Free Attack Surface Scanner

Map your external attack surface from a single domain

Enter a domain to discover its full external attack surface. This tool queries certificate transparency logs for subdomains, checks HTTP security headers, probes for exposed files like robots.txt and security.txt, and compiles a comprehensive view of your publicly visible infrastructure.

Trusted by teams at

Ramp
Pilot
Vercel
Stripe
Better Auth
SST
OpenCode

How it works

How Attack Surface Scanner works

01

Enter your domain

Type any domain name. We strip protocols and paths automatically and use the root domain for a comprehensive surface scan.

02

Multi-source reconnaissance

We query certificate transparency logs for subdomains, fetch HTTP headers from the main domain, and probe for common exposed files — all in parallel for fast results.

03

Review your attack surface

Get a consolidated view of all discovered assets, exposed services, security header gaps, and publicly accessible files — with risk ratings and remediation priorities.

Features

What Attack Surface Scanner checks

Discover subdomains via certificate transparency

Queries crt.sh certificate transparency logs to find all SSL certificates issued for your domain, revealing subdomains you may not be tracking — including staging, dev, and internal services.

Analyze HTTP security headers

Checks the main domain for critical security headers including Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, and more to identify missing protections.

Detect exposed files and paths

Probes for robots.txt (which may reveal hidden paths), sitemap.xml (full site structure), and .well-known/security.txt (security contact and policy information).

Consolidated risk assessment

Combines all findings into a single prioritized risk view — from exposed development subdomains to missing security headers — so you know exactly what to fix first.

Use cases

Who should use the free Attack Surface Scanner

Security Teams

Get a quick overview of your organization's external exposure. Discover forgotten subdomains, shadow IT assets, and misconfigured services that expand your attack surface.

Penetration Testers

Kickstart an engagement with automated reconnaissance. Gather subdomains, headers, and exposed files in seconds before diving into targeted vulnerability assessment.

DevOps Engineers

Audit your public infrastructure after deployments. Verify that staging environments aren't publicly accessible and that security headers are consistently applied.

More tools

All free security tools

FAQ

Frequently asked questions

Everything you need to know about the free Attack Surface Scanner.

Go beyond Attack Surface Scanner

This free Attack Surface Scanner checks a handful of things. Maced's AI pentest checks thousands.

Get a full autonomous penetration test — including OWASP Top 10, authentication flaws, business logic errors, API security, and more — with a compliance-ready report in hours.

Proof of exploit on every finding · SOC 2 & ISO 27001 compatible