🚀Scans

Scanning using a fleet of Ax instances

Modules: For a comprehensive overview of Ax scan modules, see Modules

ax scan is an amalgamation of the various Ax scripts (~/.axiom/interact) and operations. Its designed to provide an easy way to distribute any binary or script. The only requirements are:

  • The tool you wish to distribute needs to be installed on the remote instances.

  • On the ax controller, use one of our preexisting modules or create your own. The module specifies the command to execute on the remote instances in parallel (must be a valid JSON file in ~/.axiom/modules)

  • When creating custom modules, make sure to add the appropriate extension to the module's ext key:value pair. This tells ax scan how to download and merge the results.

  • Spin-up some instances beforehand using ax fleet and make sure they are selected (ax select '\*')

    • Optionally use ax scan ... --spinup $N argument to specify how many instance to spin up at runtime.

  • Finally, execute the appropriate ax scan command, specifying the input file to distribute and the module you want to execute across the fleet ax scan my-targets.txt -m ffuf

Source Code: ax scan is written in bash making it very easy to review. For a detailed step-by-step walk-though of how ax scan works under the hood, its highly recommended to read the comments in the source code!

With ax scan, every instance executes the same command, specified in the module. Ax scan splits the user-provided target list (e.g., a list of IPs) into equal parts per instance. For example, if you have a target list of 10 IPs and 5 instances selected, the target list is divided into 5 equal parts (2 targets per instance). Each target list is uploaded to the appropriate instance using axiom-scp.

To prepare the instances before the actual scan is executed, ax scan creates a unique folder on all remote instances to store the data needed for that particular scan invocation (/home/op/scan/$module+timestamp).

A unique tmux session is created on each remote instance to handle the execution. If you ax ssh into the instance, you can attach to the tmux session (tmux a -t $module+$timestamp) in real-time (results are also automatically streamed from each remote instance and returned to the terminal).

Locally, ax scan creates a separate local scan working directory for each scan invocation, located ~/.axiom/tmp/$module+timestamp. Optional user provided command-line arguments are passed to the module (extra args) and are combined with the commands in the module. The final command is stored in a local file and then uploaded to every instance participating in the scan. Some of the data stored in the local scan working directory includes the command to run on the instances, the path of the temporary ssh sockets used for the scan, the axiom sshconfig, the input file, the results and the status of each scanner, located ~/.axiom/tmp/$module+timestamp.

Some logging operations are executed on the remote instances to redirect stdout and stderr to a file in the instances remote scan working directory. These files are collectively tailed across each instance and streamed to the ax contoller's terminal in real-time.

When any particular instance is finished with its portion of the total scan, ax creates a $(hostname) file in the instance's remote scanning working directory. During the scan, Ax checks for each $(hostname) file to know that part of the scan has completed. Once all instances have created their $(hostname), or if Ax can no longer communicate to ALL of instances in the selected fleet or if --max-runtime is exceeded, the scan is considered complete and merging starts.

Scan results are downloaded periodically during the scan and once again after the scan completes, just in case.

ax scan

Modules must be located in ~/.axiom/modules/. For more information about modules, see modules.

PreviousFleetsNextModules

Last updated