How kimmcondoness/attack-surface-management-system works
This Flask ASM application manages only authorized targets, discovers their internet-facing assets, scans them for exposed services and security findings, then prioritizes and reports risk. The main operational path is analyst target/scan activity through the scan service, scanner modules, and persisted assets/findings; scheduled monitoring reuses that scanning path and records changes. Dashboard, inventory, threat intelligence, user administration, and reports are distinct product capabilities. The graph follows documented behavior and sampled source; unsampled route-to-service wiring is omitted where not established.
Main entry points: models.py Assets and findings · scan_service.py Scan orchestration · app.py Flask application · monitor_service.py Scheduled monitoring
Components 28
Web application
- Flask application
app.py - Login and access
routes/auth_pages.py - Dashboard and radar
routes/dashboard.py - Asset inventory
services/inventory_service.py - Target management
routes/targets.py - Scan controls
routes/scans.py
Target scanning
- Scan orchestration
services/scan_service.py - Scan runner
services/scan_runner.py - Subdomain discovery
scanner/subfinder.py - Port discovery
scanner/nmap_scanner.py - Configuration checks
scanner/config_scanner.py - Exposure checks
scanner/exposure_scanner.py - Template scanning
scanner/nuclei_scanner.py
Risk intelligence
- Threat intelligence
routes/threat_intel.py - Risk prioritization
services/risk_service.py - CVE enrichment
services/cve_lookup.py - Dork catalog
services/dork_service.py
Monitoring and reporting
- Scheduled monitoring
services/monitor_service.py - Reports and exports
services/report_service.py - Mail service
utils/mailer.py
Persistence
- Authorized targets
models.py - Assets and findings
models.py
Other components
- Security analysts
- IT administrators
- SQL database
- NVD CVE data
- CISA KEV catalog
- Exploit availability
Connections 41
- Security analysts → Login and access: signs in
- IT administrators → Login and access: signs in
- Flask application → Login and access: registers routes
- Flask application → Dashboard and radar: registers routes
- Flask application → Target management: registers routes
- Flask application → Scan controls: registers routes
- Security analysts → Target management: manages targets
- Security analysts → Scan controls: starts scans
- IT administrators → Dashboard and radar: views status
- Dashboard and radar → Assets and findings: reads
- Asset inventory → Assets and findings: reads
- Target management → Authorized targets: manages
- Scan controls → Scan orchestration: requests scans
- Scan orchestration → Scan runner: runs workflow
- Scan orchestration → Subdomain discovery: discovers hosts
- Scan orchestration → Port discovery: discovers ports
- Scan orchestration → Configuration checks: checks configuration
- Scan orchestration → Exposure checks: checks exposures
- Scan orchestration → Template scanning: runs if available
- Scan orchestration → CVE enrichment: matches banners
- Subdomain discovery → Assets and findings: supplies assets
- Port discovery → Assets and findings: supplies services
- Configuration checks → Assets and findings: supplies findings
- Exposure checks → Assets and findings: supplies findings
- Template scanning → Assets and findings: supplies findings
- CVE enrichment → NVD CVE data: looks up CVEs
- CVE enrichment → CISA KEV catalog: checks exploitation
- CVE enrichment → Exploit availability: checks availability
- Scheduled monitoring → Scan orchestration: starts due scans
- Scheduled monitoring → Authorized targets: claims targets
- Scheduled monitoring → Assets and findings: records changes
- Scheduled monitoring → Mail service: sends alerts
- Threat intelligence → Risk prioritization: prioritizes findings
- Risk prioritization → Assets and findings: scores findings
- Threat intelligence → CISA KEV catalog: reviews updates
- Reports and exports → Assets and findings: gathers report data
- Reports and exports → Risk prioritization: scores report
- Security analysts → Reports and exports: exports reports
- Dork catalog → Security analysts: provides query links
- Authorized targets → SQL database: persists
- Assets and findings → SQL database: persists