ARTEX: Automated Recon and Threat Exposure Analysis for Your Own Web Services

TL;DR: ARTEX is a free Flask-based web security platform that automates subdomain enumeration, port scanning with risk ratings, DNS and SSL/TLS analysis, technology fingerprinting and Groq AI-powered recommendations with owner and hunter report views plus PDF and JSON export. Install it on Linux with Python, nmap and pip, point it only at systems you own or may test, and harden what it finds. Full scan tour, install walkthrough and honest limits inside.

What ARTEX Is

ARTEX security scanner is an advanced web application security analysis platform that automates reconnaissance, vulnerability scanning, threat assessment and AI-powered security recommendations for modern web applications and infrastructure.

That is the project own description, and the codebase backs every word of it. ARTEX V2.0, Automated Reconnaissance and Threat Exposure Analyzer, is a self-hosted Flask web application by IlyassCODEX at https://github.com/IlyassCODEX/ARTEX, roughly 221 stars and 138 forks across 32 commits at the time of writing. You type a domain into a Bootstrap web form, tick the modules you want, pick an intensity, and a threaded scan engine fans out across subdomains, ports, DNS, certificates, technology fingerprints and authentication surfaces, then stitches everything into a risk-scored report with an AI analyst writing owner and hunter perspectives. Results stay on your machine, exports come as PDF or JSON, and a small REST API lets other tooling drive it.

Why Hams Running Web Services Should Care

Ham radio grew a web habit. Cluster dashboards, propagation maps, satellite trackers, web SDR receivers, logbook portals, club membership pages, AllStar status boards, personal blogs like this one. Many sit on a VPS or a home server, reachable from the whole internet, maintained in spare time between activations. Every one of them is a small public web service with the same exposure as a startup landing page and a fraction of the security budget.

ARTEX fits exactly there: the authorized self-scan before someone else scans you. Point it at your own domain after an update, read the subdomain list for forgotten staging hosts, check the open ports for a database console you exposed during debugging, confirm TLS didn’t regress to a weak protocol, and fix the findings on your own schedule. Security teams call this attack surface management. For a club webmaster it is simpler: know what your server looks like from the outside, because scanners, researchers and opportunists already look.

One boundary first, stated the way the project states it. This tool is for authorized security assessments only. Scanning systems you don’t own and have no permission to test is illegal in most countries, including under Malaysia Computer Crimes Act 1997 for local readers, and against the acceptable use of nearly every hosting provider. Everything below assumes your own domains, your own lab, your own written scope.

What ARTEX Actually Scans

The scan form exposes nine toggles plus intensity, and each maps to a real module in the repository. Light caps subdomain work at 10 hosts, normal at 30, aggressive at 100. So intensity is mostly a breadth dial for the enumeration phase.

Subdomain enumeration combines wordlist probing with certificate transparency style discovery in modules/subdomains.py and modules/enumeration.py, around 300 lines each. Expect the usual finds on a lived-in domain: old staging hosts, dev subdomains, webmail, autodiscover, forgotten campaign microsites, each one a full login page you stopped thinking about.

Port scanning wraps python-nmap over ports 1 to 1000 with service guessing, per-port risk ratings and batch scanning across targets, plus a quick web scan shortcut. Open ports get a risk label, not just a number, which is what turns a port list into a priority list. A dusty 8080 with a management console outranks an expected 443 by a mile.

DNS scanning covers the record set that leaks architecture: A, AAAA, MX, TXT including SPF posture, NS delegation, CNAME chains and zone hygiene. Misconfigured mail records invite spoofing of your club callsign address, dangling CNAMEs invite subdomain takeover.

SSL and TLS analysis is the deepest module at over 900 lines. It pulls the live certificate chain, parses subject and alternative names, checks hostname matching, fingerprints the public key, probes supported protocols and cipher suites with strength ratings, verifies HSTS including preload readiness, OCSP stapling, certificate transparency logs, CRL revocation data, TLS fingerprints, security headers and even DNSSEC posture for the zone, with classic vulnerability checks including Heartbleed patterns. For a blog or dashboard behind Cloudflare or Lets Encrypt this is the section that confirms your edge config survived the last change.

Technology fingerprinting identifies the stack behind the pages, server banners, frameworks, CMS versions, JavaScript libraries, which matters because exploitability concentrates on outdated components. Authentication surface detection catalogues login forms and exposed admin paths, the pages credential stuffing actually targets. Real IP discovery attempts to find origin servers hiding behind CDNs, the finding that downgrades a whole proxy setup when it succeeds.

The AI Analyst: Owner View and Hunter View

The distinguishing feature is the analyst layer. With a Groq API key added to modules/AI_analyst.py, findings go to the Llama 3 70B chat completions endpoint twice with two different prompts, producing a dual-perspective report. The owner view reads like remediation guidance for the person who has to fix things: what broke, how bad, what to patch first. The hunter view reads like an attacker notes: how the pieces chain together, which finding unlocks the next. Without a key the same pipeline falls back to rule-based analysis, so the tool never hard-requires a cloud account. A separate FastAnalyst module, the largest file in the repo at over 750 lines, handles quicker assessment passes.

Treat the AI output as a junior analyst, not an oracle. Models hallucinate severities, misread chained exploits and occasionally invent remediation steps for software you don’t run. The value is triage speed and readable summaries for non-specialists, like a club committee deciding what to fund. Verify every critical claim by hand before acting, especially anything that suggests aggressive follow-up testing.

Reports, API and Plumbing

Completed scans land in a results view with per-module sections, and export produces PDF reports via reportlab for humans and JSON for tooling. The REST surface is small and predictable: POST /start_scan with domain plus options, GET /scan_status with a progress percentage and current task, GET /results and /api/results, GET /export for the files, plus /health and /api/capabilities. Scan state lives in memory with a background thread per scan, Redis is listed as an optional job queue dependency. Persistence, scheduling and multi-user auth aren’t in this codebase, which tells you the intended shape: a personal workbench on localhost, not a shared enterprise service.

Installing ARTEX on Linux

Prerequisites are Python 3.8 or newer, a system nmap, and optionally wkhtmltopdf plus Redis. On Ubuntu or Debian that is sudo apt-get install nmap wkhtmltopdf, on macOS brew install nmap wkhtmltopdf. Then the familiar flow, noting the upstream clone URL in the README still shows a yourrepo placeholder, so clone the real address:

git clone https://github.com/IlyassCODEX/ARTEX.git
cd ARTEX
python3 -m venv venv
source venv/bin/activate
pip install -r requirements.txt

The requirements pin Flask 2.3.2, python-nmap, requests, dnspython, BeautifulSoup4, reportlab, lxml, pyOpenSSL, cryptography, tqdm and pytest. Two things to know before you install. The tech fingerprinting module imports Wappalyzer, which is missing from requirements, so add python-Wappalyzer plus setuptools below 81 for its resource lookup. And on very new interpreters the old pins fight the toolchain: this box runs Python 3.14, where lxml 4.9.3 has no build, Flask 2.3.2 uses a loader API removed from the stdlib, so the working set here is lxml 6, cryptography 50, pyOpenSSL 26, reportlab 5 and Flask 3.1 installed over the same file, verified booting with a healthy /health response. If the pinned install fails on your Python, retry with modern floors on those five and let pip resolve wheels.

Add a Groq key for the AI layer. Get one free at https://console.groq.com/keys, open modules/AI_analyst.py, and set the groq_api_key field. Leave it empty and the rule-based analyst covers the same report slots with static logic.

Launch with python app.py and open http://localhost:5000. Bind it to loopback only, keep it off the public internet, and guard the machine it runs on, because a scanner holds the same credential material and target lists you would least like to leak.

Running Your First Authorized Scan

Start with your own domain and the normal intensity. Enable every module on the first run to learn the full report shape, then disable what you don’t need on repeats. Light intensity suits quick checks after a config change, aggressive suits a quarterly review of a domain with history. Watch the progress readout, it names the current phase, then walk the report top to bottom: subdomains for surprises, ports for exposure, SSL for regressions, tech stack for stale components, AI owner view for the fix order.

Work the findings in severity order and rescan to confirm. Close the forgotten subdomain or put auth in front of it. Firewall the stray port or bind the service to loopback. Renew and reconfigure the weak TLS endpoint. Update the flagged component. Export the before and after as PDF for your records, and keep the JSON if you want to diff future scans. For a club site, that pair of PDFs is also how you show the committee what the volunteer hours bought.

ARTEX Against the Usual Suspects

The honest read: ZAP remains the tool for hands-on web testing through a proxy, Nuclei wins repeatable template checks in pipelines, and Nmap alone stays the ground truth for what is actually open. ARTEX wins the first hour on a new domain, breadth fast, readable output, AI triage for the fix order. Use it as the survey before the specialist tools, not instead of them.

Honest Limits

Scope the enthusiasm with what the code shows. Scan state is in-process memory, so a restart loses history and concurrent heavy scans share one box. There’s no login system, no scheduling and no multi-tenant isolation, so localhost plus a trusted operator is the deployment model. Pinned dependencies are from the Flask 2.3 era and can need unpinning on new Pythons. The README clone URL still carries a placeholder. Real IP discovery is heuristic, CDN origins sometimes stay hidden. The AI layer needs a third-party key and sends your findings to that API, which is a data-sharing decision to make deliberately. And the eternal caveat: automated scanners miss logic flaws, broken access control and business-process abuse that only a human tester finds. ARTEX tells you what your perimeter looks like. It doesn’t certify you secure.

Sources and Further Reading

• ARTEX repository: https://github.com/IlyassCODEX/ARTEX
• ARTEX AI analyst module: https://github.com/IlyassCODEX/ARTEX/blob/main/modules/AI_analyst.py
• ARTEX SSL scanner module: https://github.com/IlyassCODEX/ARTEX/blob/main/modules/ssl_scanner.py
• Groq API keys console: https://console.groq.com/keys
• OWASP ZAP: https://www.zaproxy.org/
• Nuclei scanner: https://github.com/projectdiscovery/nuclei

73 de 9M2PJU