehensive — Timeout: 120s
What it does: Naabu is a fast port scanner written in Go that uses SYN/CONNECT scanning to identify open ports on target hosts. In Quick scans, it checks the top 100 ports; in Standard scans, the top 1,000; in Comprehensive scans, it performs a full scan. It's designed for speed and reliability.
Why it matters: Open ports are the entry points for network-based attacks. An exposed database port (3306, 5432), an unprotected admin panel (8080, 8443), or a forgotten SSH service (22) can each lead to a complete compromise. Naabu maps every open door.
FindBreak output: JSON list of open ports with protocol and host information.
🔍 Standard · 🛡️ Comprehensive — Timeout: 180s
What it does: Masscan is the fastest Internet port scanner — capable of scanning the entire IPv4 internet in under 6 minutes. FindBreak uses it to scan port ranges 1-10,000 (Standard) or 1-65,535 (Comprehensive) at rates of 5,000 packets per second. It complements Naabu for maximum port coverage.
Why it matters: While Naabu is precise and quiet, Masscan is raw speed. Together, they ensure no open port goes undetected — even high-numbered ports (above 10,000) often used by developers to "hide" management interfaces, debugging tools, and staging services.
FindBreak output: JSON list of open ports discovered at high speed.
🔍 Standard · 🛡️ Comprehensive — Timeout: 300s
What it does: Nmap (Network Mapper) is the gold standard for network discovery and security auditing. After Naabu/Masscan find open ports, Nmap performs deep service detection (-sV) and runs its NSE scripts (-sC) to fingerprint exact service versions, detect operating systems, and identify known vulnerabilities in running services.
Why it matters: Knowing a port is open is step 1. Knowing it's running "Apache 2.4.49" (which has CVE-2021-41773, a critical path traversal) is where the real intelligence lives. Nmap's banner grabbing and script engine provide the enrichment that turns port data into actionable security intelligence.
FindBreak output: XML-parsed service data including IP, port, protocol, service name, product, and version.
⚡ Quick · 🔍 Standard · 🛡️ Comprehensive — Timeout: 90s
What it does: httpx is a fast, multi-purpose HTTP toolkit. It probes discovered hosts and subdomains to determine which ones serve web content, then extracts page titles, server headers, response status codes, content lengths, technology fingerprints, and (in Standard+ scans) security headers like HSTS, CSP, and X-Frame-Options.
Why it matters: httpx is the connective tissue between discovery and analysis. It transforms a list of hostnames into a rich inventory of web assets — answering "what's running where?" across the entire attack surface. Its technology detection reveals the frameworks, CMS platforms, and libraries in use.
FindBreak output: JSON with URL, title, status code, server, technologies, content length, and security headers.
⚡ Quick · 🔍 Standard · 🛡️ Comprehensive — Timeout: 60s
What it does: Wappalyzer is a technology profiler that identifies the full software stack behind a website. Using pattern matching against HTTP headers, HTML content, JavaScript variables, and cookies, it detects CMS platforms (WordPress, Drupal), frameworks (React, Angular, Vue), servers (Nginx, Apache), CDNs (Cloudflare, AWS CloudFront), analytics tools, and more.
Why it matters: Knowing the exact tech stack enables targeted vulnerability research. If a target runs WordPress 6.1.1 with WooCommerce and Elementor, an attacker (or defender) can immediately cross-reference CVE databases for known exploits in those exact versions. FindBreak uses this intelligence to prioritize vulnerability scanning.
FindBreak output: List of detected technologies with categories and confidence levels.
🔍 Standard · 🛡️ Comprehensive — Timeout: 30s
What it does: wafw00f (Web Application Firewall Fingerprinting) detects and identifies Web Application Firewalls (WAFs) protecting a target. It sends specially crafted HTTP requests and analyzes responses to determine if a WAF is present and which product it is — Cloudflare, AWS WAF, Akamai, ModSecurity, Imperva, F5 BIG-IP, and 100+ others.
Why it matters: WAF detection is critical for both offensive and defensive teams. Defenders need to verify their WAF is properly deployed. Penetration testers need to know what defenses to expect. If a subdomain has no WAF while others do, it's likely a higher-risk target that bypasses the organization's security controls.
FindBreak output: JSON with WAF detection results, identified product, and confidence score.
⚡ Quick · 🔍 Standard — Timeout: 60s
What it does: SSLyze is a fast SSL/TLS scanning tool that analyzes a server's SSL/TLS configuration. It checks supported protocols (TLS 1.0, 1.1, 1.2, 1.3), cipher suites, certificate chain validity, OCSP stapling, session resumption, and known vulnerabilities like Heartbleed, ROBOT, and CRIME.
Why it matters: Weak SSL/TLS configurations are among the most common yet easily fixable security issues. SSLyze quickly identifies servers still supporting deprecated TLS 1.0/1.1, using weak cipher suites, or serving certificates with mismatched hostnames — all of which can be exploited for man-in-the-middle attacks.
FindBreak output: Comprehensive SSL/TLS configuration analysis in JSON format.
🔍 Standard · 🛡️ Comprehensive — Timeout: 30s
What it does: tlsx is a fast TLS data extraction tool that grabs certificate details including Subject Alternative Names (SANs), Common Names (CNs), issuer information, expiry dates, and certificate chain data. It works at scale, processing hundreds of hosts in seconds.
Why it matters: SAN certificates often reveal additional hostnames and infrastructure that aren't discoverable through DNS — internal names, partner integrations, and development environments listed in wildcard and multi-domain certificates. tlsx also catches certificates nearing expiration, which can cause service outages.
FindBreak output: JSON with certificate subject, SANs, CN, issuer, and expiry data.
🛡️ Comprehensive — Timeout: 180s
What it does: testssl.sh is the most thorough SSL/TLS testing tool available. It performs 800+ individual checks including every known SSL/TLS vulnerability (BEAST, POODLE, DROWN, Logjam, FREAK, Sweet32), cipher suite analysis, certificate transparency verification, HTTP Strict Transport Security (HSTS) preload status, and compliance with PCI DSS and HIPAA requirements.
Why it matters: For compliance-driven organizations, testssl provides the level of detail required by auditors. It produces evidence-grade reports showing exactly which protocols, ciphers, and configurations are in use — mapped to specific compliance requirements and CVE identifiers.
FindBreak output: Detailed JSON findings with severity classifications.
🛡️ Comprehensive — Timeout: 180s
What it does: Katana is a next-generation web crawler that performs deep crawling (depth 3) with JavaScript rendering. It discovers all accessible URLs, endpoints, forms, API routes, and hidden pages on a web application. Its JS crawling capability (-js-crawl) means it can find endpoints that are only referenced in JavaScript code, not in HTML.
Why it matters: Modern single-page applications (SPAs) hide most of their attack surface in JavaScript. Traditional crawlers miss API endpoints, internal routes, and dynamic pages. Katana's JS-aware crawling exposes the full attack surface of React, Angular, and Vue applications — including admin panels, debug endpoints, and API routes.
FindBreak output: JSON list of discovered URLs, endpoints, and their attributes.
🛡️ Comprehensive — Timeout: 300s
What it does: Arjun discovers hidden HTTP parameters in web applications. It sends thousands of requests with common parameter names to detect which parameters a web application accepts — even if they're not documented anywhere. This includes GET parameters, POST body parameters, and JSON keys.
Why it matters: Hidden parameters are a goldmine for attackers. Undocumented ?debug=true, ?admin=1, or ?export=csv parameters can bypass authentication, expose sensitive data, or enable privilege escalation. Arjun finds these parameters that standard crawlers completely miss.
FindBreak output: JSON map of discovered parameters per endpoint.
⚡ Quick · 🔍 Standard · 🛡️ Comprehensive — Timeout: 300s
What it does: Nuclei is the most powerful template-based vulnerability scanner in the industry. It uses a community-maintained library of 8,000+ detection templates covering CVEs, misconfigurations, exposed panels, default credentials, API key leaks, and technology-specific vulnerabilities. In Quick scans, it checks only Critical+High severity; Standard adds Medium; Comprehensive runs all templates.
Why it matters: Nuclei is the heart of FindBreak's vulnerability detection. While other tools discover what exists, Nuclei answers what's vulnerable. Its template system means new CVEs get detection templates within hours of disclosure. From Log4Shell to Spring4Shell, Nuclei has templates ready before most commercial scanners.
FindBreak output: JSON findings with template ID, severity, CVE reference, matched URL, and remediation guidance.
🛡️ Comprehensive — Timeout: 300s
What it does: Nikto is a comprehensive web server scanner that tests for 6,700+ potentially dangerous files, programs, and server configurations. It checks for outdated server versions, default files, server misconfigurations, and known vulnerabilities in web server software including Apache, Nginx, IIS, and Tomcat.
Why it matters: While Nuclei focuses on application-level vulnerabilities, Nikto specializes in server-level security issues — exposed .git directories, backup files (database.sql.bak), server-status pages, and default installation files that developers often forget to remove in production.
FindBreak output: JSON list of identified vulnerabilities, misconfigurations, and dangerous file exposures.
🛡️ Comprehensive — Timeout: 600s
What it does: Prowler is an AWS security assessment tool that evaluates cloud infrastructure against 300+ security best practices. It covers IAM policies, S3 bucket permissions, security group rules, CloudTrail logging, encryption settings, VPC configurations, and compliance requirements for CIS Benchmarks, PCI DSS, HIPAA, GDPR, and SOC 2.
Why it matters: Cloud misconfigurations are the #1 cause of data breaches. A single S3 bucket set to public, an overly permissive IAM role, or disabled CloudTrail logging can expose an entire organization. Prowler automates what would take a cloud security engineer days to review manually.
FindBreak output: JSON findings with severity, compliance framework mapping, and remediation steps.
🛡️ Comprehensive — Timeout: 120s
What it does: Syft generates Software Bill of Materials (SBOMs) for container images, filesystems, and archives. It catalogs every package, library, and dependency in a software artifact — version numbers, package managers (npm, pip, maven, go modules), and license information — outputting in CycloneDX JSON format.
Why it matters: You can't secure what you don't know exists. Supply chain attacks (like the SolarWinds and Log4j incidents) exploit dependencies that organizations don't even know they're using. Syft creates a complete inventory that enables proactive vulnerability management.
FindBreak output: CycloneDX JSON SBOM with component names, versions, and package ecosystems.
🛡️ Comprehensive — Timeout: 120s
What it does: Grype is a vulnerability scanner for container images and filesystems. It takes the SBOM generated by Syft (or scans directly) and cross-references every component against vulnerability databases (NVD, GitHub Advisory Database, GHSA) to identify known CVEs in the software supply chain.
Why it matters: Grype answers the critical question: "Are any of our dependencies vulnerable?" It integrates with Syft to provide a complete picture — from "what do we have" to "what's at risk." Together, they form a continuous supply chain security monitoring pipeline.
FindBreak output: JSON vulnerability matches with CVE IDs, severity, fix versions, and affected packages.
🛡️ Comprehensive — Timeout: 300s
What it does: Cartography (by Lyft) consolidates infrastructure assets and their relationships into a graph database. It maps how cloud resources, applications, and services are interconnected — revealing which EC2 instances can access which S3 buckets, which IAM roles can assume which permissions, and which services depend on which databases.
Why it matters: Security isn't just about individual assets — it's about relationships between assets. Cartography reveals attack paths: "If an attacker compromises this web server, they can reach the database through this security group, using this IAM role." This relationship visualization is what separates surface-level scanning from true attack surface understanding.
FindBreak output: Infrastructure relationship data for graph-based analysis.
🛡️ Comprehensive — Timeout: 30s
What it does: OWASP Dependency-Track is a component analysis platform that continuously identifies risks in the software supply chain. It ingests SBOMs and continuously monitors components against multiple vulnerability intelligence sources, policy violations, and license compliance issues. FindBreak integrates with its API for real-time component risk scoring.
Why it matters: Unlike point-in-time scanners, Dependency-Track provides continuous monitoring. When a new CVE is published for a library your application uses, it immediately flags the risk — even if the scan was performed weeks ago. This continuous approach is essential for modern DevSecOps workflows.
FindBreak output: Component vulnerability correlations with CVE mappings.
⚡ Quick · 🔍 Standard · 🛡️ Comprehensive — Timeout: 30s
What it does: OpenCTI (Open Cyber Threat Intelligence) is an open-source threat intelligence platform. FindBreak queries its GraphQL API to correlate scan targets against known threat actors, malware campaigns, indicators of compromise (IoCs), and attack patterns from MITRE ATT&CK. It answers: "Is anyone actively targeting this domain?"
Why it matters: Vulnerability scanning tells you what could be exploited. Threat intelligence tells you what is being exploited — and by whom. Correlating scan findings with active threat campaigns enables risk-based prioritization: a medium-severity vulnerability being actively exploited by APT groups is far more urgent than a critical vulnerability with no known exploits.
FindBreak output: Threat actor intelligence, campaign correlations, and IoC matches.
⚡ Quick · 🔍 Standard · 🛡️ Comprehensive Engines Included:
sqlmap(SQLi),commix(Command Inj.),corsy(CORS),dalfox(XSS),paramspider(Parameters),gospider(Crawling),gau(Archives),linkfinder(JS Routes),secretfinder(Tokens). Why it matters: Automates deep-application vulnerability discovery mirroring manual penetration testing techniques across XSS, SQLi, and misconfigurations.
🛡️ Comprehensive Engines Included:
cloud_enum(Buckets),terrashield(Cloud Assets),aeroguard(Configs),subjack(Takeovers). Why it matters: Identifies dangling DNS records and exposed cloud storage containers which often lead to immediate unauthenticated data breaches.
🔍 Standard · 🛡️ Comprehensive Engines Included:
trufflehog(Keys),git-dumper(Source Code),aquatone(Screenshots),gowitness(Visuals),retirejs(JS Vulns),snallygaster(Exposed Files). Why it matters: Scans static assets and repositories for hardcoded API keys while generating visual evidence (screenshots) of all discovered endpoints for human review.
⚡ Quick · 🔍 Standard · 🛡️ Comprehensive Engines Included:
shodan(IoT),censys(Certificates),theHarvester(Emails/IPs),dnstwist(Phishing),findbreak(Proprietary),host,dig(DNS resolution). Why it matters: Enriches standard vulnerability data with global IoT search engines and domain permutation checks to identify impersonation and shadow-IT assets worldwide.
FindBreak runs engines in a carefully ordered, dependency-aware pipeline:
Phase 1: Discovery → Subfinder → Amass → MassDNS
Phase 2: DNS Resolution → dnsx → dig → host
Phase 3: Port Scanning → Naabu → Masscan → Nmap
Phase 4: HTTP Analysis → httpx → Wappalyzer → wafw00f
Phase 5: SSL/TLS → SSLyze → tlsx → testssl
Phase 6: Web Crawling → Katana → Arjun → gospider → gau
Phase 7: Vuln Scanning → Nuclei → Nikto → retirejs
Phase 8: DAST / Fuzzing → sqlmap → dalfox → commix → corsy
Phase 9: Cloud & Secrets → cloud_enum → subjack → trufflehog → git-dumper
Phase 10: Visual Recon → aquatone → gowitness
Phase 11: OSINT & Intel → BBOT → shodan → censys → theHarvester
Phase 12: Supply Chain → Syft → Grype → Dependency-Track
Phase 13: Operations → Cartography → OpenCTI
Each phase feeds into the next — subdomains discovered in Phase 1 are resolved in Phase 2, port-scanned in Phase 3, HTTP-probed in Phase 4, and vulnerability-scanned in Phase 7. This creates a compound intelligence effect where each engine amplifies the next.
FindBreak includes a dedicated Traffic Intelligence Engine that leverages 10 top GitHub open-source repos (combined 150k+ stars) to provide SimilarWeb-level domain intelligence — entirely for free, with no API keys required.
| # | Engine | GitHub | Stars | Mode | Key API |
|---|---|---|---|---|---|
| 1 | waybackurls | tomnomnom/waybackurls | 3.3k★ | Wayback CDX | web.archive.org/cdx/search/cdx |
| 2 | gau | lc/gau | 3.8k★ | Historical URLs | CommonCrawl Index API |
| 3 | Katana | projectdiscovery/katana | 12.1k★ | CT Logs | crt.sh/?q=%25.domain&output=json |
| 4 | SimilarWeb Free | DaWe35/Similarweb-free-API | 600★ | Domain Ranking | tranco-list.eu/api/ranks/domain/ |
| 5 | httpx | projectdiscovery/httpx | 8.1k★ | PageRank | openpagerank.com/api/v1.0/getPageRank |
| 6 | Web-Check | Lissy93/web-check | 32.2k★ | Tech Detection | api.builtwith.com/free1/api.json |
| 7 | Plausible | plausible/analytics | 23.1k★ | Availability | archive.org/wayback/available |
| 8 | Umami | umami-software/umami | 24.6k★ | Analytics Proxy | Snapshot enrichment pipeline |
| 9 | Matomo | matomo-org/matomo | 20.1k★ | Deep Analysis | Subdomain analysis pipeline |
| 10 | PostHog | PostHog/posthog | 25.9k★ | Behavior Intel | Rank-based behavioral scoring |
- Domain Authority Hero — Global rank, monthly visits, PageRank score
- Engagement Metrics — Bounce rate, pages/visit, avg session duration
- Monthly Archive Trend — Area chart of Wayback CDX crawl frequency
- Domain Reputation Radar — 6-axis radar chart (Popularity, Visibility, Authority, Freshness, Breadth, Security)
- Certificate Timeline — Bar chart of SSL cert issuance over time
- Content Distribution — Pie chart of MIME type distribution
- Top Pages Table — 10-column table with URL, hits, status, type, depth, protocol, size, params, cache
- Domain Intelligence Matrix — 30+ signal cards covering archive, security, HTTPS adoption, and computed scores
- Technology Stack Grid — Detected technologies with categories
- Intelligence Pipeline — Source attribution with data point counts
FindBreak generates 20+ page branded PDF security reports using jsPDF (29k★) + jspdf-autotable (2.5k★).
| Page | Section |
|---|---|
| 1 | Cover Page (branded) |
| 2 | Table of Contents |
| 3 | Executive Summary |
| 4 | Scan Configuration & Scope |
| 5 | Risk Score & Assessment |
| 6-7 | Vulnerability Analysis & Detail Table |
| 8 | Infrastructure Assessment |
| 9 | Subdomain Enumeration |
| 10 | Technology Stack |
| 11-12 | Engine Execution Matrix & Details |
| 13 | Endpoint Discovery |
| 14-16 | Traffic Intelligence (Overview, Archive, Pages, Sources) |
| 17 | Compliance Posture |
| 18 | Attack Surface Summary |
| 19 | Recommendations & Remediation |
| 20 | Appendix: Data Sources & Methodology |
| Role | How FindBreak Helps |
|---|---|
| CISOs & Security Directors | Executive dashboards, compliance reports, risk trend analysis |
| Penetration Testers | Automated recon pipeline, multi-engine scanning, report generation |
| Security Engineers | Real-time monitoring, vulnerability tracking, remediation workflows |
| SOC Analysts | Threat intelligence, incident response playbooks, alert correlation |
| DevSecOps Teams | CI/CD security integration, SBOM analysis, supply chain monitoring |
| Compliance Officers | Automated compliance mapping, audit trails, governance dashboards |
- 🏦 Financial Services — PCI DSS compliance, fraud detection, API security
- 🏥 Healthcare — HIPAA compliance, patient data protection, medical device security
- 🏛️ Government — NIST framework compliance, critical infrastructure protection
- 🛒 E-Commerce — Payment security, customer data protection, web application security
- 💻 SaaS Companies — Continuous security monitoring, vulnerability management, SOC 2 readiness
- 🏭 Manufacturing — OT/IT convergence security, supply chain risk management
| Technology | Purpose |
|---|---|
| React 18 | Component-based UI with hooks and concurrent rendering |
| TypeScript | End-to-end type safety |
| Vite | Lightning-fast HMR and build tooling |
| TailwindCSS | Utility-first responsive design system |
| Framer Motion | Premium animations and micro-interactions |
| Recharts | Interactive data visualizations and charts |
| Radix UI | Accessible, composable UI primitives |
| TanStack Query | Server state management with caching and retries |
| Wouter | Lightweight client-side routing |
| Lucide React | Beautiful, consistent iconography |
| Technology | Purpose |
|---|---|
| Node.js | High-performance async runtime |
| Express | RESTful API framework with 40+ endpoints |
| TypeScript | Type-safe server logic |
| Supabase | PostgreSQL database with Row Level Security |
| Zod | Runtime schema validation |
| bcrypt | Secure password hashing |
| JWT | Stateless authentication tokens |
| child_process | Engine orchestration and process management |
| Technology | Purpose |
|---|---|
| Supabase Cloud | Managed PostgreSQL with real-time subscriptions |
| In-Memory Cache | Resilient fallback when database is unavailable |
| WebSocket | Real-time scan progress streaming |
| AbortController | Timeout protection across all API calls |
- Node.js 18+
- npm 9+
- Supabase account (for database)
# Clone the repository
git clone https://github.com/jkanatt/secnode.git
cd secnode
# Install dependencies
npm install
# Configure environment variables
cp .env.example .env
# Edit .env with your Supabase credentialsSUPABASE_URL=https://your-project.supabase.co
SUPABASE_SERVICE_ROLE_KEY=your-service-role-key
SUPABASE_ANON_KEY=your-anon-key
PORT=5001
NODE_ENV=development# Start the development server
npm run dev
# The platform will be available at:
# → http://localhost:5001npm run build
npm startFindBreak ships with 29 production-ready pages covering every aspect of cybersecurity operations:
| Category | Pages |
|---|---|
| Core | Dashboard, CISO Dashboard, New Scan, Scan Progress, Scan Results |
| Vulnerability Management | Vulnerabilities List, Vulnerability Details, Scan Findings |
| Asset Management | Asset Discovery, Asset Criticality |
| Threat Operations | Threat Intelligence, Dark Web Monitoring, Threats |
| Security Modules | Cloud Security, DevSecOps, Identity Graph, IR Playbooks |
| Offensive Security | Pentest Scanner, Phishing Simulator |
| Governance | Compliance, Supply Chain, Reports, Remediation |
| Administration | Settings, Profile, Automation Rules |
Each completed scan unlocks a comprehensive analysis dashboard with 12 specialized tabs:
- Overview — Executive summary with risk score, vulnerability distribution, and key metrics
- Links — Endpoint discovery with URLs, subdomains, open ports, and response data
- Engines — 20+ engine execution matrix with scores, findings, and expandable details
- Traffic — SimilarWeb-style traffic intelligence with 30+ cards (powered by 10 GitHub repos)
- Vulnerabilities & Risk — Detailed finding list with CVSS scores, filterable and sortable
- Infrastructure & Cloud — Subdomain map, DNS records, services, and cloud asset inventory
- Supply Chain & Code — Technology stack analysis, dependency risks, and SBOM
- Identity & Access — Identity relationship mapping and access pattern analysis
- SecOps & Intel — Security operations data with threat intelligence correlation
- Compliance & Governance — Multi-framework compliance scoring (OWASP, NIST, PCI DSS)
- Attack Surface Mode — Complete external attack surface visualization
- Remediation Workflow — Ticket-based vulnerability remediation tracking
| Type | Duration | Engines | Use Case |
|---|---|---|---|
| ⚡ Quick Scan | ~2 min | 6 engines | Fast reconnaissance, CI/CD integration |
| 🔍 Standard Scan | ~10 min | 28 engines | Regular security assessments |
| 🛡️ Comprehensive Scan | ~30 min | 56 engines | Full attack surface analysis, compliance audits |
| ⚙️ Custom Scan | Variable | Configurable | Targeted assessments with specific engine selection |
- Row Level Security (RLS) — Supabase enforces data isolation at the database level
- Service Role Isolation — Backend uses service role key, frontend uses anon key
- Graceful Degradation — In-memory cache keeps the platform operational during DB outages
- Timeout Protection — Every API call has a 5-second timeout with fallback behavior
- Input Sanitization — All user inputs are validated with Zod schemas
- Error Boundaries — Frontend catches and displays errors with retry functionality
- Non-Blocking Scans — Scan execution never blocks the API server
- < 200ms API response time for cached queries
- 5 second maximum wait for any database operation
- 29+ engines executing with intelligent Node.js fallback technology
- Real-time progress updates via polling with smart intervals
- Zero data loss — In-memory cache preserves scan state during outages
- 100% engine execution — Node.js fallback ensures all engines produce findings even without CLI binaries
secnode/
├── client/ # React frontend
│ └── src/
│ ├── components/ # Reusable UI components
│ │ ├── ui/ # Design system primitives
│ │ ├── scan-results/ # 9 scan result tab components
│ │ └── vulnerability/ # Vulnerability display components
│ ├── pages/ # 29 application pages
│ ├── hooks/ # Custom React hooks
│ └── lib/ # Utilities and helpers
├── server/ # Express backend
│ ├── routes.ts # 40+ API endpoints with timeouts
│ ├── scan-engine.ts # 10-phase Node.js scan orchestrator with per-engine fallback
│ ├── engine-runner.ts # 29-engine execution framework with real output parsers
│ ├── engine-fallback.ts # AI-powered Node.js fallback for 100% engine coverage
│ ├── traffic-engine.ts # 10-repo traffic intelligence engine
│ ├── storage.ts # Supabase data access layer
│ ├── supabase.ts # Database client configuration
│ └── bin/ # Rebranded security engine binaries
├── shared/ # Shared types and schemas
│ └── schema.ts # Zod validation schemas
└── package.json # Dependencies and scripts
FindBreak is a proprietary platform. For partnership inquiries, enterprise licensing, or security research collaborations, please contact the development team.
This project is proprietary software. All rights reserved.
Built for defenders. Powered by intelligence. Driven by security.
FindBreak — Because attackers don't wait, neither should you.