Scana
Security testing on your own servers.
Scana is a self-hosted control plane for authorised security tests. Register the targets you own. Run the scans. Get a graded certificate with a fix for every finding.
How it works
3 steps- 01
Register.
Add a target you own and prove it with one DNS record. Scana only ever scans what you have registered.
- 02
Scan.
More than 15 scanners, including nmap, nuclei and httpx, run on your own servers.
- 03
Fix.
You get a grade, and a fix for every finding. Each pen test ends in a graded certificate.
What you get
Open sourceMore than 15 scanners
nmap, nuclei, httpx and more, run from one place with one set of results.
Proof of ownership
A target has to pass a DNS check before anything runs against it.
Graded certificates
Every pen test finishes with a grade and a certificate to keep.
A fix for each finding
Findings come with the steps to close them, not just a severity.
Docker or Kubernetes
A guided installer sets up one machine, or installs the Helm chart into your cluster.
Runs on your servers
The scanners, the database and the reports all run on machines you control.
Run it yourself
No account. No licence key.There is no account to create, no licence key to paste and no plan to pick. It is open source and free to use.
You need
- Bash, curl, jq and OpenSSL
- Docker with Compose, or Helm and kubectl for Kubernetes
git clone https://github.com/ChxisB/scana.gitcd scanasudo install -d -m 700 -o "$(id -u)" -g "$(id -g)" /opt/scanabash deploy/install.sh --method dockerThe installer asks for your domain and how people sign in, then generates the database password, encryption key and setup code. Run it again to upgrade.
Free, and staying free.
Scana is open source and free to use. There are no plans, no seats and no licence keys. If Scana saves you time, you can say thanks with a coffee.