samaritan // features
Register a target, get scanned, get findings.
Samaritan discovers your external surface, runs active checks against it, matches results to known CVEs, and tracks findings over time.
#discovery
Attack surface discovery
Samaritan actively enumerates your external surface: subdomains, IP addresses, exposed services, and TLS certificates, through DNS enumeration, zone walks, and live service fingerprinting against targets you register. No agents required.
- ›api.acme-corp.io: nginx 1.24.0, port 443
- ›staging.acme-corp.io: TLS expires in 8 days
- ›admin.acme-corp.io: HTTP basic auth form exposed
- ›metrics.acme-corp.io: Prometheus :9090 unauthenticated
- ›grafana.acme-corp.io: Grafana 10.x, default credentials
- ›vault.acme-corp.io: HashiCorp Vault UI, Shamir unseal
- ›dev.acme-corp.io: Node.js inspector :9229 on 0.0.0.0
- ›legacy.acme-corp.io: MinIO :9000, public bucket listing
- ›HTTPS :443 (8 hosts)
- ›SSH :22 (2 hosts, production)
- ›Prometheus :9090 - unauthenticated metrics
- ›Grafana :3000 - default admin password
- ›Redis :6379 - no auth, staging
- ›PostgreSQL :5432 - public-facing, dev
- ›Node.js debug :9229 - public, 0.0.0.0
- ›MinIO :9000 - public bucket listing
#correlation
CVE correlation
Every service and version Samaritan fingerprints during a scan is checked against known CVEs. The result is not a raw port list: it's a scored finding with CVSS, severity, and the evidence that triggered the match.
#alerting
Alerting and prioritization
Every alert shows why it was prioritized: asset criticality, exposure context, and correlation confidence, not just what triggered it. Noise without context creates alert fatigue. Samaritan gives you both.
Prometheus metrics endpoint unauthenticated - full topology exposed
Why prioritized
metrics.acme-corp.io:9090 exposes /metrics with no authentication. The data includes internal service hostnames, latency histograms, and error rates; enough to map internal topology. Grafana on the same host accepted admin/admin login, making credential extraction the next obvious step.
metrics.acme-corp.io (54.203.118.42:9090)
Unauthenticated RCE surface - Node.js V8 inspector on public interface
Why prioritized
dev.acme-corp.io:9229 accepts connections from 0.0.0.0 with no authentication. The V8 inspector protocol permits arbitrary JavaScript execution in the Node.js process. PostgreSQL :5432 is also public-facing on the same host, meaning code execution grants direct database access without credential requirements.
18.184.99.128 (dev.acme-corp.io)
#reporting
Reporting and dashboards
Posture score tracks over time, not just a point-in-time grade. Remediation progress, asset coverage, and mean detection time are all visible without building your own dashboards.
Audit-ready exports
Every finding exports as a structured JSON record with the affected asset, matched CVE ID, CVSS score, severity, and evidence. One record per ScanResult.
Posture trending
Your overall risk grade updates as new findings are discovered and existing ones are remediated. The trend is visible at a glance across scans without building a custom dashboard.
Asset-level drill-down
Every tracked target (host, domain, port range) has its own finding history, so you can see exactly which assets have recurring exposure patterns across scans.
Map your surface. Close the gaps.
scoped to targets you register · no credentials required to start