Hackly

Authorized attack-surface
scanning — with ownership gates.

Inventory targets you own, verify DNS ownership, run soft rate-limited scans, and review findings from a Filament admin panel. Built with Laravel 13 and Filament 5.

Get started Read the docs View on GitHub

Legal notice — Only scan targets you are authorized to assess. Unauthorized scanning may be illegal. DNS ownership verification is required before a scan can start.

Coverage

Scanners that respect
your rate limits.

Profiles map to task sets. Soft jitter, spacing, quiet hours, and deep-scan cooldown keep noise — and ban risk — down.

01 DNS / WHOIS dig + whois — records, registrar, and basic exposure. quick · standard · deep
02 Port scan nmap top ports with light service detection. quick · standard · deep
03 Tech fingerprint Soft HTTP checks for PHP/Laravel headers, cookies, and debug pages. quick · standard · deep
04 Subdomains Soft wordlist + Certificate Transparency logs. standard · deep
05 Path discovery Soft wordlist / Nuclei — Laravel exposures (.env, Telescope, Horizon…). standard · deep
06 Nuclei templates OWASP + PHP/Laravel/dotenv vulnerability templates via nuclei. standard · deep
07 OWASP ZAP DAST Baseline DAST for deep profile — longer timeout, cooldown enforced. deep

Install

Up in minutes.

PHP 8.3+, Composer, and SQLite (or MySQL / PostgreSQL). A queue worker must be running for scans to execute.

Terminal — bootstrap 
composer install
cp .env.example .env
php artisan key:generate
touch database/database.sqlite
php artisan migrate --seed
Terminal — run 
# serve + queue + logs + vite
composer run dev

# or separately:
php artisan serve
php artisan queue:work  # required
01

Open the app

Visit / — seeded as admin@hackly.test / password. Change it immediately.

02

Add & verify a target

Create a domain or IP, publish the DNS TXT token, then verify ownership before scanning.

03

Start a scan

Pick quick, standard, or deep. Jobs dispatch immediately; findings sort HIGH → LOW.

Documentation

Reference

Architecture, profiles, CLI, env knobs, and the ownership-first security model.

Overview

Hackly is an orchestration layer for authorized attack-surface and application security scanning. You inventory targets, prove ownership, run soft rate-limited scanner jobs, and review normalized findings in Filament.

Architecture
Target (verified)
   └─ Scan
        └─ ScanTasks  →  RunScanTaskJob  →  Findings

Jobs use the database queue (no Horizon). A queue worker must be running for scans to execute.

Requirements

  • PHP 8.3+
  • Composer
  • SQLite (default) or MySQL / PostgreSQL
  • Node.js (optional — Vite assets; Filament ships published assets)
Default admin after seed: / · admin@hackly.test · password

Scanner binaries

Optional but recommended. Without them, related tasks fail gracefully and surface missing-binary errors in the scan UI.

Binary Used for
dig, whois DNS / WHOIS
nmap Ports
nuclei Templates & path discovery
zap.sh Deep DAST (OWASP ZAP)

Ubuntu 24.04 / 26.04+

Install helpers 
sudo bash scripts/install-scanner-binaries-ubuntu.sh
php artisan hackly:check-binaries

Usage

From the admin UI

  1. Open Targets → create a domain or IP
  2. Copy the DNS token → publish the TXT record at your DNS provider
  3. Verify DNS — must succeed before scanning
  4. Start scan — pick a profile; jobs dispatch immediately
  5. Watch Scans for live progress, open findings (HIGH → LOW), export the PDF
  6. On a target’s detail page, browse the related Scans table

From the CLI

Terminal 
php artisan hackly:scan example.com --profile=standard

Scan profiles

Profile Tasks
quick dns_info, port_scan, tech_fingerprint
standard + subdomain_enum, path_discovery, nuclei_owasp
deep + zap_baseline (cooldown between deep runs on the same target)

Findings are normalized to LOW / MEDIUM / HIGH and ordered by severity.

Commands

Command Purpose
hackly:check-binaries Verify scanner binaries
hackly:scan {target} Create scan & dispatch jobs (--profile=)
hackly:cleanup-outputs Delete old raw scanner outputs
hackly:dispatch-due Re-dispatch leftover pending tasks
queue:work Process scan jobs

Configuration

Primary config: config/hackly.php — override via .env.

.env 
QUEUE_CONNECTION=database
CACHE_STORE=database

# Safety
HACKLY_ALLOWLIST_ONLY=false
HACKLY_ALLOWLIST=example.com,203.0.113.10
HACKLY_ALLOW_PRIVATE_TARGETS=true

# Soft rate limits
HACKLY_PER_TARGET_PER_MINUTE=2
HACKLY_GLOBAL_CONCURRENT=5
HACKLY_JITTER_SECONDS=5
HACKLY_TASK_SPACING_SECONDS=10
HACKLY_DEEP_COOLDOWN_HOURS=24
HACKLY_QUIET_HOURS_ENABLED=false

# Job timeout must exceed longest scanner (ZAP ~900s)
HACKLY_JOB_TIMEOUT=960
DB_QUEUE_RETRY_AFTER=1020

# Binary paths
HACKLY_NMAP=nmap
HACKLY_NUCLEI=nuclei
# macOS: HACKLY_ZAP=/Applications/ZAP.app/Contents/Java/zap.sh
HACKLY_ZAP=zap.sh

Security model

  • Scans require ownership verification (DNS TXT for domains)
  • Optional allowlist and private-IP blocking
  • Soft rate limits, jitter, task spacing, and quiet hours
  • Deep profile has a cooldown between runs on the same target
  • Admin accounts support TOTP and email multi-factor authentication
Hackly is an orchestration layer — it does not replace responsible disclosure policies or scoped pentest agreements.

Production tips

  • Set HACKLY_ALLOW_PRIVATE_TARGETS=false
  • Prefer HACKLY_ALLOWLIST_ONLY=true with an explicit allowlist
  • Configure real mail for email 2FA (MAIL_MAILER=…)
  • Change the seeded admin password immediately
  • Run a persistent queue:work (and optionally schedule:work for cleanup)

Source and issues: github.com/andreapollastri/hackly