> For the complete documentation index, see [llms.txt](https://ax.attacksurge.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ax.attacksurge.com/fundamentals/scans/modules.md).

# Modules

All `ax scan` modules must be stored in [`~/.axiom/modules`](https://github.com/attacksurge/ax/tree/master/modules). To create custom modules, see [**Adding Simple Modules**](/fundamentals/scans/modules/adding-simple-modules.md) and [**Adding One-Shot Modules**](/fundamentals/scans/modules/adding-one-shot-modules.md).

[Simple Modules](/fundamentals/scans/modules/adding-simple-modules.md) are bash commands defined within JSON files. `ax scan` can execute any bash command you supply in the module, including loops and sub-shells, as long as it's valid JSON.

[One-Shot Modules](/fundamentals/scans/modules/adding-one-shot-modules.md) allow you to easily thread any binary or script. If the command in the module contains the string `_target_` or `_safe-target_`, `ax scan` automatically executes the module as a One-Shot Module (unless `--disable-oneshot` is used). `_target_` is replaced with the expanded target list that the current thread is running against.

When creating custom modules, make sure to understand how [**Merging and** **Module Extensions**](/fundamentals/scans/modules/merging-and-module-extensions.md) work. These features tell `ax scan` how to download and merge scan results in various formats.

When supplying extra command-line arguments to `ax scan` (also known as `extra_args`), these arguments are combined with the commands in the module. This effectively passes the extra arguments to the binary or script you are distributing at run-time. The final command is executed on all instances in parallel.

To quickly familiarize yourself with the default modules included in Ax, simply run `ax scan --list`.

<figure><img src="/files/ceOm3L7oqh9n3yuPzzUB" alt=""><figcaption><p>modules with long commands were truncated in the above screenshot for readability</p></figcaption></figure>

Ax scan has some optional variable replacements, simplifying the process of dynamically replacing some variables at runtime, such as wordlists, config files, and folder paths.

## Variable Replacements

The following variables will be replaced in both Simple Modules and One-Shot Modules at runtime:

<table><thead><tr><th width="182">Variable</th><th>Replacement and Argument </th></tr></thead><tbody><tr><td><code>_wordlist_</code></td><td><ul><li>A wordlist on the remote instances (<code>-w</code>). </li><li>A local wordlist to upload before the scan (<code>-wL</code>/<code>--local-wordlist</code>)</li><li>A local wordlist to split and upload before the scan (<code>-wD</code>/<code>--distribute-wordlist</code></li></ul></td></tr><tr><td><code>_config_</code></td><td><ul><li>A file on the remote instances (<code>--remote-config</code>)</li><li>A local file to upload to all instances before the scan (<code>--local-config</code>)</li></ul></td></tr><tr><td><code>_folder_</code></td><td><ul><li>A folder on the remote instances (<code>--remote-folder</code>)</li><li>A local folder to upload to all instances (<code>--nuclei-templates</code> or  <code>--local-folder</code>)</li></ul></td></tr></tbody></table>

The following variables will only be replaced in [One-Shot](/fundamentals/scans/modules/adding-one-shot-modules.md) modules at runtime:&#x20;

<table><thead><tr><th width="185">Variable</th><th>Replacement</th></tr></thead><tbody><tr><td><code>_target_</code></td><td>Replaced with the expanded target list that the current thread is running against</td></tr><tr><td><code>_cleantarget_</code></td><td>Replaced with target cleaned from http:// or https://</td></tr><tr><td><code>_safe-target_</code></td><td>Replaced with target automatically quoting for commands, stopping subcommands running</td></tr></tbody></table>

{% hint style="info" %}
**Safe Target**: By default the string `_target_` in the module is automatically replaced with `_safe-target_`, unless the `ax scan` option `--unsafe` is used.
{% endhint %}