ARISE-XTI — AI-Powered Intelligent Attack Surface Management

Autonomous Recon, Intelligence, Security & Exposure — an AI-powered intelligent Attack Surface Management platform.

ARISE-XTI turns a single domain into a continuously-monitored external attack surface. A 28-module pipeline runs the full adversary workflow — discovery, enumeration, fingerprinting, web/API/cloud exploitation, OSINT and intel enrichment — then an autonomous AI pentester (AriseAI) reasons over every piece of evidence, ranks attack hypotheses, chains them into CAPEC v3.9 / MITRE ATT&CK kill chains and live-verifies the top candidates. Everything lands in a single Flask dashboard with KEV/EPSS-blended exploitability ranking, L0–L6 evidence ladder, SLA clocks and asset-ledger diffing.

What makes ARISE-XTI different

• AI-first triage — AriseAI reads every scan artifact, picks the highest-signal hypotheses and verifies them against the real target before anything is marked "confirmed".
• Evidence-driven — zero AI-only findings. Every proven issue carries a baseline-vs-attack diff you can replay as curl.
• Full stack coverage — web, API, cloud, TLS, SBOM, DNS, MCP/AI surface, Shodan/Censys/GreyNoise enrichment, autonomous red-team emulation.
• Operator-ready — KEV/EPSS priority, SLA tracking, saved views, CSV/JSON export, Slack hand-off.

---

Table of Contents

• Dashboards
• Quick Start
• Installation
• How to Use
  • Running the Dashboard
  • Running a Scan
  • Reviewing Results
  • AriseAI Red Team Pentesting
  • Attack Path Analysis
  • Incremental & Selective Scans
  • Exporting & Reporting
• Pipeline Modules
• API Keys & Secrets
• Configuration Reference
• Repo Layout
• Acknowledgements
• License

---

📸 Dashboards

Overview — risk score, attack chains, asset ribbon	Issues — KEV/EPSS-ranked, SLA-tracked
Attack Surface — adversary-perspective inventory	Attack Paths — CAPEC chains to crown jewels
CVEs — KEV/EPSS-blended	Assets — all hosts, IPs, WAF/CDN posture
URL Inventory — classified endpoints	API Security — BOLA/BFLA with evidence ladder
Cloud — AWS/GCP/Azure + takeover chain	SSL / TLS — SSL-Labs-style per-host grades
SBOM — components × versions × hosts	OSINT — brand, breach, code, impersonation
Shodan — external-view correlation	Red Team — AriseAI autonomous pentester
Changes — asset / port / finding diff

---

⚡ Quick Start

🐳 Docker (fastest — 30 seconds)

docker run -d --name arisexti -p 5059:5059 \
  -v arisexti-scans:/app/scans \
  -v arisexti-state:/app/state \
  piratesshield/arisexti:latest

Open http://localhost:5059 → log in with admin / admin.

Image: piratesshield/arisexti on Docker Hub.

🖥️ Native install

./setup.sh                                          # one-shot installer (macOS/Linux)
./easm-pipeline.sh example.com                      # run a scan
python3 dashboard.py                                # open http://localhost:5059

Default login: admin / admin — change ARISE_ADMIN_PASSWORD before exposing the dashboard.

---

🔧 Installation

Pick one of the three paths below.

Option A — 🐳 Docker (recommended)

The official image on Docker Hub ships every binary (subfinder, nuclei, naabu, katana, dnsx, puredns, massdns, nmap, Chromium for Playwright, etc.) — no local Go toolchain, no brew/apt, no PATH fights.

# Pull the latest build
docker pull piratesshield/arisexti:latest

# Run the dashboard (host port 5059)
docker run -d --name arisexti \
  -p 5059:5059 \
  -v arisexti-scans:/app/scans \
  -v arisexti-state:/app/state \
  piratesshield/arisexti:latest

# Open http://localhost:5059 (admin / admin)
docker logs -f arisexti

With API keys (recommended — enables AI analyst, Shodan, Censys, etc.):