The rapid expansion of internet-facing web applications has widened the attack surface available to automated scanners, botnets and malicious actors, while common weaknesses such as misconfigured servers, unpatched software, obsolete transport-layer encryption and missing HTTP security headers continue to be exploited at scale. Commercial vulnerability scanners are costly and largely opaque, whereas open-source command-line utilities operate independently of one another and demand specialised expertise, offering little contextual or remediation guidance. This paper presents the design of SecureXon , a modular, full-stack security reconnaissance and threat-intelligence platform built around a Python/Flask backend that consolidates fifteen asynchronous reconnaissance modules with a large-language-model-driven Security Operations Center (SOC) assistant for false-positive vulnerability filtering and remediation guidance. A dedicated Zero-Trust defensive subsystem, the SSRF Guard, validates every outbound network request against loopback, private, link-local, multicast and encoded IP representations before it is dispatched. A companion log-analysis engine maps detected attack signatures in Nginx/Apache traffic to the MITRE ATT&CK knowledge base. Beyond the system design, this paper contributes a normalised risk-scoring formulation, an architecture and workflow specification, a structured SSRF bypass test-vector suite, and a precision/recall/F1-based evaluation protocol for the AI-assisted CVE triage stage. As the platform is currently at the design-and-development stage, the paper specifies evaluation protocols for quantitative validation rather than reporting unmeasured performance results.

Index Terms— Web reconnaissance, vulnerability assessment, artificial intelligence in security operations, Server-Side Request Forgery, CVE triage, MITRE ATT&CK, SSL/TLS auditing, log analysis, asynchronous scanning.