"Can we just build this with open source?" is a fair question, and the honest answer is mostly yes for the scanning and mostly no for the monitoring. The tools below are the ones that actually get used, nearly all of them battle-tested in bug bounty work where speed and accuracy on large scopes are the whole game. Everything here is genuinely free and self-hostable.

Discovery: finding what exists

1. OWASP Amass

The most thorough asset discovery tool in the category, and an OWASP flagship project. Amass combines passive sources (certificate transparency, dozens of search and threat-intel APIs, WHOIS) with active DNS enumeration, brute forcing and permutation, then maps relationships between netblocks, ASNs and domains. Its graph database keeps results across runs, which is closer to inventory than most single-shot tools get.

Watch out for: it is slow and thorough by default, and the richest passive sources want API keys. Budget time for configuration.

2. Subfinder

ProjectDiscovery's passive subdomain finder. Where Amass is exhaustive, Subfinder is fast: it queries around thirty passive sources and returns results in seconds rather than hours. For most workflows this is the first command you run, and Amass is what you reach for when you need depth.

3. dnsx

A fast DNS toolkit for resolving large hostname lists, filtering to what actually resolves, and retrieving specific record types in bulk. Its practical role in a pipeline is cutting a list of 50,000 speculative hostnames down to the few hundred that exist, and it is the natural place to flag CNAMEs pointing at unclaimed platform endpoints, which is the subdomain takeover signal.

Probing: seeing what answers

4. httpx

Takes a list of hosts and tells you which speak HTTP, with status codes, page titles, response headers, technology fingerprints, TLS details and optional screenshots. It is the connective tissue of nearly every pipeline here, and the fastest way to turn "hosts that resolve" into "things actually serving content."

5. naabu and nmap

naabu is a fast SYN/CONNECT port scanner designed to feed other tools, ideal for a quick sweep of common ports across many hosts. nmap remains the reference implementation for depth: service and version detection, OS fingerprinting, and the NSE scripting engine. The usual pattern is naabu for breadth, then nmap against the ports it found.

Important: both are active scanners that send unsolicited traffic. Run them only against infrastructure you own or have written authorization to test.

Assessment: judging what you found

6. nuclei

The most valuable single tool on this list. Nuclei runs YAML-defined templates against targets, with a community template library in the thousands covering exposed panels, default credentials, misconfigurations, information disclosure and a large set of known CVEs. Templates are readable and easy to write, so encoding a check specific to your stack takes minutes.

Watch out for: template quality varies, and false positives are real. Tag filtering and severity thresholds matter once you are running it regularly.

7. testssl.sh

A single bash script that tests a TLS endpoint thoroughly: protocol versions, cipher suites, certificate chain and expiry, known vulnerabilities (ROBOT, Heartbleed descendants, LOGJAM), HSTS and more. It is essentially SSL Labs as a local command, works against internal hosts SSL Labs cannot reach, and outputs JSON for scripting.

8. OpenVAS / Greenbone Community Edition

The only serious free CVE scanner, with tens of thousands of vulnerability tests and a feed that updates continuously. It fills the gap the tools above leave: authenticated and unauthenticated checks for known software vulnerabilities on hosts you administer.

Watch out for: this is the heaviest thing here to operate. It wants a real server, the feed sync is slow, and tuning consumes time. We compared the operational tradeoff against a hosted monitor in Bastion vs. OpenVAS.

9. EasyEASM

A lightweight wrapper that chains several of the tools above (Amass, Subfinder, naabu, httpx) into a single configurable job and diffs results between runs to report new assets. It is a small project rather than a platform, and it is the closest thing to an out-of-the-box open source EASM if you want the pipeline pre-assembled.

A working pipeline

Chained together, these produce a genuine external assessment:

subfinder -d example.com -silent \
  | dnsx -silent -a -resp \
  | httpx -silent -title -tech-detect -status-code \
  | nuclei -severity medium,high,critical

Add naabu for ports, testssl.sh per HTTPS host, and Amass on a slower schedule for deep discovery. Written as a nightly job with output diffed against yesterday, this is a credible monitoring system.

What the open source stack does not give you

This is the part worth being clear-eyed about, because it is where the free option stops being free:

  • Scheduling and reliability. Something must run this nightly and complain when it does not. A silent cron failure is indistinguishable from a clean scan.
  • History and diffing. The security question is "what changed?", and answering it means storing every result and comparing runs. That is a database and a schema you now own.
  • Deduplication and noise control. Nuclei will find the same low-severity issue on 40 hosts every night forever unless someone builds triage state.
  • Alerting that people read. Routing, severity thresholds, and not paging anyone at 3am for an informational finding.
  • Reports someone else accepts. A customer security questionnaire wants a dated PDF, not terminal output.
  • Authorization boundaries. Nothing here stops you scanning something you do not own, which is your legal problem to manage.

Every one of those is buildable, and teams do build them. The realistic cost is a few days up front and a few hours a month forever, which priced against the paid tiers is rarely the cheaper option unless you have an engineer who wants to own it. Where self-hosting clearly wins: scanning at a scale that would be expensive to meter, environments where data cannot leave your network, and testing scopes that need custom checks a vendor will not write.

Frequently asked questions

Is there an open source EASM platform?

Not a complete one. The open source ecosystem provides excellent individual tools (Amass and Subfinder for discovery, httpx for probing, nuclei for assessment, testssl.sh for TLS, OpenVAS for CVEs) that you chain together yourself. EasyEASM is the closest thing to a pre-assembled pipeline, but scheduling, history, deduplication and alerting remain yours to build.

What is the best free subdomain enumeration tool?

Subfinder for speed and Amass for depth, and most people run both. Subfinder queries around thirty passive sources and returns results in seconds; Amass adds active DNS enumeration, permutation and relationship mapping across netblocks and ASNs, at the cost of much longer run times. Both benefit substantially from configured API keys.

Are open source attack surface tools safe to run on production?

The passive ones are: Subfinder, Amass in passive mode, and certificate transparency queries touch your infrastructure barely or not at all. Active tools (naabu, nmap, nuclei and OpenVAS) send real probe traffic and can affect fragile services, so run them against infrastructure you own or have written authorization to test, and prefer off-peak windows for the first run.

Is self-hosting actually cheaper than a paid tool?

Only if you count honestly. The software is free, but hosting, scheduling, feed updates, storage, triage and maintenance typically consume a few engineer hours a month. At normal loaded rates that exceeds the $25 to $200 per month that lightweight commercial monitors cost. Self-hosting wins on scale, on data residency requirements, and when you need custom checks no vendor offers.

Sources