Cert-X-Gen

Cert-X-Gen is a security scanner that finds vulnerabilities across web applications, services, networks, and desktop applications, and shows you the evidence behind every finding.

Under the hood it runs templates. A template is a self-contained check: it knows how to detect one specific weakness, how serious that weakness is, and what to do about it. You point cxg at a target, it runs every template that applies, and it writes the results to a report you can read or feed into a pipeline.

Templates live in their own repository and are fetched with one command, so the catalogue grows without you upgrading the scanner. They arrive grouped by subject, including web, network, databases, devops, recon, messaging, monitoring, and tooling. You can write your own and keep them beside your code.

cxg template update

Templates in any language

Most checks are straightforward: send a request, look for something in the response. YAML describes those well, and a YAML template stays readable to anyone on your team.

Some checks need to do more than match text. Cert-X-Gen lets a template be an ordinary program instead, written in Python, JavaScript, Rust, Go, C, C++, Java, Ruby, Perl, PHP, or Shell. A template written as a program can:

• Choose its next request based on what the last response said
• Calculate something, such as whether session tokens are genuinely random
• Verify a signature or read a file format
• Hold a finding back until every step has confirmed it

Take an exposed .git directory. A template can fetch /.git/HEAD, read which branch it points at, fetch that branch, and check that it resolves to a real commit. Three requests, each one deciding the next. If any step fails the template stays quiet, so what you get is a confirmed finding rather than a maybe.

Write your first template builds that check step by step, and why polyglot templates covers when the extra power is worth its cost, because a code template needs its language installed wherever the scan runs.

What a finding gives you

Every finding carries the evidence behind it, not only a verdict.

Field	What it holds
severity, confidence	How serious the template’s author judged it, and how sure the check is
title, description	What was found, in the template author’s words
evidence.request	The exact request that triggered it
evidence.response	The full response body cxg matched against
evidence.matched_patterns	Which conditions fired
cwe_ids, cve_ids, cvss_score	Set when the template provides them
remediation	How to fix it, when the template says

Keeping the whole response body is what makes a finding auditable weeks later. You can read what the scanner saw, rather than trusting that it matched something.

Results go to scan-results.json by default, and one run can write JSON, SARIF, CSV, HTML, and Markdown at the same time, so the same scan feeds a pipeline and a person.

Where Cert-X-Gen fits

Cert-X-Gen runs two pipelines. They start from different things, so the one you reach for depends on what you already have.

flowchart TB
    subgraph SCAN["cxg scan"]
        direction LR
        A["a target you can reach"] --> C(["run every template<br/>that applies"])
        B["templates"] --> C
        C --> D["findings, each with the<br/>request and response"]
    end

    subgraph PENTEST["cxg pentest"]
        direction LR
        E["a running app"] --> G(["write probes,<br/>then try to confirm them"])
        F["its source, and a guardlink<br/>threat model"] --> G
        G --> H["a verdict for each<br/>suspected exposure"]
    end

    SCAN ~~~ PENTEST

    class D,H emphasis

What you are doing	Reach for	Why
Sweeping web applications and services for known issues	cxg scan	Select templates by tag, severity, or exact ID
Scanning hosts and networks	cxg scan	--scope takes hosts, domains, URLs, and CIDR ranges
Testing an application whose source you have	cxg pentest	Starts from exposures a developer marked in the code, not from guesswork
Testing an Electron desktop app	cxg pentest --target-type electron	Drives the app over the Chrome DevTools Protocol and probes its IPC channels
Confirming blind SSRF or injection	--oast-interactsh	cxg owns the callback host and polls it, so a hit is proof rather than a lead
Gating a build	Exit codes and --ci	An expired session fails the job loudly instead of scanning logged out
Writing a check nothing else can express	cxg template	The check is a program, so it can parse, compute, and chain requests

What to know going in

Three things surprise people. Each one is covered in full elsewhere.

Cert-X-Gen ships with no templates.

Run cxg template update first, or a scan runs nothing and reports nothing.

A template runs as you.

cxg starts it as an ordinary child process with your files, your credentials, and your network access. There is no sandbox, and no flag or configuration key adds one. Read the template trust model before you run a template you did not write.

A skipped template looks exactly like a clean result.

If a template’s language is not installed on the machine, cxg logs a warning, records nothing, and still exits 0. Run with -v and treat those warnings as failures, especially in CI. See why polyglot templates.

Where to go next

Install and scan something

Install the binary, fetch templates, and read a real finding on a target you control.

Install cxg · Run your first scan

Write a check in code

Build the .git detection above in Python, validate it, and run it through the engine.

Write your first template

Run a whitebox pentest

Turn a guardlink threat model into probes, and let cxg try to confirm or rule out each one against a running app.

Run a pentest

Look up a flag

Every command, flag, and default, generated from the binary’s own --help.

CLI reference

Version and source

These docs describe Cert-X-Gen 1.3.0, released 2026-08-13. The generated reference comes from that release’s published binary, which is the same asset the install steps download. The release binary, cargo install cert-x-gen, and the Homebrew tap all serve 1.3.0.

Engine

Bugb-Technologies/cert-x-gen

Templates

Bugb-Technologies/cert-x-gen-templates

Changelog

Every release, with the diff between any two

Release

v1.3.0