# kimmcondoness/attack-surface-management-system architecture

> Architecture diagram of the GitHub repository kimmcondoness/attack-surface-management-system, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-28). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/kimmcondoness/attack-surface-management-system
- Repository: https://github.com/kimmcondoness/attack-surface-management-system
- Video tour (about a minute): https://gitdiagram.com/kimmcondoness/attack-surface-management-system/video

## Overview

This Flask ASM application manages only authorized targets, discovers their internet-facing assets, scans them for exposed services and security findings, then prioritizes and reports risk. The main operational path is analyst target/scan activity through the scan service, scanner modules, and persisted assets/findings; scheduled monitoring reuses that scanning path and records changes. Dashboard, inventory, threat intelligence, user administration, and reports are distinct product capabilities. The graph follows documented behavior and sampled source; unsampled route-to-service wiring is omitted where not established.

Main entry points: [`models.py`](https://github.com/kimmcondoness/attack-surface-management-system/blob/main/models.py) (Assets and findings), [`services/scan_service.py`](https://github.com/kimmcondoness/attack-surface-management-system/blob/main/services/scan_service.py) (Scan orchestration), [`app.py`](https://github.com/kimmcondoness/attack-surface-management-system/blob/main/app.py) (Flask application), [`services/monitor_service.py`](https://github.com/kimmcondoness/attack-surface-management-system/blob/main/services/monitor_service.py) (Scheduled monitoring)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_web["Web application"]
  node_app["Flask application<br/>[app.py]"]
  node_auth["Login and access<br/>[auth_pages.py]"]
  node_dashboard["Dashboard and radar<br/>[dashboard.py]"]
  node_inventory["Asset inventory"]
  node_target_routes["Target management<br/>[targets.py]"]
  node_scan_routes["Scan controls<br/>[scans.py]"]
end

subgraph group_scan["Target scanning"]
  node_scan_service["Scan orchestration<br/>[scan_service.py]"]
  node_runner["Scan runner<br/>[scan_runner.py]"]
  node_subfinder["Subdomain discovery<br/>[subfinder.py]"]
  node_nmap["Port discovery<br/>[nmap_scanner.py]"]
  node_config_scan["Configuration checks<br/>[config_scanner.py]"]
  node_exposure["Exposure checks"]
  node_nuclei["Template scanning<br/>[nuclei_scanner.py]"]
end

subgraph group_intel["Risk intelligence"]
  node_threat["Threat intelligence<br/>[threat_intel.py]"]
  node_risk["Risk prioritization<br/>[risk_service.py]"]
  node_enrichment["CVE enrichment<br/>[cve_lookup.py]"]
  node_dorks["Dork catalog<br/>[dork_service.py]"]
end

subgraph group_ops["Monitoring and reporting"]
  node_monitor["Scheduled monitoring<br/>[monitor_service.py]"]
  node_reports["Reports and exports<br/>[report_service.py]"]
  node_mail["Mail service<br/>[mailer.py]"]
end

subgraph group_data["Persistence"]
  node_targets[("Authorized targets<br/>[models.py]")]
  node_records[("Assets and findings<br/>[models.py]")]
end

node_analyst(("Security analysts"))
node_admin(("IT administrators"))
node_db[("SQL database")]
node_nvd["NVD CVE data"]
node_kev["CISA KEV catalog"]
node_exploit["Exploit availability"]

node_analyst -->|"signs in"| node_auth
node_admin -->|"signs in"| node_auth
node_app -->|"registers routes"| node_auth
node_app -->|"registers routes"| node_dashboard
node_app -->|"registers routes"| node_target_routes
node_app -->|"registers routes"| node_scan_routes
node_analyst -->|"manages targets"| node_target_routes
node_analyst -->|"starts scans"| node_scan_routes
node_admin -->|"views status"| node_dashboard
node_dashboard -->|"reads"| node_records
node_inventory -->|"reads"| node_records
node_target_routes -->|"manages"| node_targets
node_scan_routes -->|"requests scans"| node_scan_service
node_scan_service -->|"runs workflow"| node_runner
node_scan_service -->|"discovers hosts"| node_subfinder
node_scan_service -->|"discovers ports"| node_nmap
node_scan_service -->|"checks configuration"| node_config_scan
node_scan_service -->|"checks exposures"| node_exposure
node_scan_service -.->|"runs if available"| node_nuclei
node_scan_service -->|"matches banners"| node_enrichment
node_subfinder -->|"supplies assets"| node_records
node_nmap -->|"supplies services"| node_records
node_config_scan -->|"supplies findings"| node_records
node_exposure -->|"supplies findings"| node_records
node_nuclei -.->|"supplies findings"| node_records
node_enrichment -->|"looks up CVEs"| node_nvd
node_enrichment -->|"checks exploitation"| node_kev
node_enrichment -->|"checks availability"| node_exploit
node_monitor -->|"starts due scans"| node_scan_service
node_monitor -->|"claims targets"| node_targets
node_monitor -->|"records changes"| node_records
node_monitor -->|"sends alerts"| node_mail
node_threat -->|"prioritizes findings"| node_risk
node_risk -->|"scores findings"| node_records
node_threat -->|"reviews updates"| node_kev
node_reports -->|"gathers report data"| node_records
node_reports -->|"scores report"| node_risk
node_analyst -->|"exports reports"| node_reports
node_dorks -->|"provides query links"| node_analyst
node_targets -->|"persists"| node_db
node_records -->|"persists"| node_db

click node_app "https://github.com/kimmcondoness/attack-surface-management-system/blob/main/app.py"
click node_auth "https://github.com/kimmcondoness/attack-surface-management-system/blob/main/routes/auth_pages.py"
click node_dashboard "https://github.com/kimmcondoness/attack-surface-management-system/blob/main/routes/dashboard.py"
click node_inventory "https://github.com/kimmcondoness/attack-surface-management-system/blob/main/services/inventory_service.py"
click node_target_routes "https://github.com/kimmcondoness/attack-surface-management-system/blob/main/routes/targets.py"
click node_scan_routes "https://github.com/kimmcondoness/attack-surface-management-system/blob/main/routes/scans.py"
click node_scan_service "https://github.com/kimmcondoness/attack-surface-management-system/blob/main/services/scan_service.py"
click node_runner "https://github.com/kimmcondoness/attack-surface-management-system/blob/main/services/scan_runner.py"
click node_subfinder "https://github.com/kimmcondoness/attack-surface-management-system/blob/main/scanner/subfinder.py"
click node_nmap "https://github.com/kimmcondoness/attack-surface-management-system/blob/main/scanner/nmap_scanner.py"
click node_config_scan "https://github.com/kimmcondoness/attack-surface-management-system/blob/main/scanner/config_scanner.py"
click node_exposure "https://github.com/kimmcondoness/attack-surface-management-system/blob/main/scanner/exposure_scanner.py"
click node_nuclei "https://github.com/kimmcondoness/attack-surface-management-system/blob/main/scanner/nuclei_scanner.py"
click node_targets "https://github.com/kimmcondoness/attack-surface-management-system/blob/main/models.py"
click node_records "https://github.com/kimmcondoness/attack-surface-management-system/blob/main/models.py"
click node_monitor "https://github.com/kimmcondoness/attack-surface-management-system/blob/main/services/monitor_service.py"
click node_threat "https://github.com/kimmcondoness/attack-surface-management-system/blob/main/routes/threat_intel.py"
click node_risk "https://github.com/kimmcondoness/attack-surface-management-system/blob/main/services/risk_service.py"
click node_enrichment "https://github.com/kimmcondoness/attack-surface-management-system/blob/main/services/cve_lookup.py"
click node_reports "https://github.com/kimmcondoness/attack-surface-management-system/blob/main/services/report_service.py"
click node_dorks "https://github.com/kimmcondoness/attack-surface-management-system/blob/main/services/dork_service.py"
click node_mail "https://github.com/kimmcondoness/attack-surface-management-system/blob/main/utils/mailer.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_app,node_auth,node_dashboard,node_inventory,node_target_routes,node_scan_routes toneBlue
class node_scan_service,node_runner,node_subfinder,node_nmap,node_config_scan,node_exposure,node_nuclei,node_db toneAmber
class node_threat,node_risk,node_enrichment,node_dorks toneMint
class node_monitor,node_reports,node_mail toneRose
class node_targets,node_records,node_analyst,node_admin,node_nvd,node_kev,node_exploit toneIndigo
```

## Components

### Web application

- [Flask application](https://github.com/kimmcondoness/attack-surface-management-system/blob/main/app.py): `app.py`
- [Login and access](https://github.com/kimmcondoness/attack-surface-management-system/blob/main/routes/auth_pages.py): `routes/auth_pages.py`
- [Dashboard and radar](https://github.com/kimmcondoness/attack-surface-management-system/blob/main/routes/dashboard.py): `routes/dashboard.py`
- [Asset inventory](https://github.com/kimmcondoness/attack-surface-management-system/blob/main/services/inventory_service.py): `services/inventory_service.py`
- [Target management](https://github.com/kimmcondoness/attack-surface-management-system/blob/main/routes/targets.py): `routes/targets.py`
- [Scan controls](https://github.com/kimmcondoness/attack-surface-management-system/blob/main/routes/scans.py): `routes/scans.py`

### Target scanning

- [Scan orchestration](https://github.com/kimmcondoness/attack-surface-management-system/blob/main/services/scan_service.py): `services/scan_service.py`
- [Scan runner](https://github.com/kimmcondoness/attack-surface-management-system/blob/main/services/scan_runner.py): `services/scan_runner.py`
- [Subdomain discovery](https://github.com/kimmcondoness/attack-surface-management-system/blob/main/scanner/subfinder.py): `scanner/subfinder.py`
- [Port discovery](https://github.com/kimmcondoness/attack-surface-management-system/blob/main/scanner/nmap_scanner.py): `scanner/nmap_scanner.py`
- [Configuration checks](https://github.com/kimmcondoness/attack-surface-management-system/blob/main/scanner/config_scanner.py): `scanner/config_scanner.py`
- [Exposure checks](https://github.com/kimmcondoness/attack-surface-management-system/blob/main/scanner/exposure_scanner.py): `scanner/exposure_scanner.py`
- [Template scanning](https://github.com/kimmcondoness/attack-surface-management-system/blob/main/scanner/nuclei_scanner.py): `scanner/nuclei_scanner.py`

### Risk intelligence

- [Threat intelligence](https://github.com/kimmcondoness/attack-surface-management-system/blob/main/routes/threat_intel.py): `routes/threat_intel.py`
- [Risk prioritization](https://github.com/kimmcondoness/attack-surface-management-system/blob/main/services/risk_service.py): `services/risk_service.py`
- [CVE enrichment](https://github.com/kimmcondoness/attack-surface-management-system/blob/main/services/cve_lookup.py): `services/cve_lookup.py`
- [Dork catalog](https://github.com/kimmcondoness/attack-surface-management-system/blob/main/services/dork_service.py): `services/dork_service.py`

### Monitoring and reporting

- [Scheduled monitoring](https://github.com/kimmcondoness/attack-surface-management-system/blob/main/services/monitor_service.py): `services/monitor_service.py`
- [Reports and exports](https://github.com/kimmcondoness/attack-surface-management-system/blob/main/services/report_service.py): `services/report_service.py`
- [Mail service](https://github.com/kimmcondoness/attack-surface-management-system/blob/main/utils/mailer.py): `utils/mailer.py`

### Persistence

- [Authorized targets](https://github.com/kimmcondoness/attack-surface-management-system/blob/main/models.py): `models.py`
- [Assets and findings](https://github.com/kimmcondoness/attack-surface-management-system/blob/main/models.py): `models.py`

### Other components

- **Security analysts**
- **IT administrators**
- **SQL database**
- **NVD CVE data**
- **CISA KEV catalog**
- **Exploit availability**

## Connections

- Security analysts → Login and access: signs in
- IT administrators → Login and access: signs in
- Flask application → Login and access: registers routes
- Flask application → Dashboard and radar: registers routes
- Flask application → Target management: registers routes
- Flask application → Scan controls: registers routes
- Security analysts → Target management: manages targets
- Security analysts → Scan controls: starts scans
- IT administrators → Dashboard and radar: views status
- Dashboard and radar → Assets and findings: reads
- Asset inventory → Assets and findings: reads
- Target management → Authorized targets: manages
- Scan controls → Scan orchestration: requests scans
- Scan orchestration → Scan runner: runs workflow
- Scan orchestration → Subdomain discovery: discovers hosts
- Scan orchestration → Port discovery: discovers ports
- Scan orchestration → Configuration checks: checks configuration
- Scan orchestration → Exposure checks: checks exposures
- Scan orchestration → Template scanning: runs if available
- Scan orchestration → CVE enrichment: matches banners
- Subdomain discovery → Assets and findings: supplies assets
- Port discovery → Assets and findings: supplies services
- Configuration checks → Assets and findings: supplies findings
- Exposure checks → Assets and findings: supplies findings
- Template scanning → Assets and findings: supplies findings
- CVE enrichment → NVD CVE data: looks up CVEs
- CVE enrichment → CISA KEV catalog: checks exploitation
- CVE enrichment → Exploit availability: checks availability
- Scheduled monitoring → Scan orchestration: starts due scans
- Scheduled monitoring → Authorized targets: claims targets
- Scheduled monitoring → Assets and findings: records changes
- Scheduled monitoring → Mail service: sends alerts
- Threat intelligence → Risk prioritization: prioritizes findings
- Risk prioritization → Assets and findings: scores findings
- Threat intelligence → CISA KEV catalog: reviews updates
- Reports and exports → Assets and findings: gathers report data
- Reports and exports → Risk prioritization: scores report
- Security analysts → Reports and exports: exports reports
- Dork catalog → Security analysts: provides query links
- Authorized targets → SQL database: persists
- Assets and findings → SQL database: persists