Skip to content

Releases: nizartuanku/attack-surface-monitor

Release list

v0.1.1

v0.1.1 Latest
Latest

Choose a tag to compare

View all tags
@nizartuanku nizartuanku released this 07 Sep 03:41
v0.1.1
129f615
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Attack Surface Monitor v0.1.1

Self-hosted external exposure monitoring: new ports, subdomains, exposed panels — daily diff. Scans only domains you verify you own (DNS TXT/HTTP ownership check).

This is the free edition, built from main at 129f615 with an empty license issuer key — it has no license activation. Free-tier limits: 1 verified domain; webhook and syslog alerts. Pro and Team tiers (higher limits, delivered binaries) are available at whop.com/nizar-tuanku/attack-surface-monitor.

What changed since v0.1.0

  • Wildcard coverage note. When Certificate Transparency shows a wildcard certificate (*.example.com) for your domain, ASM now raises asm.coverage-wildcard (severity Info) before showing the inventory. A wildcard certificate is logged as the wildcard, never as the hostnames behind it, so a short asset list on such a domain is a limit of the data source — the report now says so instead of presenting it as a small attack surface.
  • Hexward rename, with compatibility. Ownership challenges are now _hexward-verify (DNS TXT) and /.well-known/hexward-verify.txt (HTTP); webhooks send X-Hexward-Token. Proofs and receivers set up under the old sentinel-verify / X-Sentinel-Token names keep working until 1 March 2027 — nothing you placed before the rename reverts to pending.
  • Dashboard: tier-limit messages link to the Pro/Team page; product name and footer updated.
  • Docs: docs/CONCEPTS.md explains the product from the problem it solves, with a tested install block; README tier table lists the free alert channels as webhook and syslog; Docker section now builds the image from this repo.
  • LICENSE is the full Apache-2.0 text; CI workflow added.

Install

tar -xzf asm-free-0.1.1-linux-amd64.tar.gz
./asm

Dashboard: http://127.0.0.1:8423 — single binary, SQLite storage in the working directory, no telemetry, nothing leaves your network.

Or build from source (Go 1.24+, CGO required for the SQLite driver):

go build ./cmd/asm

Integrity

Verify the download:

sha256sum -c SHA256SUMS

SHA-256: 5dd287345cb0bcdb666ffedc113bcdad5611f30dfcc0837bc1e8cb496881e472

Feedback

Run it in a lab first. Bug reports and lab feedback via GitHub Issues are very welcome.

Assets 4
Loading

v0.1.0

v0.1.0

Choose a tag to compare

View all tags
@nizartuanku nizartuanku released this 21 Aug 23:33
v0.1.0
0599072

Attack Surface Monitor v0.1.0

Self-hosted external exposure monitoring: new ports, subdomains, exposed panels — daily diff. Scans only domains you verify you own (DNS TXT/HTTP ownership check).

This is the free edition, built from this repository with an empty license issuer key — it has no license activation. Free-tier limits: 1 verified domain. Pro and Team tiers (higher limits, delivered binaries) are available at whop.com/nizar-tuanku/attack-surface-monitor.

Install

tar -xzf asm-free-0.1.0-linux-amd64.tar.gz
./asm

Dashboard: http://127.0.0.1:8423 — single binary, SQLite storage in the working directory, no telemetry, nothing leaves your network.

Or build from source (Go 1.24+, CGO required for the SQLite driver):

go build ./cmd/asm

Integrity

Verify the download:

sha256sum -c SHA256SUMS

SHA-256: 1413b2706dabef796b593c8f9cbf50121600ba1829d187d6594ee50ca3ee37ce

Feedback

Run it in a lab first. Bug reports and lab feedback via GitHub Issues are very welcome.

Loading