ONUS - Automated Vulnerability Assessment & Penetration Testing

A locally-hosted, air-gapped VAPT tool: point it at an authorized target domain and it runs 8 scanning modules in parallel, deterministically scores every finding (CVSS v3.1), optionally adds AI-generated plain-English descriptions via a local LLM, and produces a PDF report plus a live web dashboard. No external API calls - everything runs on your own network.

Two ways to run ONUS:

Self-hosted (this repo): docker compose up → enter a domain → tick the authorization box → scan. No account, no sign-in, no email verification - it's single-operator by design, and everything below covers this path.

Hosted: a managed instance is live at tryonus.tech. It layers on production-only features (accounts / OAuth sign-in, a scan queue, per-user history) that default off in this repo, so self-hosting stays simple. See Self-hosted vs hosted.

Features

8 parallel scanning modules (Celery) - network recon (ports/services/subdomains/DNS/WHOIS), web app scanning (ZAP + Nikto + Katana), SSL/TLS config, HTTP security headers, OWASP Top 10 checks, tech fingerprinting/WAF detection, CVE scanning (Nuclei), directory enumeration (FFUF).
Deterministic CVSS v3.1 scoring - severity, CVSS score/vector, priority, and OWASP category are computed from a rule catalogue, never guessed by an LLM. Two runs of the same scan produce byte-identical numeric fields.
Confidence verification - findings are passively re-checked (non-destructive re-observation only) and tagged confirmed / probable / unverified rather than silently dropped.
Optional local AI analysis - Ollama + Qwen 2.5 7B turns scored findings into plain-English descriptions and remediation steps. Fully air-gapped; the tool works without it (see Quick start below).
Context-aware, actionable remediation - every finding ends with a concrete next step. Stable issues use deterministic templates; genuinely context-dependent ones use the AI; and managed-platform detection (Vercel / Cloudflare / Netlify / GitHub Pages / …) means a platform-owned TLS finding says who controls that layer and what to do next, instead of impossible "edit your server config" advice.
PDF report + web dashboard - WeasyPrint-rendered report and a Next.js dashboard, both driven by the same scored/described findings.

Self-hosted vs hosted

	Self-hosted (this repo)	Hosted (tryonus.tech)
Setup	`docker compose up`	none - just open the site
Sign-in	none - single operator	account / Google / GitHub OAuth
Scan flow	domain → authorization box → scan	same, after signing in
Extras	-	scan queue, per-user history, hosted email
Runs on	your own network, air-gapped	managed cloud

The self-hosted default path is intentionally the simple one: no sign-up, no email verification, no OAuth. The hosted-only features (authentication, scan queue) live behind config flags that default off (REQUIRE_AUTH=false, HOSTED_QUEUE_ENABLED=false; see Configuration) and are not set in docker-compose.yml - so running ONUS locally never puts you behind a login. Prefer zero setup? Use the hosted site at tryonus.tech.

Screenshots

New Scan	Live Scan Status

Report Dashboard	Scans Discovery

Architecture

domain → [recon | webscan | ssl_tls | headers | owasp | tech_fingerprint | nuclei | enumeration] (parallel, Celery)
       → any module failed/timed out? → pause for operator retry/continue/cancel
       → aggregator (dedup + OWASP-map + sort)
       → confidence verification (passive re-observation)
       → deterministic CVSS scoring
       → Ollama (Qwen 2.5 7B) AI analysis
       → WeasyPrint PDF + PostgreSQL
       → dashboard / PDF download

Six layers: Next.js frontend → FastAPI → Celery/Redis → 8 parallel scanning modules → Ollama (Qwen 2.5 7B) → WeasyPrint PDF + dashboard. Full details in ARCHITECTURE.md (schemas, contracts, guardrails) and docs/QUICK_REF.md (quick lookup for common changes).

Prerequisites

Docker + Docker Compose v2
~8GB free disk. The built images total ~6.8GB (backend and worker are ~3.25GB each - they bundle Nuclei templates and a headless Chromium via Playwright - plus a ~270MB frontend), and the build itself needs headroom on top.
~6GB free RAM. The ZAP sidecar alone is capped at 4GB (mem_limit: 4g), and Postgres, Redis, the API, the worker and the frontend run alongside it.
First build takes roughly 10-15 minutes on a decent connection.

Quick start

See Prerequisites above: ~8GB disk and ~6GB RAM, and expect a 10-15 minute first build.

cp .env.example .env
cp backend/subfinder-config/provider-config.yaml.example backend/subfinder-config/provider-config.yaml
docker compose up -d
docker compose ps        # wait for zap to report healthy (~2 min)

Open http://localhost:3000, enter a domain, tick the authorization box, and start the scan.

No sign-in, sign-up, or email verification. Self-hosted ONUS is single-operator by default - there's no account step between opening the dashboard and scanning.

This works with no Ollama install. CVSS/severity/priority scoring is always deterministic (analysis/cvss_scorer.py) - without Ollama running, findings just get a rule-based description template instead of AI-generated prose. See "Optional: enable AI-generated descriptions" below to turn that on.

Zero API keys are required to run this tool. Every scanning tool it wraps (nmap, ZAP, Nikto, testssl.sh, Nuclei, Amass, Naabu, httpx, WhatWeb, WAFW00F, FFUF) and Ollama itself work with no key at all. The subfinder config copy step above is the one optional exception - leaving it as the empty template is fine, subfinder just runs with free/public sources only. To deepen subdomain enumeration, you can add up to two free-tier keys to that file before starting: a GitHub personal access token and a ProjectDiscovery Chaos API key - see the comments inside provider-config.yaml.example.

Optional: enable AI-generated descriptions

Ollama runs natively on the host (not in Docker) so it can use the host's GPU directly; containers reach it via host.docker.internal.

ONUS

Most Popular