This skill should be used when the user asks to "perform vulnerability scanning", "scan networks for open ports", "assess web application security", "scan wireless networks", "detect malware", "check cloud security", or "evaluate system compliance". It provides comprehensive guidance on security scanning tools and methodologies.
Add this skill
npx mdskills install sickn33/scanning-toolsComprehensive security scanning reference with extensive tool commands and workflows
1---2name: Security Scanning Tools3description: This skill should be used when the user asks to "perform vulnerability scanning", "scan networks for open ports", "assess web application security", "scan wireless networks", "detect malware", "check cloud security", or "evaluate system compliance". It provides comprehensive guidance on security scanning tools and methodologies.4metadata:5 author: zebbern6 version: "1.1"7---89# Security Scanning Tools1011## Purpose1213Master essential security scanning tools for network discovery, vulnerability assessment, web application testing, wireless security, and compliance validation. This skill covers tool selection, configuration, and practical usage across different scanning categories.1415## Prerequisites1617### Required Environment18- Linux-based system (Kali Linux recommended)19- Network access to target systems20- Proper authorization for scanning activities2122### Required Knowledge23- Basic networking concepts (TCP/IP, ports, protocols)24- Understanding of common vulnerabilities25- Familiarity with command-line interfaces2627## Outputs and Deliverables28291. **Network Discovery Reports** - Identified hosts, ports, and services302. **Vulnerability Assessment Reports** - CVEs, misconfigurations, risk ratings313. **Web Application Security Reports** - OWASP Top 10 findings324. **Compliance Reports** - CIS benchmarks, PCI-DSS, HIPAA checks3334## Core Workflow3536### Phase 1: Network Scanning Tools3738#### Nmap (Network Mapper)3940Primary tool for network discovery and security auditing:4142```bash43# Host discovery44nmap -sn 192.168.1.0/24 # Ping scan (no port scan)45nmap -sL 192.168.1.0/24 # List scan (DNS resolution)46nmap -Pn 192.168.1.100 # Skip host discovery4748# Port scanning techniques49nmap -sS 192.168.1.100 # TCP SYN scan (stealth)50nmap -sT 192.168.1.100 # TCP connect scan51nmap -sU 192.168.1.100 # UDP scan52nmap -sA 192.168.1.100 # ACK scan (firewall detection)5354# Port specification55nmap -p 80,443 192.168.1.100 # Specific ports56nmap -p- 192.168.1.100 # All 65535 ports57nmap -p 1-1000 192.168.1.100 # Port range58nmap --top-ports 100 192.168.1.100 # Top 100 common ports5960# Service and OS detection61nmap -sV 192.168.1.100 # Service version detection62nmap -O 192.168.1.100 # OS detection63nmap -A 192.168.1.100 # Aggressive (OS, version, scripts)6465# Timing and performance66nmap -T0 192.168.1.100 # Paranoid (slowest, IDS evasion)67nmap -T4 192.168.1.100 # Aggressive (faster)68nmap -T5 192.168.1.100 # Insane (fastest)6970# NSE Scripts71nmap --script=vuln 192.168.1.100 # Vulnerability scripts72nmap --script=http-enum 192.168.1.100 # Web enumeration73nmap --script=smb-vuln* 192.168.1.100 # SMB vulnerabilities74nmap --script=default 192.168.1.100 # Default script set7576# Output formats77nmap -oN scan.txt 192.168.1.100 # Normal output78nmap -oX scan.xml 192.168.1.100 # XML output79nmap -oG scan.gnmap 192.168.1.100 # Grepable output80nmap -oA scan 192.168.1.100 # All formats81```8283#### Masscan8485High-speed port scanning for large networks:8687```bash88# Basic scanning89masscan -p80 192.168.1.0/24 --rate=100090masscan -p80,443,8080 192.168.1.0/24 --rate=100009192# Full port range93masscan -p0-65535 192.168.1.0/24 --rate=50009495# Large-scale scanning96masscan 0.0.0.0/0 -p443 --rate=100000 --excludefile exclude.txt9798# Output formats99masscan -p80 192.168.1.0/24 -oG results.gnmap100masscan -p80 192.168.1.0/24 -oJ results.json101masscan -p80 192.168.1.0/24 -oX results.xml102103# Banner grabbing104masscan -p80 192.168.1.0/24 --banners105```106107### Phase 2: Vulnerability Scanning Tools108109#### Nessus110111Enterprise-grade vulnerability assessment:112113```bash114# Start Nessus service115sudo systemctl start nessusd116117# Access web interface118# https://localhost:8834119120# Command-line (nessuscli)121nessuscli scan --create --name "Internal Scan" --targets 192.168.1.0/24122nessuscli scan --list123nessuscli scan --launch <scan_id>124nessuscli report --format pdf --output report.pdf <scan_id>125```126127Key Nessus features:128- Comprehensive CVE detection129- Compliance checks (PCI-DSS, HIPAA, CIS)130- Custom scan templates131- Credentialed scanning for deeper analysis132- Regular plugin updates133134#### OpenVAS (Greenbone)135136Open-source vulnerability scanning:137138```bash139# Install OpenVAS140sudo apt install openvas141sudo gvm-setup142143# Start services144sudo gvm-start145146# Access web interface (Greenbone Security Assistant)147# https://localhost:9392148149# Command-line operations150gvm-cli socket --xml "<get_version/>"151gvm-cli socket --xml "<get_tasks/>"152153# Create and run scan154gvm-cli socket --xml '155<create_target>156 <name>Test Target</name>157 <hosts>192.168.1.0/24</hosts>158</create_target>'159```160161### Phase 3: Web Application Scanning Tools162163#### Burp Suite164165Comprehensive web application testing:166167```168# Proxy configuration1691. Set browser proxy to 127.0.0.1:80801702. Import Burp CA certificate for HTTPS1713. Add target to scope172173# Key modules:174- Proxy: Intercept and modify requests175- Spider: Crawl web applications176- Scanner: Automated vulnerability detection177- Intruder: Automated attacks (fuzzing, brute-force)178- Repeater: Manual request manipulation179- Decoder: Encode/decode data180- Comparer: Compare responses181```182183Core testing workflow:1841. Configure proxy and scope1852. Spider the application1863. Analyze sitemap1874. Run active scanner1885. Manual testing with Repeater/Intruder1896. Review findings and generate report190191#### OWASP ZAP192193Open-source web application scanner:194195```bash196# Start ZAP197zaproxy198199# Automated scan from CLI200zap-cli quick-scan https://target.com201202# Full scan203zap-cli spider https://target.com204zap-cli active-scan https://target.com205206# Generate report207zap-cli report -o report.html -f html208209# API mode210zap.sh -daemon -port 8080 -config api.key=<your_key>211```212213ZAP automation:214```bash215# Docker-based scanning216docker run -t owasp/zap2docker-stable zap-full-scan.py \217 -t https://target.com -r report.html218219# Baseline scan (passive only)220docker run -t owasp/zap2docker-stable zap-baseline.py \221 -t https://target.com -r report.html222```223224#### Nikto225226Web server vulnerability scanner:227228```bash229# Basic scan230nikto -h https://target.com231232# Scan specific port233nikto -h target.com -p 8080234235# Scan with SSL236nikto -h target.com -ssl237238# Multiple targets239nikto -h targets.txt240241# Output formats242nikto -h target.com -o report.html -Format html243nikto -h target.com -o report.xml -Format xml244nikto -h target.com -o report.csv -Format csv245246# Tuning options247nikto -h target.com -Tuning 123456789 # All tests248nikto -h target.com -Tuning x # Exclude specific tests249```250251### Phase 4: Wireless Scanning Tools252253#### Aircrack-ng Suite254255Wireless network penetration testing:256257```bash258# Check wireless interface259airmon-ng260261# Enable monitor mode262sudo airmon-ng start wlan0263264# Scan for networks265sudo airodump-ng wlan0mon266267# Capture specific network268sudo airodump-ng -c <channel> --bssid <target_bssid> -w capture wlan0mon269270# Deauthentication attack271sudo aireplay-ng -0 10 -a <bssid> wlan0mon272273# Crack WPA handshake274aircrack-ng -w wordlist.txt -b <bssid> capture*.cap275276# Crack WEP277aircrack-ng -b <bssid> capture*.cap278```279280#### Kismet281282Passive wireless detection:283284```bash285# Start Kismet286kismet287288# Specify interface289kismet -c wlan0290291# Access web interface292# http://localhost:2501293294# Detect hidden networks295# Kismet passively collects all beacon frames296# including those from hidden SSIDs297```298299### Phase 5: Malware and Exploit Scanning300301#### ClamAV302303Open-source antivirus scanning:304305```bash306# Update virus definitions307sudo freshclam308309# Scan directory310clamscan -r /path/to/scan311312# Scan with verbose output313clamscan -r -v /path/to/scan314315# Move infected files316clamscan -r --move=/quarantine /path/to/scan317318# Remove infected files319clamscan -r --remove /path/to/scan320321# Scan specific file types322clamscan -r --include='\.exe$|\.dll$' /path/to/scan323324# Output to log325clamscan -r -l scan.log /path/to/scan326```327328#### Metasploit Vulnerability Validation329330Validate vulnerabilities with exploitation:331332```bash333# Start Metasploit334msfconsole335336# Database setup337msfdb init338db_status339340# Import Nmap results341db_import /path/to/nmap_scan.xml342343# Vulnerability scanning344use auxiliary/scanner/smb/smb_ms17_010345set RHOSTS 192.168.1.0/24346run347348# Auto exploitation349vulns # View vulnerabilities350analyze # Suggest exploits351```352353### Phase 6: Cloud Security Scanning354355#### Prowler (AWS)356357AWS security assessment:358359```bash360# Install Prowler361pip install prowler362363# Basic scan364prowler aws365366# Specific checks367prowler aws -c iam s3 ec2368369# Compliance framework370prowler aws --compliance cis_aws371372# Output formats373prowler aws -M html json csv374375# Specific region376prowler aws -f us-east-1377378# Assume role379prowler aws -R arn:aws:iam::123456789012:role/ProwlerRole380```381382#### ScoutSuite (Multi-cloud)383384Multi-cloud security auditing:385386```bash387# Install ScoutSuite388pip install scoutsuite389390# AWS scan391scout aws392393# Azure scan394scout azure --cli395396# GCP scan397scout gcp --user-account398399# Generate report400scout aws --report-dir ./reports401```402403### Phase 7: Compliance Scanning404405#### Lynis406407Security auditing for Unix/Linux:408409```bash410# Run audit411sudo lynis audit system412413# Quick scan414sudo lynis audit system --quick415416# Specific profile417sudo lynis audit system --profile server418419# Output report420sudo lynis audit system --report-file /tmp/lynis-report.dat421422# Check specific section423sudo lynis show profiles424sudo lynis audit system --tests-from-group malware425```426427#### OpenSCAP428429Security compliance scanning:430431```bash432# List available profiles433oscap info /usr/share/xml/scap/ssg/content/ssg-<distro>-ds.xml434435# Run scan with profile436oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_pci-dss \437 --report report.html \438 /usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml439440# Generate fix script441oscap xccdf generate fix \442 --profile xccdf_org.ssgproject.content_profile_pci-dss \443 --output remediation.sh \444 /usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml445```446447### Phase 8: Scanning Methodology448449Structured scanning approach:4504511. **Planning**452 - Define scope and objectives453 - Obtain proper authorization454 - Select appropriate tools4554562. **Discovery**457 - Host discovery (Nmap ping sweep)458 - Port scanning459 - Service enumeration4604613. **Vulnerability Assessment**462 - Automated scanning (Nessus/OpenVAS)463 - Web application scanning (Burp/ZAP)464 - Manual verification4654664. **Analysis**467 - Correlate findings468 - Eliminate false positives469 - Prioritize by severity4704715. **Reporting**472 - Document findings473 - Provide remediation guidance474 - Executive summary475476### Phase 9: Tool Selection Guide477478Choose the right tool for each scenario:479480| Scenario | Recommended Tools |481|----------|-------------------|482| Network Discovery | Nmap, Masscan |483| Vulnerability Assessment | Nessus, OpenVAS |484| Web App Testing | Burp Suite, ZAP, Nikto |485| Wireless Security | Aircrack-ng, Kismet |486| Malware Detection | ClamAV, YARA |487| Cloud Security | Prowler, ScoutSuite |488| Compliance | Lynis, OpenSCAP |489| Protocol Analysis | Wireshark, tcpdump |490491### Phase 10: Reporting and Documentation492493Generate professional reports:494495```bash496# Nmap XML to HTML497xsltproc nmap-output.xml -o report.html498499# OpenVAS report export500gvm-cli socket --xml '<get_reports report_id="<id>" format_id="<pdf_format>"/>'501502# Combine multiple scan results503# Use tools like Faraday, Dradis, or custom scripts504505# Executive summary template:506# 1. Scope and methodology507# 2. Key findings summary508# 3. Risk distribution chart509# 4. Critical vulnerabilities510# 5. Remediation recommendations511# 6. Detailed technical findings512```513514## Quick Reference515516### Nmap Cheat Sheet517518| Scan Type | Command |519|-----------|---------|520| Ping Scan | `nmap -sn <target>` |521| Quick Scan | `nmap -T4 -F <target>` |522| Full Scan | `nmap -p- <target>` |523| Service Scan | `nmap -sV <target>` |524| OS Detection | `nmap -O <target>` |525| Aggressive | `nmap -A <target>` |526| Vuln Scripts | `nmap --script=vuln <target>` |527| Stealth Scan | `nmap -sS -T2 <target>` |528529### Common Ports Reference530531| Port | Service |532|------|---------|533| 21 | FTP |534| 22 | SSH |535| 23 | Telnet |536| 25 | SMTP |537| 53 | DNS |538| 80 | HTTP |539| 443 | HTTPS |540| 445 | SMB |541| 3306 | MySQL |542| 3389 | RDP |543544## Constraints and Limitations545546### Legal Considerations547- Always obtain written authorization548- Respect scope boundaries549- Follow responsible disclosure practices550- Comply with local laws and regulations551552### Technical Limitations553- Some scans may trigger IDS/IPS alerts554- Heavy scanning can impact network performance555- False positives require manual verification556- Encrypted traffic may limit analysis557558### Best Practices559- Start with non-intrusive scans560- Gradually increase scan intensity561- Document all scanning activities562- Validate findings before reporting563564## Troubleshooting565566### Scan Not Detecting Hosts567568**Solutions:**5691. Try different discovery methods: `nmap -Pn` or `nmap -sn -PS/PA/PU`5702. Check firewall rules blocking ICMP5713. Use TCP SYN scan: `nmap -PS22,80,443`5724. Verify network connectivity573574### Slow Scan Performance575576**Solutions:**5771. Increase timing: `nmap -T4` or `-T5`5782. Reduce port range: `--top-ports 100`5793. Use Masscan for initial discovery5804. Disable DNS resolution: `-n`581582### Web Scanner Missing Vulnerabilities583584**Solutions:**5851. Authenticate to access protected areas5862. Increase crawl depth5873. Add custom injection points5884. Use multiple tools for coverage5895. Perform manual testing590
Full transparency — inspect the skill content before installing.