NuajLens Free
See what
attackers see.
A free vulnerability scanner that runs on your own server, scans only the assets you register, and hands you the report when it ends.
Register
It scans what you register.
Nothing
else.
The most dangerous thing a scanner can do is scan the wrong host. So every target comes from the assets you register — never from an address typed into a box.
Your inventory
-
edge-perimeterThree ranges, one asset.
-
vpn-gatewayIn a nightly check and a monthly audit at once.
-
mail-relayDisable it and it leaves every scan. Its history stays.
Never reached
-
An address typed by handThere is no field for one.
-
A range wider than /16Refused, so a typo cannot start a scan of the internet.
-
A target slipped into a profileRefused when saved, and stripped again before the scan runs.
Scan
Findings land while
the scan is still
running.
Progress, request rate and results stream to the console as it works. Counts climb during the run instead of jumping at the end.
Findings
A finding is one issue,
not one
sighting.
The same problem seen in twenty scans is one row, with an accurate first sighting. And what you decide about it survives every scan after.
See the same problem
In your findings
Must miss it before it closes
| Finding | Host | Severity | Status | First seen | Last seen |
|---|---|---|---|---|---|
| Unauthenticated admin API | 10.0.1.9:8080 | critical | open | 63 d ago | today |
| Exposed .git directory | 10.0.0.7:80 | high | open | 12 d ago | today |
| Default credentials | 10.0.1.9:22 | high | accepted | 41 d ago | today |
| TLS 1.0 accepted | 10.0.1.24:443 | medium | open | 6 d ago | today |
| Weak cipher suite | 192.168.5.2:443 | medium | resolved | 28 d ago | 9 d ago |
| Missing HSTS header | 10.0.1.24:443 | low | false positive | 55 d ago | today |
Report
A PDF lands in the right inboxes
when the
scan ends.
A summary in the message, the full report attached — to your recipients, and to each customer, covering only their own assets.
- A cover verdict
- Severity counts
- The highest-priority findings
- What moved since the previous run
Sent after every scheduled scan, or on demand. Any findings view exports to CSV.
Who it is for
Free to run. Including
for a living.
Free for any use, commercial included. No seats, no caps on assets, scans or customers, and no paid tier holding back the useful half.
Providers
One console, a book of clients
- Each customer’s report covers only their own assets
- Assets carry the customer name and their recipients
- A clean customer is not emailed because another’s scan found something
- Your own recipients still receive the full picture
Charge for the assessment. The tool costs nothing.
Internal teams
Answering for your own perimeter
- The inventory is the scope — nothing outside it can be reached
- Nightly, weekly or monthly, without anyone remembering to run it
- Ages, median time to fix and blind spots: the questions an auditor asks
- Self-hosted, so findings and SMTP credentials stay on your host
One binary, one directory, one service account.
Scope
The failure mode,
designed out.
Targets come only from registered assets. Arguments that would add targets of their own are refused. One bad range rejects the edit — nothing is dropped silently.
Inventory
One asset, many ranges
An entry holds a comma- or line-separated list. An office network with three subnets is one asset, not three — and the same range can sit in a nightly critical-only group and a monthly full audit at once.
Guardrail
Arguments cannot smuggle targets
Custom profiles pass extra arguments to the engine verbatim, with one
exception: flags that would introduce targets of their own — -u,
-target, -list, -resume, -config — are
refused when the profile is saved and stripped again before the scan runs.
Blind spots
Never scanned is a number
The dashboard names enabled assets the scanner has never completed a run against. They contribute no findings, which looks identical to being clean.
Out-of-band detection is off until you turn it on, because it sends callback data to a third-party server. Every scan writes an auditable event log.
How it works
Four steps, then it runs itself.
Register the asset
Addresses and ranges you are authorised to test. This list is the scanner’s entire world.
Pick a profile
Severities, template tags, protocols, rate limit, concurrency, timeout. Four are built in; duplicate one to make your own.
Put it on a schedule
A five-field cron spec, or @daily and @every 6h.
Schedules reload on change — no restart.
Read the report
A PDF and an HTML summary go out when the scan ends — to your recipients, and to each customer’s own.
| Built-in profile | What it is for | Typical cadence |
|---|---|---|
| Exposure Check | Exposed panels, config files, backups, default logins. | Safe to run often |
| Vulnerability Scan | CVEs and known-exploitable issues, medium and above. | Weekly |
| Critical Only | High and critical only. Minimal noise. | Nightly |
| Full Audit | Every template, every severity. Slow. | Monthly, or before an audit |
Pace
The profile says what to look for.
The pace says how hard to push.
Chosen per run, so one profile serves the maintenance window and the background sweep. Every pace stays capped — no setting can turn a scan into an attack on your own network — and it is recorded on the scan.
| Pace | What it changes | May resolve findings |
|---|---|---|
| Background | ⅕ the rate, ¼ the concurrency, wider timeouts. | No |
| Gentle | Half rate and concurrency, wider timeouts. | No |
| Normal | The profile exactly as it was authored. | Yes |
| Aggressive | 2.5× the rate, 2× the concurrency. | Yes |
A slower pace widens timeouts rather than shortening them, and a throttled run closes nothing: fewer requests prove nothing was fixed.
Dashboard
It opens with a verdict,
not a table.
It refreshes every five seconds and leads with what needs work: open critical and high findings, how long they have waited, and the assets nobody has scanned.
Security posture
critical and high, still open
Critical exposure
4 critical findings need immediate attention.
The first figure is the oldest unfixed critical or high — the one that says whether anything is being fixed. The raw count of open findings is never the headline.
Open critical and high
last 14 days| Day | Open critical + high |
|---|
How long they have been open
22 open findingsc/h is the critical and high findings inside that band. Every finding in the oldest two bands here is one of them — that is the number worth acting on.
Where the risk sits
ranked by what needs work, not by how much was found3 assets have never been scanned — warehouse-lan, dr-site, kiosk-vlan
Informational findings usually outnumber everything else several times over. Counted into the ranking they decide it, so they are counted and named but never drawn — and the assets nobody has scanned are listed underneath, because a host with no findings and a host nobody looked at report the same zero.
Findings
Fixed means two scans
that could have seen it.
Reporting a live vulnerability as fixed is the worst thing a scanner can do, so a finding closes only on evidence.
Resolution
Two silences, not one
A finding must be missed by two consecutive completed scans before it closes. A template can fail to fire on a dropped connection or a rate limit; one silence is not evidence.
Reach
Only what the scan could see
A Critical Only run never loads a medium-severity template, so its silence says nothing about a medium finding. Resolution considers only findings within the profile’s reach. A failed or cancelled scan resolves nothing at all.
Triage
Your decisions stick
Accept a risk or flag a false positive and the state survives future scans. Those two statuses are yours — no scan moves a finding out of them.
Scan engine
The engine can move forward
without you trusting a download.
Detection runs on nuclei, and templates change daily while the engine changes every few weeks — so the two update independently, and neither waits on a package release. What arrives from the network still has to prove what it is before anything runs it.
Floor
The bundled engine cannot be touched
A matching nuclei binary ships inside the package, owned by dpkg or rpm and outside the one path the systemd unit makes writable — the service cannot modify or delete it. It is the version the release was tested against, and the version everything else falls back to.
Chain of custody
An update proves itself first
Before a fetched build can become the engine it has to:
- arrive over HTTPS — a redirect off TLS aborts the download
- match the SHA-256 published in the release checksums
- unpack under a size ceiling, writing only the path intended
- report a version matching the release tag
- parse the installed template set
Only then does the active pointer move, by atomic rename — a scan starting mid-swap sees one version or the other, never a broken link. Any failure discards the download and leaves the running engine untouched.
Reversible
A way back that always exists
Every engine on the host is listed with the running one marked, and revert returns to whatever was active before. The bundled engine is never garbage-collected, so a rollback target exists even on a host that has been offline since install. Version changes are refused while a scan is in flight, and each scan records the engine that produced it.
Or turn it off: engine-updates = off pins the install to the bundled binary and makes the API refuse version changes — restoring the property that every executable the service runs is read-only to it, at the cost of the engine only advancing when the package does.
Install
One package, then a URL and
a certificate fingerprint.
The package bundles the open-source nuclei scan engine, creates the service account, installs a hardened systemd unit, generates a self-signed TLS certificate and starts the service. The certificate is generated before the service is started, so the console is not served in plaintext during setup.
Access
NuajLens is free. The download is by request.
There is no licence key, no seat count and no trial timer — but NuajLens is licensed rather than public domain, and builds are served from download.nuaj.com, which is opened per organisation. Read the licence, then send one email to our helpdesk and we grant your access, usually the same business day.
- 1 Read the licence
- 2 Email helpdesk
- 3 Access granted
- 4 apt install nuajlens
Nothing to fetch at install time
One package on Debian, Ubuntu, RHEL, Fedora, Rocky, Alma and openSUSE, for x86_64 and aarch64. Your own package manager installs it, so nothing new has to be trusted to run on the host.
The install pulls nothing down: every part of NuajLens, the scan engine included, is already inside the package. An air-gapped host installs exactly the same way.
One directory of state
/opt/nuajlens/ ├── bin/ nuajlens + scan engine ├── nuajlens.conf configuration └── data/ db, scan logs, templates, cert
Backup, migration and removal are each a single path. Removing the package keeps that directory, so a reinstall finds your scan history again; purging it takes everything.
Once your access is granted, NuajLens installs from the nuaj package repository by name — apt install nuajlens or dnf install nuajlens. Your access email carries the repository setup for download.nuaj.com: one keyring and one source line, added once per host. From then on your package manager verifies every install and every upgrade against that key, and there is nothing to check by hand.
Requesting access records your acceptance of the End User Licence Agreement. NuajLens is supplied free of charge and without warranty; you are responsible for holding authorisation to test every asset you register.
At a glance
NuajLens,
at a glance.
NuajLens is a self-hosted vulnerability scanner and reporting console: vulnerability management software you run on your own server. Register the assets you are authorised to test, put them on a schedule, and the scanner works from that inventory rather than from a target typed into a free-text field. Findings persist between runs, and a PDF report lands in the right inboxes when a scan ends. One package installs the console, the datastore, the scheduler, the report engine and the scan engine itself — free of charge, commercial use included.
| Product type | Vulnerability scanner and vulnerability management console, self-hosted |
|---|---|
| What it does | Scheduled authenticated-perimeter scanning of a registered asset inventory, with findings that persist between runs and PDF reporting on completion |
| Deployment | Self-hosted only. One package on your own server — see deployment and requirements |
| Platforms | Debian, Ubuntu, RHEL, Fedora, Rocky, Alma and openSUSE, on x86_64 and aarch64 |
| Packaging | deb and rpm, installed by name from the nuaj package repository. Nothing is fetched at install time, so an air-gapped host installs identically |
| Scan engine | The open-source nuclei engine, bundled inside the package and updated as a verified unit |
| Footprint | Runs in 2 GB of RAM. All state in one directory, /opt/nuajlens |
| Multi-customer | One install serves a book of clients — assets, schedules and reports are kept per customer |
| Price | Free of charge, including commercial use. No licence key, no seat count, no trial timer. Download access is granted per organisation on request |
| Licence | Proprietary, supplied free of charge. End User Licence Agreement |
| Vendor | Nuaj Company Inc., Ontario, Canada |
Questions
The things worth knowing
before you install it.
What does it cost?
Nothing, for any use including commercial use. There is no licence key, no seat count, no trial timer and no paid tier holding half the product. It is source-available rather than open source: the source is published so anyone running a scanner against their own network can read what it does, but redistributing or mirroring it is not permitted.
If it is free, why is the download gated?
Because it is licensed rather than placed in the public domain, and builds are served per organisation so that every copy in circulation traces back to a known origin. One email to the helpdesk names your organisation and records your acceptance of the licence; access is usually granted the same business day, and it costs nothing.
Does anything leave my network?
The console, the database and every report stay on your host. Two things reach outward: the nuclei template set, which is fetched from upstream because it changes daily, and out-of-band detection — which is off until you turn it on, precisely because it sends callback data to a third-party server. Reports travel only through the SMTP server you configure.
Is this a penetration test?
No. It is template-based detection run against services you own: it finds what a template can recognise, on a schedule, and tracks what happens to each finding afterwards. It does not chain findings together, exploit anything, or exercise judgement. An empty report is not a clean bill of health, and the licence says so in as many words.
How does it decide something has been fixed?
Carefully, because reporting a live vulnerability as fixed is the worst thing it could do. A finding must be missed by two consecutive completed scans, and only by scans that could actually have seen it — a Critical Only run never loads a medium-severity template, so its silence says nothing about a medium finding. Deliberately throttled runs resolve nothing, and a failed or cancelled scan resolves nothing at all.
What does it need to run?
A Linux host with 2 GB of memory, amd64 or arm64, and a .deb or .rpm. It installs as its own service account under one directory, and serves the console over HTTPS on port 8443 with a certificate generated before the service first starts, so the login form is never presented over plaintext. Your own certificate, or a reverse proxy in front, are both supported. The deployment page has the full list, including what happens on a host with no internet access.
Can I run it for my clients?
Yes — that is what the customer fields are for, and the licence permits paid work delivered with it. Give an asset a customer and a recipient list, and that customer receives their own report covering only their assets. The scoping is applied to the findings query itself, so no path exists by which one customer’s finding, hostname or asset name reaches another’s report.
What am I allowed to scan?
Assets you own or hold documented authorisation to test. Registering an asset is a statement that you do, and that obligation is section 4 of the licence. The product is built to make that the easy path — targets come only from the inventory, wide CIDR blocks are refused, and profile arguments cannot introduce targets of their own — but none of that is a substitute for the authorisation itself.
What happens if I want it gone?
The installer removes it: --uninstall keeps your data, --purge takes everything and asks first. Nothing is written outside /opt/nuajlens, so backing the install up, moving it to another host, or removing every trace of it are each one path.
Is NuajLens an alternative to Nessus or OpenVAS?
Anything else — helpdesk@nuaj.com.