Jonathans Blog

banner

Axiom: Cloud-Based Distributed Pentesting at Scale

Jonathan Mitchell

Some scanning jobs just don’t fit on a laptop. Enumerating subdomains across a large bug bounty scope, running Nmap or Nuclei against thousands of hosts, or mass-screenshotting an entire IP range all hit the same wall: a single machine, even a beefy one, is either too slow or gets your IP rate-limited before it’s halfway through. Axiom exists specifically to solve that problem by turning your toolkit into a fleet.

What Axiom Does

Axiom is a dynamic infrastructure framework for penetration testers: it automates spinning up disposable cloud instances – “fleets” – pre-loaded with a curated set of recon and scanning tools, distributes a scan job across all of them in parallel, collects the results back to your local machine, and then tears the instances down again. Instead of running a scan sequentially against 10,000 hosts from one machine, you can split that list across 20 or 50 cloud instances and get the results back in a fraction of the time.

It supports most of the major cloud providers – DigitalOcean, Linode/Akamai, AWS, Azure, Google Cloud, Hetzner, and others – through a consistent set of commands, so the workflow stays the same regardless of which provider you’re paying for compute that day.

Core Concepts

  • Instances – individual cloud VMs, provisioned from a base image and torn down when you’re done with them.
  • Fleets – a named group of instances you spin up together to run a job in parallel, e.g. axiom-fleet mynames -i 20 to bring up 20 instances at once.
  • Presets/images – Axiom ships an image builder that bakes tools like subfinder, httpx, nuclei, masscan, and dozens of others into a base image, so every instance in a fleet is ready to work the moment it boots rather than needing manual setup.
  • Modules – wrapper scripts (axiom-scan) that split input across the fleet, run a given tool against each chunk, and merge the output back into a single result file on your local machine.

Getting Started

The setup script handles most of the configuration interactively:

bash <(curl -s https://raw.githubusercontent.com/pry0cc/axiom/master/interact/axiom-configure)

It’ll ask which cloud provider you’re using and for an API key/token, then walk you through selecting a base image to build from (or building your own). Once configured, spinning up a fleet and running a scan looks like this:

# Bring up 10 instances named "recon"
axiom-fleet recon -i 10

# Run subfinder across a list of domains, split across the fleet
axiom-scan domains.txt -m subfinder -o subdomains.txt

# Tear the fleet down when you're finished
axiom-rm recon* -f

The -m flag selects which module (i.e. which tool wrapper) to run – Axiom ships modules for most of the common recon and scanning tools out of the box, and you can write your own for anything it doesn’t already support.

Cost and Cleanup Discipline

The obvious risk with any tool that spins up cloud instances programmatically is forgetting to tear them down and getting an unpleasant bill. A few habits worth building in:

  • Always pair a fleet-up command with a corresponding axiom-rm once the job finishes, ideally scripted together rather than run as two manual steps.
  • Use axiom-ls regularly to check what’s actually still running – it’s easy to lose track across multiple projects.
  • Set billing alerts on whichever cloud account you’re using Axiom against, independent of Axiom itself, as a backstop.

A Note on Authorisation

Axiom’s whole value proposition is scanning at a scale a single machine can’t manage – which also means it’s easy to accidentally point a fleet of 50 instances at infrastructure you don’t have permission to test. Everything here assumes an authorised engagement or a bug bounty program’s defined scope; the same rules that apply to any other scanning tool in this space apply here, just with more horsepower behind them.

If you’re building out a recon workflow and want a single-host alternative to compare against before committing to fleet-based scanning, our Nmap for Beginners guide and its intermediate follow-up cover the same scanning fundamentals Axiom is ultimately parallelising.

Leave a Reply