Automate monthly attack surface assessments for your domains (zero tools to install)

Built with n8n
, , ,
1

Most security teams run vulnerability scans once or twice a year — if they’re lucky. Meanwhile, new subdomains get created, certificates expire, and someone leaves a .env file exposed on a staging server.

I built a workflow that runs a full external security assessment on any domain automatically — checking 10+ attack vectors — and sends you a scored report. No Nmap to install, no Nuclei to configure, no servers to maintain.

What it checks

The assessment scans your public-facing infrastructure across these vectors:

  • Email spoofing defenses — SPF, DKIM, DMARC policy strength
  • SSL/TLS hardening — deprecated protocols, weak ciphers, HSTS presence, cert expiration
  • HTTP security headers — CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy
  • Sensitive file exposure — .env, .git, backup files, admin panels (25+ paths)
  • Open TCP ports — databases (PostgreSQL, MySQL, Redis, MongoDB), RDP, VNC
  • CORS misconfiguration — reflective origins, wildcard access
  • Cloud storage exposure — public S3 buckets, Azure blobs, GCS containers
  • Subdomain takeover — dangling DNS pointing to deprovisioned services
  • Cookie security — missing Secure/HttpOnly/SameSite flags
  • Dangerous HTTP methods — PUT, DELETE, TRACE enabled
  • security.txt — responsible disclosure channel verification

The workflow

┌─────────────┐     ┌──────────────────┐     ┌─────────────┐     ┌──────────────┐
│  Schedule   │────▶│  Mediavox Node   │────▶│  IF Score   │────▶│  Send Alert  │
│  (Monthly)  │     │  ASA: Run Scan   │     │   < 70      │     │  (Slack/Email)│
└─────────────┘     └──────────────────┘     └─────────────┘     └──────────────┘
                            │
                            ▼
                    ┌──────────────────┐
                    │  Store Results   │
                    │  (Google Sheets) │
                    └──────────────────┘

Nodes used:

  • Schedule Trigger — runs the first Monday of every month
  • Mediavox (community node: n8n-nodes-mediavox) — calls the ASA endpoint with your brand ID
  • IF — checks if score dropped below your threshold
  • Slack / Email — alerts your team when posture degrades
  • Google Sheets — logs historical scores for trend tracking

Setup

  1. Install the Mediavox community node: Settings → Community Nodes → search n8n-nodes-mediavox
  2. Create a free API key from the Mediavox Developer Portal (search “Mediavox Developer Portal” in your browser)
  3. Register your brand (domain) in Brand Intelligence
  4. Import the workflow template (available in the node’s documentation)
  5. Set your brand ID and alert threshold

How to use the Mediavox node for ASA

In the Mediavox node, select:

  • Product: Brand Intelligence
  • Method: brand.posture.scan
  • Parameters: { "brandId": "YOUR_BRAND_ID" }

The response includes:

{
  "score": 81,
  "rating": "Good",
  "findings": {
    "critical": 0,
    "high": 2,
    "medium": 5,
    "low": 8
  },
  "domains_scanned": 12,
  "subdomains_found": 43,
  "top_issues": [
    {
      "severity": "high",
      "category": "email",
      "title": "DMARC policy is p=none",
      "target": "yourdomain.com",
      "remediation": "Set DMARC policy to p=reject to prevent email spoofing"
    }
  ]
}

Real example

I ran this on a LATAM fintech’s public domains. Results in under 60 seconds:

  • Score: 71/100 (Fair)
  • 2 High findings: DMARC p=none + Redis on port 6379 responding
  • 5 Medium: missing CSP, weak HSTS, no security.txt, CORS wildcard, TLS 1.1 still enabled
  • 8 Low: server version headers, missing Permissions-Policy

The Redis finding alone could have been a full data breach if an attacker found it first.

Use cases

  • Monthly security posture check — know your score without hiring a pentester
  • CI/CD post-deploy validation — trigger a scan after every major release
  • Multi-brand monitoring — run assessments across all your domains in parallel
  • Compliance evidence — export scores for PCI-DSS, SOC 2, ISO 27001 audits
  • Vendor risk assessment — scan your suppliers’ domains before onboarding

What it doesn’t do (important)

This is NOT a penetration test. It:

  • Never exploits vulnerabilities
  • Never accesses internal systems
  • Only checks what’s publicly visible from the internet
  • Doesn’t require any network access or agents

Think of it as “what can an attacker see about you right now?” — answered in 60 seconds, every month, automatically.

The Mediavox community node also supports fraud detection (SMS/URL analysis), document intelligence (NER extraction), and data quality APIs (name/address/phone standardization for LATAM). Search n8n-nodes-mediavox in Community Nodes to get started.

Questions? Happy to help with setup or custom use cases.