Full-spectrum External Threat Intelligence & Attack Surface Management
223
Summon every hidden exposure — from subdomain to crown jewel.
ARISE XTI is a full-spectrum EASM platform that discovers, maps, and continuously monitors your external attack surface. It combines a 28-module automated pipeline with AI-driven adversary emulation to surface real, evidence-backed security findings.
docker pull piratesshield/arisexti:latest
docker run -d \
-p 5059:5059 \
-v $(pwd)/scans:/app/scans \
-v $(pwd)/logs:/app/logs \
piratesshield/arisexti
Open http://localhost:5059 in your browser.
| Field | Value |
|---|---|
| Username | admin |
| Password | admin |
Change these immediately via Settings or set at launch:
-e ARISE_ADMIN_USER=myuser -e ARISE_ADMIN_PASSWORD=s3cureP@ss
example.com)docker exec -it <container> bash easm-pipeline.sh --target example.com
| Phase | Modules |
|---|---|
| Recon | Subdomain enum (subfinder, puredns), DNS resolution, port scanning (naabu) |
| Discovery | HTTP probing (httpx), URL crawling (katana, gospider, gau), directory brute-force |
| Analysis | Nuclei scanning, API security testing, cloud storage enum, OSINT intelligence |
| Offensive | 403 bypass, SSTI/CRLF/redirect verification, JWT attacks, adaptive attack loop |
| Intel | Shodan correlation, TLS/cert posture, SBOM detection, Internet Intelligence Layer |
AI-driven adversary emulation with 5 threat profiles (APT29, FIN7, APT28, Lazarus, Opportunistic). Generates evidence-backed findings with full kill-chain mapping to MITRE ATT&CK.
subfinder · dnsx · httpx · nuclei · katana · naabu · gau · ffuf · massdns · trufflehog · dalfox · puredns · nmap · sqlmap · jwt_tool · SSTImap · graphw00f · smuggler
| View | Description |
|---|---|
| Overview | Risk gauge, vulnerability summary, tech stack, top-risk assets |
| Issues | KEV/EPSS-ranked findings with SLA tracking and trend analysis |
| Attack Surface | Consolidated issue console with attack-surface scoring |
| Assets | Full host inventory with WAF/CDN status and security headers |
| Vulnerabilities | Nuclei + custom findings with severity breakdown |
| URL Inventory | Classified endpoints with attack routing metadata |
| API Security | Confirmed vs. potential API vulnerabilities |
| Cloud | S3/Azure/GCP bucket enumeration and posture findings |
| TLS/Certs | SSL-Labs-style per-host certificate and HSTS grading |
| OSINT | Human exposure intelligence and brand monitoring |
| Shodan | External-view port/service correlation |
| Attack Paths | CAPEC-driven exploitable path graph |
| Red Team | AriseAI adversary emulation findings |
| SBOM | Software Bill of Materials with version detection |
| Variable | Default | Description |
|---|---|---|
ARISE_DASHBOARD_PORT | 5059 | Dashboard HTTP port |
ARISE_DASHBOARD_HOST | 0.0.0.0 | Bind address |
ARISE_ADMIN_USER | admin | Initial admin username |
ARISE_ADMIN_PASSWORD | admin | Initial admin password |
Mount these volumes to retain data across container restarts:
-v /path/to/scans:/app/scans
-v /path/to/logs:/app/logs
-v /path/to/state:/app/state
curl http://localhost:5059/api/health
# → {"ok": true, "service": "arise-dashboard"}
The container includes a built-in HEALTHCHECK on /api/health.
| Tag | Description |
|---|---|
latest | Most recent stable build |
v4.0 | Current release |
linux/arm64 (Apple Silicon native)http://localhost:5059 after docker runBuilt for security professionals. Use responsibly and only against authorized targets.
Content type
Image
Digest
sha256:4fca93988…
Size
866.9 MB
Last updated
about 10 hours ago
docker pull piratesshield/arisexti