Security Scanning Tools

Purpose

Master essential security scanning tools for network discovery, vulnerability assessment, web application testing, wireless security, and compliance validation. This skill covers tool selection, configuration, and practical usage across different scanning categories.

Prerequisites

Required Environment

Linux-based system (Kali Linux recommended)
Network access to target systems
Proper authorization for scanning activities

Required Knowledge

Basic networking concepts (TCP/IP, ports, protocols)
Understanding of common vulnerabilities
Familiarity with command-line interfaces

Outputs and Deliverables

Network Discovery Reports - Identified hosts, ports, and services
Vulnerability Assessment Reports - CVEs, misconfigurations, risk ratings
Web Application Security Reports - OWASP Top 10 findings
Compliance Reports - CIS benchmarks, PCI-DSS, HIPAA checks

Core Workflow

Phase 1: Network Scanning Tools

Nmap (Network Mapper)

Primary tool for network discovery and security auditing:

# Host discovery
nmap -sn 192.168.1.0/24              # Ping scan (no port scan)
nmap -sL 192.168.1.0/24              # List scan (DNS resolution)
nmap -Pn 192.168.1.100               # Skip host discovery

# Port scanning techniques
nmap -sS 192.168.1.100               # TCP SYN scan (stealth)
nmap -sT 192.168.1.100               # TCP connect scan
nmap -sU 192.168.1.100               # UDP scan
nmap -sA 192.168.1.100               # ACK scan (firewall detection)

# Port specification
nmap -p 80,443 192.168.1.100         # Specific ports
nmap -p- 192.168.1.100               # All 65535 ports
nmap -p 1-1000 192.168.1.100         # Port range
nmap --top-ports 100 192.168.1.100   # Top 100 common ports

# Service and OS detection
nmap -sV 192.168.1.100               # Service version detection
nmap -O 192.168.1.100                # OS detection
nmap -A 192.168.1.100                # Aggressive (OS, version, scripts)

# Timing and performance
nmap -T0 192.168.1.100               # Paranoid (slowest, IDS evasion)
nmap -T4 192.168.1.100               # Aggressive (faster)
nmap -T5 192.168.1.100               # Insane (fastest)

# NSE Scripts
nmap --script=vuln 192.168.1.100     # Vulnerability scripts
nmap --script=http-enum 192.168.1.100  # Web enumeration
nmap --script=smb-vuln* 192.168.1.100  # SMB vulnerabilities
nmap --script=default 192.168.1.100  # Default script set

# Output formats
nmap -oN scan.txt 192.168.1.100      # Normal output
nmap -oX scan.xml 192.168.1.100      # XML output
nmap -oG scan.gnmap 192.168.1.100    # Grepable output
nmap -oA scan 192.168.1.100          # All formats

Loading…

Core Workflow

Phase 1: Network Scanning Tools

Nmap (Network Mapper)

Primary tool for network discovery and security auditing:

# Host discovery nmap -sn 192.168.1.0/24 # Ping scan (no port scan) nmap -sL 192.168.1.0/24 # List scan (DNS resolution) nmap -Pn 192.168.1.100 # Skip host discovery # Port scanning techniques nmap -sS 192.168.1.100 # TCP SYN scan (stealth) nmap -sT 192.168.1.100 # TCP connect scan nmap -sU 192.168.1.100 # UDP scan nmap -sA 192.168.1.100 # ACK scan (firewall detection) # Port specification nmap -p 80,443 192.168.1.100 # Specific ports nmap -p- 192.168.1.100 # All 65535 ports nmap -p 1-1000 192.168.1.100 # Port range nmap --top-ports 100 192.168.1.100 # Top 100 common ports # Service and OS detection nmap -sV 192.168.1.100 # Service version detection nmap -O 192.168.1.100 # OS detection nmap -A 192.168.1.100 # Aggressive (OS, version, scripts) # Timing and performance nmap -T0 192.168.1.100 # Paranoid (slowest, IDS evasion) nmap -T4 192.168.1.100 # Aggressive (faster) nmap -T5 192.168.1.100 # Insane (fastest) # NSE Scripts nmap --script=vuln 192.168.1.100 # Vulnerability scripts nmap --script=http-enum 192.168.1.100 # Web enumeration nmap --script=smb-vuln* 192.168.1.100 # SMB vulnerabilities nmap --script=default 192.168.1.100 # Default script set # Output formats nmap -oN scan.txt 192.168.1.100 # Normal output nmap -oX scan.xml 192.168.1.100 # XML output nmap -oG scan.gnmap 192.168.1.100 # Grepable output nmap -oA scan 192.168.1.100 # All formats

Scenario	Recommended Tools
Network Discovery	Nmap, Masscan
Vulnerability Assessment	Nessus, OpenVAS
Web App Testing	Burp Suite, ZAP, Nikto
Wireless Security	Aircrack-ng, Kismet
Malware Detection	ClamAV, YARA
Cloud Security	Prowler, ScoutSuite
Compliance	Lynis, OpenSCAP
Protocol Analysis	Wireshark, tcpdump

Scan Type	Command
Ping Scan	`nmap -sn <target>`
Quick Scan	`nmap -T4 -F <target>`
Full Scan	`nmap -p- <target>`
Service Scan	`nmap -sV <target>`
OS Detection	`nmap -O <target>`
Aggressive	`nmap -A <target>`
Vuln Scripts	`nmap --script=vuln <target>`
Stealth Scan	`nmap -sS -T2 <target>`

Port	Service
21	FTP
22	SSH
23	Telnet
25	SMTP
53	DNS
80	HTTP
443	HTTPS
445	SMB
3306	MySQL
3389	RDP

Security Scanning Tools

Security Scanning Tools

Purpose

Prerequisites

Required Environment

Required Knowledge

Outputs and Deliverables

Core Workflow

Phase 1: Network Scanning Tools

Nmap (Network Mapper)

Related Skills

flow

verify

feature-flags

flags

Security Scanning Tools

Purpose

Prerequisites

Required Environment

Required Knowledge

Outputs and Deliverables

Core Workflow

Phase 1: Network Scanning Tools

Nmap (Network Mapper)

Masscan

Phase 2: Vulnerability Scanning Tools

Nessus

OpenVAS (Greenbone)

Phase 3: Web Application Scanning Tools

Burp Suite

OWASP ZAP

Nikto

Phase 4: Wireless Scanning Tools

Aircrack-ng Suite

Kismet

Phase 5: Malware and Exploit Scanning

ClamAV

Metasploit Vulnerability Validation

Phase 6: Cloud Security Scanning

Prowler (AWS)

ScoutSuite (Multi-cloud)

Phase 7: Compliance Scanning

Lynis

OpenSCAP

Phase 8: Scanning Methodology

Phase 9: Tool Selection Guide

Phase 10: Reporting and Documentation

Quick Reference

Nmap Cheat Sheet

Common Ports Reference

Constraints and Limitations

Legal Considerations

Technical Limitations

Best Practices

Troubleshooting

Scan Not Detecting Hosts

Slow Scan Performance

Web Scanner Missing Vulnerabilities

Related Skills

flow

verify

feature-flags

flags