Security Scanning Tools Purpose Master essential security scanning tools for network discovery, vulnerability assessment, web application testing, wireless security, and compliance validation. This skill covers tool selection, configuration, and practical usage across different scanning categories. Prerequisites Required Environment Linux-based system (Kali Linux recommended) Network access to target systems Proper authorization for scanning activities Required Knowledge Basic networking concepts (TCP/IP, ports, protocols) Understanding of common vulnerabilities Familiarity with command-line interfaces Outputs and Deliverables Network Discovery Reports - Identified hosts, ports, and services Vulnerability Assessment Reports - CVEs, misconfigurations, risk ratings Web Application Security Reports - OWASP Top 10 findings Compliance Reports - CIS benchmarks, PCI-DSS, HIPAA checks Core Workflow Phase 1: Network Scanning Tools Nmap (Network Mapper) Primary tool for network discovery and security auditing:

Host discovery

nmap -sn 192.168 .1.0/24

Ping scan (no port scan)

nmap -sL 192.168 .1.0/24

List scan (DNS resolution)

nmap -Pn 192.168 .1.100

Skip host discovery

Port scanning techniques

nmap -sS 192.168 .1.100

TCP SYN scan (stealth)

nmap -sT 192.168 .1.100

TCP connect scan

nmap -sU 192.168 .1.100

UDP scan

nmap -sA 192.168 .1.100

ACK scan (firewall detection)

Port specification

nmap -p 80,443 192.168 .1.100

Specific ports

nmap -p- 192.168 .1.100

All 65535 ports

nmap -p 1 -1000 192.168 .1.100

Port range

nmap --top-ports 100 192.168 .1.100

Top 100 common ports

Service and OS detection

nmap -sV 192.168 .1.100

Service version detection

nmap -O 192.168 .1.100

OS detection

nmap -A 192.168 .1.100

Aggressive (OS, version, scripts)

Timing and performance

nmap -T0 192.168 .1.100

Paranoid (slowest, IDS evasion)

nmap -T4 192.168 .1.100

Aggressive (faster)

nmap -T5 192.168 .1.100

Insane (fastest)

NSE Scripts

nmap --script = vuln 192.168 .1.100

Vulnerability scripts

nmap --script = http-enum 192.168 .1.100

Web enumeration

nmap --script = smb-vuln* 192.168 .1.100

SMB vulnerabilities

nmap --script = default 192.168 .1.100

Default script set

Output formats

nmap -oN scan.txt 192.168 .1.100

Normal output

nmap -oX scan.xml 192.168 .1.100

XML output

nmap -oG scan.gnmap 192.168 .1.100

Grepable output

nmap -oA scan 192.168 .1.100

All formats

Masscan High-speed port scanning for large networks:

Basic scanning

masscan -p80 192.168 .1.0/24 --rate = 1000 masscan -p80,443,8080 192.168 .1.0/24 --rate = 10000

Full port range

masscan -p0-65535 192.168 .1.0/24 --rate = 5000

Large-scale scanning

masscan 0.0 .0.0/0 -p443 --rate = 100000 --excludefile exclude.txt

Output formats

masscan -p80 192.168 .1.0/24 -oG results.gnmap masscan -p80 192.168 .1.0/24 -oJ results.json masscan -p80 192.168 .1.0/24 -oX results.xml

Banner grabbing

masscan -p80 192.168 .1.0/24 --banners Phase 2: Vulnerability Scanning Tools Nessus Enterprise-grade vulnerability assessment:

Start Nessus service

sudo systemctl start nessusd

Access web interface

https://localhost:8834

Command-line (nessuscli)

nessuscli scan --create --name "Internal Scan" --targets 192.168 .1.0/24 nessuscli scan --list nessuscli scan --launch < scan_id

nessuscli report --format pdf --output report.pdf < scan_id

Key Nessus features: Comprehensive CVE detection Compliance checks (PCI-DSS, HIPAA, CIS) Custom scan templates Credentialed scanning for deeper analysis Regular plugin updates OpenVAS (Greenbone) Open-source vulnerability scanning:

Install OpenVAS

sudo apt install openvas sudo gvm-setup

Start services

sudo gvm-start

Access web interface (Greenbone Security Assistant)

https://localhost:9392

Command-line operations

gvm-cli socket --xml "" gvm-cli socket --xml ""

Create and run scan

gvm-cli socket --xml ' Test Target 192.168.1.0/24 ' Phase 3: Web Application Scanning Tools Burp Suite Comprehensive web application testing:

Proxy configuration

1. Set browser proxy to 127.0.0.1:8080
2. Import Burp CA certificate for HTTPS
3. Add target to scope

Key modules:

• Proxy: Intercept and modify requests
• Spider: Crawl web applications
• Scanner: Automated vulnerability detection
• Intruder: Automated attacks (fuzzing, brute-force)
• Repeater: Manual request manipulation
• Decoder: Encode/decode data
• Comparer: Compare responses Core testing workflow: Configure proxy and scope Spider the application Analyze sitemap Run active scanner Manual testing with Repeater/Intruder Review findings and generate report OWASP ZAP Open-source web application scanner:

Start ZAP

zaproxy

Automated scan from CLI

zap-cli quick-scan https://target.com

Full scan

zap-cli spider https://target.com zap-cli active-scan https://target.com

Generate report

zap-cli report -o report.html -f html

API mode

zap.sh -daemon -port 8080 -config api.key = < your_key

ZAP automation:

Docker-based scanning

docker run -t owasp/zap2docker-stable zap-full-scan.py \ -t https://target.com -r report.html

Baseline scan (passive only)

docker run -t owasp/zap2docker-stable zap-baseline.py \ -t https://target.com -r report.html Nikto Web server vulnerability scanner:

Basic scan

nikto -h https://target.com

Scan specific port

nikto -h target.com -p 8080

Scan with SSL

nikto -h target.com -ssl

Multiple targets

nikto -h targets.txt

Output formats

nikto -h target.com -o report.html -Format html nikto -h target.com -o report.xml -Format xml nikto -h target.com -o report.csv -Format csv

Tuning options

nikto -h target.com -Tuning 123456789

All tests

nikto -h target.com -Tuning x

Exclude specific tests

Phase 4: Wireless Scanning Tools Aircrack-ng Suite Wireless network penetration testing:

Check wireless interface

airmon-ng

Enable monitor mode

sudo airmon-ng start wlan0

Scan for networks

sudo airodump-ng wlan0mon

Capture specific network

sudo airodump-ng -c < channel

--bssid < target_bssid

-w capture wlan0mon

Deauthentication attack

sudo aireplay-ng -0 10 -a < bssid

wlan0mon

Crack WPA handshake

aircrack-ng -w wordlist.txt -b < bssid

capture*.cap

Crack WEP

aircrack-ng -b < bssid

capture*.cap Kismet Passive wireless detection:

Start Kismet

kismet

Specify interface

kismet -c wlan0

Access web interface

http://localhost:2501

Detect hidden networks

Kismet passively collects all beacon frames

including those from hidden SSIDs

Phase 5: Malware and Exploit Scanning ClamAV Open-source antivirus scanning:

Update virus definitions

sudo freshclam

Scan directory

clamscan -r /path/to/scan

Scan with verbose output

clamscan -r -v /path/to/scan

Move infected files

clamscan -r --move = /quarantine /path/to/scan

Remove infected files

clamscan -r --remove /path/to/scan

Scan specific file types

clamscan -r --include = '.exe$|.dll$' /path/to/scan

Output to log

clamscan -r -l scan.log /path/to/scan Metasploit Vulnerability Validation Validate vulnerabilities with exploitation:

Start Metasploit

msfconsole

Database setup

msfdb init db_status

Import Nmap results

db_import /path/to/nmap_scan.xml

Vulnerability scanning

use auxiliary/scanner/smb/smb_ms17_010 set RHOSTS 192.168 .1.0/24 run

Auto exploitation

vulns

View vulnerabilities

analyze

Suggest exploits

Phase 6: Cloud Security Scanning Prowler (AWS) AWS security assessment:

Install Prowler

pip install prowler

Basic scan

prowler aws

Specific checks

prowler aws -c iam s3 ec2

Compliance framework

prowler aws --compliance cis_aws

Output formats

prowler aws -M html json csv

Specific region

prowler aws -f us-east-1

Assume role

prowler aws -R arn:aws:iam::123456789012:role/ProwlerRole ScoutSuite (Multi-cloud) Multi-cloud security auditing:

Install ScoutSuite

pip install scoutsuite

AWS scan

scout aws

Azure scan

scout azure --cli

GCP scan

scout gcp --user-account

Generate report

scout aws --report-dir ./reports Phase 7: Compliance Scanning Lynis Security auditing for Unix/Linux:

Run audit

sudo lynis audit system

Quick scan

sudo lynis audit system --quick

Specific profile

sudo lynis audit system --profile server

Output report

sudo lynis audit system --report-file /tmp/lynis-report.dat

Check specific section

sudo lynis show profiles sudo lynis audit system --tests-from-group malware OpenSCAP Security compliance scanning:

List available profiles

oscap info /usr/share/xml/scap/ssg/content/ssg- < distro

-ds.xml

Run scan with profile

oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_pci-dss \ --report report.html \ /usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml

Generate fix script

oscap xccdf generate fix \ --profile xccdf_org.ssgproject.content_profile_pci-dss \ --output remediation.sh \ /usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml Phase 8: Scanning Methodology Structured scanning approach: Planning Define scope and objectives Obtain proper authorization Select appropriate tools Discovery Host discovery (Nmap ping sweep) Port scanning Service enumeration Vulnerability Assessment Automated scanning (Nessus/OpenVAS) Web application scanning (Burp/ZAP) Manual verification Analysis Correlate findings Eliminate false positives Prioritize by severity Reporting Document findings Provide remediation guidance Executive summary Phase 9: Tool Selection Guide Choose the right tool for each scenario: Scenario Recommended Tools Network Discovery Nmap, Masscan Vulnerability Assessment Nessus, OpenVAS Web App Testing Burp Suite, ZAP, Nikto Wireless Security Aircrack-ng, Kismet Malware Detection ClamAV, YARA Cloud Security Prowler, ScoutSuite Compliance Lynis, OpenSCAP Protocol Analysis Wireshark, tcpdump Phase 10: Reporting and Documentation Generate professional reports:

Nmap XML to HTML

xsltproc nmap-output.xml -o report.html

OpenVAS report export

gvm-cli socket --xml ''

Combine multiple scan results

Use tools like Faraday, Dradis, or custom scripts

Executive summary template:

1. Scope and methodology

2. Key findings summary

3. Risk distribution chart

4. Critical vulnerabilities

5. Remediation recommendations

6. Detailed technical findings

Quick Reference Nmap Cheat Sheet Scan Type Command Ping Scan nmap -sn Quick Scan nmap -T4 -F Full Scan nmap -p- Service Scan nmap -sV OS Detection nmap -O Aggressive nmap -A Vuln Scripts nmap --script=vuln Stealth Scan nmap -sS -T2 Common Ports Reference Port Service 21 FTP 22 SSH 23 Telnet 25 SMTP 53 DNS 80 HTTP 443 HTTPS 445 SMB 3306 MySQL 3389 RDP Constraints and Limitations Legal Considerations Always obtain written authorization Respect scope boundaries Follow responsible disclosure practices Comply with local laws and regulations Technical Limitations Some scans may trigger IDS/IPS alerts Heavy scanning can impact network performance False positives require manual verification Encrypted traffic may limit analysis Best Practices Start with non-intrusive scans Gradually increase scan intensity Document all scanning activities Validate findings before reporting Troubleshooting Scan Not Detecting Hosts Solutions: Try different discovery methods: nmap -Pn or nmap -sn -PS/PA/PU Check firewall rules blocking ICMP Use TCP SYN scan: nmap -PS22,80,443 Verify network connectivity Slow Scan Performance Solutions: Increase timing: nmap -T4 or -T5 Reduce port range: --top-ports 100 Use Masscan for initial discovery Disable DNS resolution: -n Web Scanner Missing Vulnerabilities Solutions: Authenticate to access protected areas Increase crawl depth Add custom injection points Use multiple tools for coverage Perform manual testing When to Use This skill is applicable to execute the workflow or actions described in the overview.