Common Vulnerability Scanning Tools
NMAP, AWVS, Appscan, Burpsuite, x-ray, Goby
NMAP: Comprehensive Network Scanning
Nmap is a versatile network reconnaissance tool offering multiple capabilities:
- Host discovery
- Port scanning
- Service version detection
- OS fingerprinting
- Password auditing
- Vulnerability detection
- Custom script creation
Host Discovery Commands
- Single host:
nmap 192.168.1.2 - Subnet scan:
nmap 192.168.1.1/24 - Multiple targets:
nmap 192.168.1.2 192.168.1.5 - IP range:
nmap 192.168.1.1-100 - File-based targets:
nmap -iL hosts.txt - List generation:
nmap -sL 192.168.1.1/24 - Exclusion:
nmap 192.168.1.1/24 --exclude 192.168.1.1 - File exclusion:
nmap 192.168.1.1/24 --excludefile skip.txt
Port Scanning Techniques
TCP Connect Scan (-sT) Stendard three-way handshake method:
- Client sends SYN
- Server responds with SYN/ACK
- Client replies with ACK
- Client terminates connection
SYN Stealth Scan (-sS) Half-open scanning requiring elevated privileges:
- No complete TCP connection established
- Evades basic logging systems
Advanced Scanning Options
nmap -PU 192.168.1.0/24 # UDP host discovery
nmap -sV 192.168.1.1 # Service version detection
nmap -O 192.168.1.19 # OS detection
nmap -A 192.168.1.19 # Aggressive scan
nmap -oN results.txt 192.168.1.1 # Save to file
nmap -oX results.xml 192.168.1.1 # XML format
Information Gathering Scripts
nmap --script hostmap-ip2hosts target.com
nmap --script dns-brute example.com
nmap -p 445 --script smb-security-mode 192.168.1.1
nmap -p80 --script http-xss-scan www.target.com
nmap -p80 --script http-sql-injection 192.168.1.100
nmap -p80 --script=http-headers site.com
nmap -sU -p161 --script=snmp-services 192.168.1.1
Credential Testing
VNC Brute Force
nmap --script vnc-brute --script-args userdb=users.txt,passdb=passwords.txt target_ip
Telnet Authentication
nmap -p 23 --script telnet-brute --script-args userdb=users.lst,passdb=passwords.lst target_ip
FTP Credential Testing
nmap --script ftp-brute --script-args brute.threads=3 target_ip
Vulnerability Detection
nmap --script vuln 192.168.1.1
nmap -p 8080 --script http-iis-short-name-brute 192.168.1.1
nmap --script http-put --script-args http-put.url=/test.txt target_ip
nmap --script mysql-empty-password target_ip
Acunetix Web Vulnerability Scanner (AWVS)
AWVS performs automated security testing of web applications through crawling and scanning.
Key features include:
- Web crawling
- Vulnerability assessment
- Target discovery
- Subdomain enumeration
- HTTP traffic manipulation
- Service scanning
- Authentication testing
Scan results display in an interactive dashboard with detailed vulnerability information.
IBM AppScan
Enterprise-grade web application security testing platform with comprehensive scanning capbailities.
X-ray Security Tool
Command-line security assessmetn tool supporting custom vulnerability detection.
Basic Crawling Scan
xray webscan --basic-crawler http://example.com --html-output results.html
Passive Proxy Scanning
xray webscan --listen 127.0.0.1:7777 --html-output proxy.html
Single URL Assessment
xray webscan --url http://target.com --html-output single.html
Goby Security Scanner
Network asset discovery and vulnerability assessment tool with extensible plugin architecture.
Goby provides:
- Comprehensive attack surface mapping
- Efficient vulnerability scanning
- Plugin ecosystem for extended functionality
- Integration capabilities with other security tools
Goby and X-ray Integration
Configure X-ray path in Goby's extension settings:
- Set X-ray executable location
- Configure scanning parameters
- Initiate scans directly from asset discovery results
Goby and Domain Scanning Integration
Subdomain discovery tools can feed targets into Goby for batch vulnerability assessment:
- Import domain lists from scanning tools
- Paste directly into Goby's target field
- Perform comprehensive security testing
Effective security testing often involves combining multiple tools for comprehensive coverage.