Sign inSign up

corefixhq/cfix-web-chromium

By corefixhq

•Updated about 6 hours ago

DAST Scanner with Chromium - ZAP, Nmap, Nuclei, TestSSL, OpenAPI Fuzzer - AI-prioritized findings

Image
Security
API management
Developer tools
0

2.7K

corefixhq/cfix-web-chromium repository overview

⁠CoreFix Web Scanner — Chromium Bundle

This image is the standard CoreFix Web Scanner with Chromium bundled inside. It launches headless Chromium within the container and drives it over CDP on localhost:9222 automatically — no Cloudflare managed browser, no host browser, and no --network host. Authenticated scans work fully self-contained, including in air-gapped and network-isolated environments.

Everything else is identical to the standard Web Scanner. For full detail on scanners, flags, config, and output, see the Docker Hub page: hub.docker.com/r/corefixhq/cfix-web⁠.

Scan it live. Fix it before they find it.

CoreFix Web Scanner runs dynamic application security testing (DAST) against any live URL — no source code required. It combines port scanning, CVE detection, web crawling, active scanning, and SSL/TLS analysis, then normalizes, deduplicates, and AI-prioritizes findings by real exploitability. This variant ships Chromium in the image so authenticated, JavaScript-heavy applications scan out of the box. One command. Zero configuration.

⁠Quick Start

docker run --rm \
  -e X_CFIX_API_KEY=cfix_live_YOUR_API_KEY \
  -v $(pwd):/web \
  -v ~/scan-results:/output \
  corefixhq/cfix-web-chromium \
  --target https://your-app.com

--target is the only required flag. First results in minutes.

⁠Authenticated Scans

Pass credentials to scan behind a login. The bundled Chromium launches headless inside the container and is driven over CDP on localhost:9222 automatically — no browser setup, no managed browser, no --network host:

docker run --rm \
  -e X_CFIX_API_KEY=cfix_live_YOUR_API_KEY \
  -v $(pwd):/web \
  -v ~/scan-results:/output \
  corefixhq/cfix-web-chromium \
  --target https://your-app.com \
  --username admin \
  --password s3cr3t

Because the browser ships in the image, authenticated scans run identically on a laptop, in CI, or in an air-gapped network — nothing reaches out to an external browser service.

For complex flows, drop a .cfix.web.yaml config or recorded .har files into the directory mounted at /web (see Configuration⁠).

Bring your own Chromium? If you would rather connect to an external browser you control, use the standard corefixhq/cfix-web⁠ image instead, which falls back to a Cloudflare managed browser or a host Chromium on port 9222 with --network host.

⁠Image Tags

TagDescription
latestLatest stable release
x.y.zSpecific version (e.g. 1.0.0)
<sha>Specific commit SHA
docker pull corefixhq/cfix-web-chromium:latest
docker pull corefixhq/cfix-web-chromium:1.0.0

The Chromium bundle is larger than the standard image. If you connect to your own browser, use the slimmer corefixhq/cfix-web⁠ tags instead.

⁠Security and Privacy

  • Credentials are used only at scan time and never persisted inside the container
  • The bundled browser runs entirely inside the container — no traffic to external browser services
  • Only scan findings (not credentials or raw traffic) are transmitted to CoreFix
  • The container is stateless and isolated — destroyed after each run
  • Full privacy policy: corefix.dev/privacy⁠

⁠Links

⁠Open Source Acknowledgements

CoreFix Web Scanner is built on: Nmap⁠ (NPSL), Nuclei⁠ (MIT), OWASP ZAP⁠ (Apache-2.0), testssl.sh⁠ (GPL-2.0), Chromium⁠ (BSD-3-Clause).

Full attributions: docs.corefix.dev/acknowledgements⁠

Built with ❤️ in Bangalore, India — for developers everywhere.

Tag summary

Content type

Image

Digest

sha256:ef5baf371…

Size

1.6 GB

Last updated

about 6 hours ago

docker pull corefixhq/cfix-web-chromium