About VulnX

Built for the
security-minded.

VulnX is a lightweight, self-hosted web vulnerability scanner designed to run on modest infrastructure — including PHP shared hosting (cPanel). Three phases. One queue. Real evidence.

3Scan phases
19Scanner modules
~2 MBPeak memory
0External deps

Coverage

What the scanner does

Phase 01 Recon Parameter discovery, input-field enumeration, and login-form detection.
Phase 02 Passive Analysis HTTP security headers, TLS/SSL posture, cookie flags, DNS/email security (SPF/DMARC), and technology fingerprinting with CVE lookup.
Phase 03 Active Testing Reflected/stored/DOM XSS, SQL injection (error, boolean, time, union-based), open redirects, SSTI, file inclusion, sensitive-file exposure, weak credentials, and directory enumeration.

Every active finding includes a reproducible proof-of-concept — the exact request that triggered it — plus targeted remediation guidance.

Philosophy

Design philosophy

Security by construction

Built with defense in depth: parameterized SQL, CSRF tokens, HttpOnly/SameSite sessions, ARGON2ID password hashing, SSRF guard, rate limiting on auth and scans, and minimal information disclosure.

Evidence over noise

Findings require proof — reflected markers, timing differentials, leaked content — rather than bare status codes. This dramatically reduces false positives in the report.

Built for shared hosting

No daemons, no Redis, no root access required. A single cron-driven worker, file/DB-based queue, and a small memory footprint keep it viable on cPanel accounts.

Ethics

Responsible use

Authorization required. VulnX is a professional tool for authorized security testing. Use it only on systems you own or have explicit written permission to test. Unauthorized scanning can be illegal. Findings are advisory: a clean scan does not prove a system is secure, and a scanner cannot replace a thorough manual assessment.

Stack

Technology stack

PHP 8
Typed, modern, shared-hosting compatible
SQLite or MySQL
Works on any hosting environment
cURL + PDO
Standard PHP extensions, no Composer bloat
Single cron job
One worker drives the entire scan pipeline

We favor boring, dependable technology. The companion bug bounty toolkit collects practical commands and methodologies for authorized testing — a reference library, not a guarantee of results against any particular target.

Honesty

What we do not claim

  1. 01

    "Military-grade" security

    No scanner can guarantee security. We aim to be honest about capabilities, limits, and the nature of automated testing.

  2. 02

    100% coverage

    A clean scan does not mean a system is secure. Automated testing has inherent limitations that manual assessment cannot fully replace.

  3. 03

    Zero-day detection

    VulnX detects known vulnerability patterns backed by evidence. It is not an exploit framework or a threat intelligence platform.