ExploitSynth CLI

The command-line client for the ExploitSynth scanner. Install it, authenticate, and run scans from your terminal.

Quickstart

Three commands from zero to a first scan. Create a key under Settings → API keys (or follow the guided setup), then:

bash

pipx install exploitsynth
exploitsynth login
exploitsynth scan scan.exploitsynth.com --scope top100

Discovery and every probe run from your machine, so you can scan anything you can reach. You're billed one credit per open port identified.

Installation

Install with pipx. It keeps the CLI isolated in its own environment and on your PATH. Requires Python 3.9+ on Linux, macOS, or WSL.

bash

pipx install exploitsynth

Authentication

Create a key under Settings → API keys, then run login once. The key is stored at ~/.config/exploitsynth/config.json with owner-only permissions. For CI or ephemeral shells, export it instead.

bash

exploitsynth login
# CI / ephemeral shells:
export EXPLOITSYNTH_API_KEY=sk_your_key_here

Scanning

Every scan runs from your machine: the CLI discovers open ports locally and opens a short-lived reverse tunnel so the agent's probes egress from your network. You reach whatever your machine can reach — public hosts, or internal targets once you're on the network (client VPN, on-site LAN, HTB, …).

New scan

Identify ports you already know are open, or let the CLI discover them first. A target can be a single IP, a CIDR range, or a list.

bash

# identify known-open ports
exploitsynth scan 203.0.113.9 --ports 22,80,9929

# discover open ports first, then identify
exploitsynth scan 10.0.0.0/28 --scope top1000
# scope: top100 | top1000 | all, or a range like 1-1000

Continue from another scanner

Import an nmap or Nessus report and scan only the ports it left unidentified.

bash

exploitsynth scan --nessus engagement.nessus --project acme
exploitsynth scan --nmap recon.xml

Private / internal targets

Get on the network first (client VPN, on-site LAN, HTB, …), then scan the target as usual — discovery and probes route through this machine, so it reaches anything you can. nmap must be installed locally; chisel (the tunnel) is downloaded automatically and exists only while the command runs.

bash

sudo openvpn engagement.ovpn     # you can now reach 10.129.45.12
exploitsynth scan 10.129.45.12 --scope top1000

Commands

Command	Description
`login`	Store and verify your API key.
`scan TARGET`	Start a scan, then stream live progress. See options below.
`scans`	List recent scans (use `--project` to filter).
`show ID`	Print a scan's full results (add `--reasoning`for the agent's notes).
`credits`	Show your credit balance.
`cancel ID`	Cancel a queued or running scan.

Scan options

Option	Description
`--ports`	Known-open ports to identify directly, e.g. `22,80,9929`.
`--scope`	Discovery scope: `top100`, `top1000`, `all`, or a range like `1-1000`.
`-iL FILE / -`	Read targets from a file, or from stdin when the target is `-`.
`--nessus / --nmap`	Import a report and scan its unidentified ports.
`--project`	Engagement to file the scan under (created if it doesn't exist).
`--label`	Optional label for the scan.
`--timeout`	Per-port time limit in seconds (30–600, default 300).
`--slow`	Run one agent at a time instead of three.
`--yes`	Skip the credit-cost confirmation prompt.
`--json`	Emit machine-readable JSON on stdout (also on `scans`, `show`, `credits`). Progress goes to stderr, so pipes stay clean.