NuajLens Free
A scanner scoped to
the assets you register.
Inventory, scheduled scans, findings that persist between runs, and a PDF on the way out. One Go binary holding a web console, a datastore, a report engine and a scheduler — free to download and run.
Who it is for
Free to run. Including
for a living.
NuajLens is free of charge for any use, commercial use included: a provider can run it to deliver paid assessments to its own clients with nothing to buy, no seat count and no cap on assets, scans or customers. There is no paid tier holding the useful half.
Providers
One console, a book of clients
- Each customer's report covers only their own assets
- Assets carry the customer name and their recipients
- A clean customer is not emailed because another's scan found something
- Your own recipients still receive the full picture
Charge for the assessment. The tool costs nothing.
Internal teams
Answering for your own perimeter
- The inventory is the scope — nothing outside it can be reached
- Nightly, weekly or monthly, without anyone remembering to run it
- Ages, median time to fix and blind spots: the questions an auditor asks
- Self-hosted, so findings and SMTP credentials stay on your host
One binary, one directory, one service account.
Scope
The most dangerous thing a scanner
can do is scan the wrong host.
So the inventory is where targets come from. The scan form and the API take their targets from registered assets rather than from a free-text field, and the scan builder refuses profile arguments that would introduce targets of their own. Every entry is validated on its own — one bad range rejects the edit instead of being dropped silently — and a CIDR block wider than /16 is refused outright, so a typo cannot start a scan of the internet. The aim is to design the failure mode out rather than warn about it.
Inventory
One asset, many ranges
An entry holds a comma- or line-separated list. An office network with three subnets is one asset, not three — and the same range can sit in a nightly critical-only group and a monthly full audit at once.
Guardrail
Arguments cannot smuggle targets
Custom profiles pass extra arguments to the engine verbatim, with one
exception: flags that would introduce targets of their own — -u,
-target, -list, -resume, -config — are
refused when the profile is saved and stripped again before the scan runs.
Blind spots
Never scanned is a number
The dashboard names enabled assets the scanner has never completed a run against. They contribute no findings, which looks identical to being clean.
Out-of-band detection is off until you turn it on, because it sends callback data to a third-party server. Disabling an asset removes it from every scan without deleting its history, and every scan writes an auditable event log.
How it works
Four steps, then it runs itself.
Register the asset
Addresses and ranges you are authorised to test. This list is the scanner's entire world.
Pick a profile
Severities, template tags, protocols, rate limit, concurrency, timeout. Four are built in; duplicate one to make your own.
Put it on a schedule
A five-field cron spec, or @daily and @every 6h.
Schedules reload on change — no restart.
Read the report
A PDF and an HTML summary go out when the scan ends — to your recipients, and to each customer's own.
| Built-in profile | What it is for | Typical cadence |
|---|---|---|
| Exposure Check | Exposed panels, config files, backups, default logins. | Safe to run often |
| Vulnerability Scan | CVEs and known-exploitable issues, medium and above. | Weekly |
| Critical Only | High and critical only. Minimal noise. | Nightly |
| Full Audit | Every template, every severity. Slow. | Monthly, or before an audit |
Pace
The profile says what to look for.
The pace says how hard to push.
Chosen per run, so one profile covers both the maintenance window and the continuous background sweep. It scales the profile's rate limit and concurrency; effective values stay capped, so no pace can turn a mistyped rate limit into an attack on your own network. The pace is recorded on the scan, which is what explains why one run took twenty minutes and another took four hours.
| Pace | What it changes | May resolve findings |
|---|---|---|
| Background | ⅕ the rate, ¼ the concurrency, wider timeouts. | No |
| Gentle | Half rate and concurrency, wider timeouts. | No |
| Normal | The profile exactly as it was authored. | Yes |
| Aggressive | 2.5× the rate, 2× the concurrency. | Yes |
A slower pace never shortens a timeout — it widens it, because a tight deadline on a slow target manufactures false negatives. And a throttled run closes nothing: when you have deliberately asked for fewer requests, silence is not evidence that anything was fixed.
Console
Findings land while the scan
is still running.
Progress, request rate and results stream over Server-Sent Events — one direction, reconnects on its own, through any proxy that does not buffer. The dashboard refreshes every five seconds, so counts climb during a run rather than jumping at the end.
Security posture
critical and high, still open
Critical exposure
4 critical findings need immediate attention.
The first figure is how long the oldest unfixed critical or high has been sitting there, because that is the one that says whether anything is being fixed. The total number of open findings is not a headline anywhere here: on a real estate it is nine parts informational, and a panel that leads with it ranks by how much was found rather than by what needs work.
Open critical and high
last 14 days| Day | Open critical + high |
|---|
How long they have been open
22 open findingsc/h is the critical and high findings inside that band. Every finding in the oldest two bands here is one of them — that is the number worth acting on.
Where the risk sits
ranked by what needs work, not by how much was found3 assets have never been scanned — warehouse-lan, dr-site, kiosk-vlan
Informational findings usually outnumber everything else several times over. Counted into the ranking they decide it, so they are counted and named but never drawn — and the assets nobody has scanned are listed underneath, because a host with no findings and a host nobody looked at report the same zero.
Findings
A finding is one issue,
not one sighting.
Results are deduplicated by a fingerprint of template, host, matched location and extracted value — so the same problem seen in twenty scans is one row with an accurate first sighting.
| Finding | Host | Severity | Status | First seen | Last seen |
|---|---|---|---|---|---|
| Unauthenticated admin API | 10.0.1.9:8080 | critical | open | 63 d ago | today |
| Exposed .git directory | 10.0.0.7:80 | high | open | 12 d ago | today |
| Default credentials | 10.0.1.9:22 | high | accepted | 41 d ago | today |
| TLS 1.0 accepted | 10.0.1.24:443 | medium | open | 6 d ago | today |
| Weak cipher suite | 192.168.5.2:443 | medium | resolved | 28 d ago | 9 d ago |
| Missing HSTS header | 10.0.1.24:443 | low | false positive | 55 d ago | today |
Resolution
Two silences, not one
A finding must be missed by two consecutive completed scans before it closes. A template can fail to fire on a dropped connection or a rate limit; one silence is not evidence.
Reach
Only what the scan could see
A Critical Only run never loads a medium-severity template, so its silence says nothing about a medium finding. Resolution considers only findings within the profile's reach. A failed or cancelled scan resolves nothing at all.
Triage
Your decisions stick
Accept a risk or flag a false positive and the state survives future scans. Those two statuses are yours — no scan moves a finding out of them.
Scan engine
The engine can move forward
without you trusting a download.
Detection runs on nuclei, and templates change daily while the engine changes every few weeks — so the two update independently, and neither waits on a package release. What arrives from the network still has to prove what it is before anything runs it.
Floor
The bundled engine cannot be touched
A matching nuclei binary ships inside the package, owned by dpkg or rpm and outside the one path the systemd unit makes writable — the service cannot modify or delete it. It is the version the release was tested against, and the version everything else falls back to.
Chain of custody
An update proves itself first
Before a fetched build can become the engine it has to:
- arrive over HTTPS — a redirect off TLS aborts the download
- match the SHA-256 published in the release checksums
- unpack under a size ceiling, writing only the path intended
- report a version matching the release tag
- parse the installed template set
Only then does the active pointer move, by atomic rename — a scan starting mid-swap sees one version or the other, never a broken link. Any failure discards the download and leaves the running engine untouched.
Reversible
A way back that always exists
Every engine on the host is listed with the running one marked, and revert returns to whatever was active before. The bundled engine is never garbage-collected, so a rollback target exists even on a host that has been offline since install. Version changes are refused while a scan is in flight, and each scan records the engine that produced it.
Or turn it off: engine-updates = off pins the install to the bundled binary and makes the API refuse version changes — restoring the property that every executable the service runs is read-only to it, at the cost of the engine only advancing when the package does.
Reports
A PDF lands in the right inboxes
when the scan ends.
The message body carries an HTML summary; the attachment carries a cover verdict, severity counts, the highest-priority findings, and what moved since the previous run.
Delivery
Rules, not reminders
- Automatic after every scheduled scan
- A severity floor — below it, nothing is sent
- On demand for any scan, any time
- CSV export of the current filter, uncapped
Multi-tenant
One install, many customers
- Give an asset a customer and a recipient list
- Each customer's PDF covers only their assets
- One customer's report never carries another's findings
- Your own recipients still get the full picture
Built for the operator running one console across a book of clients.
Install
One package, then a URL and
a certificate fingerprint.
The package bundles the open-source nuclei scan engine, creates the service account, installs a hardened systemd unit, generates a self-signed TLS certificate and starts the service. The certificate is generated before the service is started, so the console is not served in plaintext during setup.
Access
NuajLens is free. The download is by request.
There is no licence key, no seat count and no trial timer — but NuajLens is licensed rather than public domain, and builds are served from download.nuaj.com, which is opened per organisation. Read the licence, then send one email to our helpdesk and we grant your access, usually the same business day.
- 1 Read the licence
- 2 Email helpdesk
- 3 Access granted
- 4 apt install nuajlens
Nothing to fetch at install time
One package on Debian, Ubuntu, RHEL, Fedora, Rocky, Alma and openSUSE, for x86_64 and aarch64. Your own package manager installs it, so nothing new has to be trusted to run on the host.
The install pulls nothing down: every part of NuajLens, the scan engine included, is already inside the package. An air-gapped host installs exactly the same way.
One directory of state
/opt/nuajlens/ ├── bin/ nuajlens + scan engine ├── nuajlens.conf configuration └── data/ db, scan logs, templates, cert
Backup, migration and removal are each a single path. Removing the package keeps that directory, so a reinstall finds your scan history again; purging it takes everything.
Once your access is granted, NuajLens installs from the nuaj package repository by name — apt install nuajlens or dnf install nuajlens. Your access email carries the repository setup for download.nuaj.com: one keyring and one source line, added once per host. From then on your package manager verifies every install and every upgrade against that key, and there is nothing to check by hand.
Requesting access records your acceptance of the End User Licence Agreement. NuajLens is supplied free of charge and without warranty; you are responsible for holding authorisation to test every asset you register.
Questions
The things worth knowing
before you install it.
What does it cost?
Nothing, for any use including commercial use. There is no licence key, no seat count, no trial timer and no paid tier holding half the product. It is source-available rather than open source: the source is published so anyone running a scanner against their own network can read what it does, but redistributing or mirroring it is not permitted.
If it is free, why is the download gated?
Because it is licensed rather than placed in the public domain, and builds are served per organisation so that every copy in circulation traces back to a known origin. One email to the helpdesk names your organisation and records your acceptance of the licence; access is usually granted the same business day, and it costs nothing.
Does anything leave my network?
The console, the database and every report stay on your host. Two things reach outward: the nuclei template set, which is fetched from upstream because it changes daily, and out-of-band detection — which is off until you turn it on, precisely because it sends callback data to a third-party server. Reports travel only through the SMTP server you configure.
Is this a penetration test?
No. It is template-based detection run against services you own: it finds what a template can recognise, on a schedule, and tracks what happens to each finding afterwards. It does not chain findings together, exploit anything, or exercise judgement. An empty report is not a clean bill of health, and the licence says so in as many words.
How does it decide something has been fixed?
Carefully, because reporting a live vulnerability as fixed is the worst thing it could do. A finding must be missed by two consecutive completed scans, and only by scans that could actually have seen it — a Critical Only run never loads a medium-severity template, so its silence says nothing about a medium finding. Deliberately throttled runs resolve nothing, and a failed or cancelled scan resolves nothing at all.
What does it need to run?
A Linux host with 2 GB of memory, amd64 or arm64, and a .deb or .rpm. It installs as its own service account under one directory, and serves the console over HTTPS on port 8443 with a certificate generated before the service first starts, so the login form is never presented over plaintext. Your own certificate, or a reverse proxy in front, are both supported.
Can I run it for my clients?
Yes — that is what the customer fields are for, and the licence permits paid work delivered with it. Give an asset a customer and a recipient list, and that customer receives their own report covering only their assets. The scoping is applied to the findings query itself, so no path exists by which one customer's finding, hostname or asset name reaches another's report.
What am I allowed to scan?
Assets you own or hold documented authorisation to test. Registering an asset is a statement that you do, and that obligation is section 4 of the licence. The product is built to make that the easy path — targets come only from the inventory, wide CIDR blocks are refused, and profile arguments cannot introduce targets of their own — but none of that is a substitute for the authorisation itself.
What happens if I want it gone?
The installer removes it: --uninstall keeps your data, --purge takes everything and asks first. Nothing is written outside /opt/nuajlens, so backing the install up, moving it to another host, or removing every trace of it are each one path.
Anything else — helpdesk@nuaj.com.