Recon
DNS enumeration, subdomain discovery, WHOIS lookups, and open port detection.
ONUS scans your website with eight trusted security tools at once, then explains what it found in plain English, ranked by what to fix first.
Authorized targets only · No card required · Self-host or hosted
2
Critical
5
High
8
Medium
4
Low
How it works
No tool-chaining, no parsing raw scanner output, no guessing which finding matters.
Enter a host you are authorized to test and confirm authorization. ONUS refuses private ranges and unverified targets.
Recon, web, TLS, headers, OWASP, fingerprinting, CVEs and directory enumeration execute in parallel, not one after another.
Findings are de-duplicated, re-verified, scored against CVSS v3.1, and written up in language a non-specialist can act on.
Coverage
Every module is a real, industry-standard scanner, normalized into one report instead of eight incompatible outputs.
DNS enumeration, subdomain discovery, WHOIS lookups, and open port detection.
Active vulnerability scanning via OWASP ZAP and Nikto, plus JS-aware crawling with Katana.
Certificate validity, cipher strength, protocol versions, and HSTS enforcement.
Checks all security response headers: CSP, X-Frame-Options, HSTS, CORS, and more.
Tests for injection, broken auth, XSS, IDOR, security misconfigurations, and open redirects.
Identifies CMS, frameworks, and outdated software; detects WAF presence.
Template-based scanning for known CVEs, misconfigurations, and exposed panels.
Brute-forces hidden files, directories, and admin panels via FFUF.
Why it matters
Most tools hand you a wall of raw output and a severity number you cannot audit. ONUS is built the other way around.
Every severity, CVSS score and priority is computed from the official CVSS v3.1 formula in code. Run the same scan twice and the numbers are byte-identical. The AI never produces a rating.
Before anything is reported, ONUS passively re-observes each finding to check it still reproduces. Results are labelled confirmed, probable, or flagged for manual review, never quietly dropped.
Each finding gets a plain-English explanation of the real-world impact plus concrete remediation steps, so the people who have to fix it do not need a security background.
Security
ONUS is a testing tool for systems you own or have written permission to assess. Those limits are enforced in code, not left to a checkbox.
Read how scans are governedEvery scan requires a confirmed authorization flag, logged with a timestamp and operator.
RFC 1918 addresses, loopback and localhost are refused before a job is ever queued.
Active checks use read-only payloads. ONUS proves a weakness exists; it never weaponizes it.
Self-hosted, every scan and the analysis that follows stay on infrastructure you control (the AI runs locally). On the hosted service, scanning and the deterministic scoring run on ours, but the plain-English write-ups are generated by a third-party model API, so findings text is sent there for that step.
No. Every finding is written twice: a plain-English explanation of what it means and why it matters, and a set of concrete remediation steps for whoever implements the fix.
Any domain or public IP you own or have written authorization to test. ONUS rejects private ranges and localhost outright, and full active scans require proving control of the target first.
That depends on how you run it. Self-hosted, scanning and analysis both execute on your own infrastructure and nothing about your targets leaves it; the AI runs locally via Ollama. On the hosted service at tryonus.tech, scanning and the severity/CVSS scoring run on our infrastructure, but the plain-English descriptions are generated by a third-party model API, so findings text (titles, short evidence snippets, and the target hostname) is sent there for that step only. The scoring is computed locally and is identical either way; only the narrative generation differs.
From the official CVSS v3.1 base-score formula, implemented in code with a per-finding vector. The language model only writes prose. It never sets or overrides a number.
The eight modules run in parallel rather than in sequence. Most assessments finish in minutes; timing depends on target size, latency and whether rate limiting is in play.
Yes. ONUS runs entirely on your own hardware via Docker Compose, with no outbound dependencies at scan time. The source is on github.com/maverickaayush/ONUS. A hosted tier is available if you would rather not operate it yourself.
ONUS helps you uncover vulnerabilities in your website, understand their real impact in plain English, and fix them with clear, prioritized guidance. It combines trusted security scanners into one workflow so both technical teams and non-security users can act on the results with confidence.