Dockerfile

# syntax=docker/dockerfile:1
#
# Microsoft Exchange Server scanner
# by Bishop Fox
#
# Build:  docker build -t exchange-scanner .
# Usage:  docker run --rm exchange-scanner -q -t <target>
#         docker run --rm -v "$PWD/targets.txt:/app/targets.txt" exchange-scanner -l targets.txt
#
# All dependencies (base images, Python packages, and the dnsx / fingerprintx
# binaries) are locked to specific versions for reproducible builds. The
# Exchange Server version table is scraped from Microsoft at build time, so the
# build requires network access and reflects the data available when it runs.

# ---------------------------------------------------------------------------
# Stage 1: build the Go-based recon tools at pinned versions
# ---------------------------------------------------------------------------
FROM golang:1.24.5-bookworm AS tools

ENV CGO_ENABLED=0 GOFLAGS=-trimpath

# dnsx ships prebuilt binaries; fingerprintx no longer does for recent
# releases, so both are built from source pinned to a specific tag.
RUN go install github.com/projectdiscovery/dnsx/cmd/dnsx@v1.2.3 \
 && go install github.com/praetorian-inc/fingerprintx/cmd/fingerprintx@v1.1.19

# ---------------------------------------------------------------------------
# Stage 2: runtime image
# ---------------------------------------------------------------------------
FROM python:3.12.8-slim-bookworm

WORKDIR /app

# Python dependencies (locked to specific versions in scripts/requirements.txt)
COPY scripts/requirements.txt ./scripts/requirements.txt
RUN pip install --no-cache-dir -r ./scripts/requirements.txt

# Recon tools built in stage 1, dropped where the scanner expects them
COPY --from=tools /go/bin/dnsx /app/tools/dnsx
COPY --from=tools /go/bin/fingerprintx /app/tools/fingerprintx

# Application code and the version-table generator
COPY exchange-scanner.py ./
COPY scripts/get-exchange-versions.py ./scripts/get-exchange-versions.py

# Generate the Exchange Server version table at build time by scraping
# Microsoft's published build numbers (requires network access during the
# build). The generator writes exchange-versions.json into /app.
RUN python3 scripts/get-exchange-versions.py

ENTRYPOINT ["python3", "exchange-scanner.py"]
CMD ["-h"]