--- name: security-scanning-tools-fb487cf3bf46 description: This skill should be used when the user asks to "perform vulnerability scanning", "scan networks for open ports", "assess web application security", "scan wireless networks", "detect malware", "check cloud security", or "evaluate system compliance". It provides comprehensive guidance on security scanning tools and methodologies. metadata: author: zebbern version: "1.1" --- # Security Scanning Tools ## Purpose Master essential security scanning tools for network discovery, vulnerability assessment, web application testing, wireless security, and compliance validation. This skill covers tool selection, configuration, and practical usage across different scanning categories. ## Prerequisites ### Required Environment - Linux-based system (Kali Linux recommended) - Network access to target systems - Proper authorization for scanning activities ### Required Knowledge - Basic networking concepts (TCP/IP, ports, protocols) - Understanding of common vulnerabilities - Familiarity with command-line interfaces ## Outputs and Deliverables 1. **Network Discovery Reports** - Identified hosts, ports, and services 2. **Vulnerability Assessment Reports** - CVEs, misconfigurations, risk ratings 3. **Web Application Security Reports** - OWASP Top 10 findings 4. **Compliance Reports** - CIS benchmarks, PCI-DSS, HIPAA checks ## Core Workflow ### Phase 1: Network Scanning Tools #### Nmap (Network Mapper) Primary tool for network discovery and security auditing: ```bash # Host discovery nmap -sn 192.168.1.0/24 # Ping scan (no port scan) nmap -sL 192.168.1.0/24 # List scan (DNS resolution) nmap -Pn 192.168.1.100 # Skip host discovery # Port scanning techniques nmap -sS 192.168.1.100 # TCP SYN scan (stealth) nmap -sT 192.168.1.100 # TCP connect scan nmap -sU 192.168.1.100 # UDP scan nmap -sA 192.168.1.100 # ACK scan (firewall detection) # Port specification nmap -p 80,443 192.168.1.100 # Specific ports nmap -p- 192.168.1.100 # All 65535 ports nmap -p 1-1000 192.168.1.100 # Port range nmap --top-ports 100 192.168.1.100 # Top 100 common ports # Service and OS detection nmap -sV 192.168.1.100 # Service version detection nmap -O 192.168.1.100 # OS detection nmap -A 192.168.1.100 # Aggressive (OS, version, scripts) # Timing and performance nmap -T0 192.168.1.100 # Paranoid (slowest, IDS evasion) nmap -T4 192.168.1.100 # Aggressive (faster) nmap -T5 192.168.1.100 # Insane (fastest) # NSE Scripts nmap --script=vuln 192.168.1.100 # Vulnerability scripts nmap --script=http-enum 192.168.1.100 # Web enumeration nmap --script=smb-vuln* 192.168.1.100 # SMB vulnerabilities nmap --script=default 192.168.1.100 # Default script set # Output formats nmap -oN scan.txt 192.168.1.100 # Normal output nmap -oX scan.xml 192.168.1.100 # XML output nmap -oG scan.gnmap 192.168.1.100 # Grepable output nmap -oA scan 192.168.1.100 # All formats ``` #### Masscan High-speed port scanning for large networks: ```bash # Basic scanning masscan -p80 192.168.1.0/24 --rate=1000 masscan -p80,443,8080 192.168.1.0/24 --rate=10000 # Full port range masscan -p0-65535 192.168.1.0/24 --rate=5000 # Large-scale scanning masscan 0.0.0.0/0 -p443 --rate=100000 --excludefile exclude.txt # Output formats masscan -p80 192.168.1.0/24 -oG results.gnmap masscan -p80 192.168.1.0/24 -oJ results.json masscan -p80 192.168.1.0/24 -oX results.xml # Banner grabbing masscan -p80 192.168.1.0/24 --banners ``` ### Phase 2: Vulnerability Scanning Tools #### Nessus Enterprise-grade vulnerability assessment: ```bash # Start Nessus service sudo systemctl start nessusd # Access web interface # https://localhost:8834 # Command-line (nessuscli) nessuscli scan --create --name "Internal Scan" --targets 192.168.1.0/24 nessuscli scan --list nessuscli scan --launch nessuscli report --format pdf --output report.pdf ``` Key Nessus features: - Comprehensive CVE detection - Compliance checks (PCI-DSS, HIPAA, CIS) - Custom scan templates - Credentialed scanning for deeper analysis - Regular plugin updates #### OpenVAS (Greenbone) Open-source vulnerability scanning: ```bash # Install OpenVAS sudo apt install openvas sudo gvm-setup # Start services sudo gvm-start # Access web interface (Greenbone Security Assistant) # https://localhost:9392 # Command-line operations gvm-cli socket --xml "" gvm-cli socket --xml "" # Create and run scan gvm-cli socket --xml ' Test Target 192.168.1.0/24 ' ``` ### Phase 3: Web Application Scanning Tools #### Burp Suite Comprehensive web application testing: ``` # Proxy configuration 1. Set browser proxy to 127.0.0.1:8080 2. Import Burp CA certificate for HTTPS 3. Add target to scope # Key modules: - Proxy: Intercept and modify requests - Spider: Crawl web applications - Scanner: Automated vulnerability detection - Intruder: Automated attacks (fuzzing, brute-force) - Repeater: Manual request manipulation - Decoder: Encode/decode data - Comparer: Compare responses ``` Core testing workflow: 1. Configure proxy and scope 2. Spider the application 3. Analyze sitemap 4. Run active scanner 5. Manual testing with Repeater/Intruder 6. Review findings and generate report #### OWASP ZAP Open-source web application scanner: ```bash # Start ZAP zaproxy # Automated scan from CLI zap-cli quick-scan https://target.com # Full scan zap-cli spider https://target.com zap-cli active-scan https://target.com # Generate report zap-cli report -o report.html -f html # API mode zap.sh -daemon -port 8080 -config api.key= ``` ZAP automation: ```bash # Docker-based scanning docker run -t owasp/zap2docker-stable zap-full-scan.py \ -t https://target.com -r report.html # Baseline scan (passive only) docker run -t owasp/zap2docker-stable zap-baseline.py \ -t https://target.com -r report.html ``` #### Nikto Web server vulnerability scanner: ```bash # Basic scan nikto -h https://target.com # Scan specific port nikto -h target.com -p 8080 # Scan with SSL nikto -h target.com -ssl # Multiple targets nikto -h targets.txt # Output formats nikto -h target.com -o report.html -Format html nikto -h target.com -o report.xml -Format xml nikto -h target.com -o report.csv -Format csv # Tuning options nikto -h target.com -Tuning 123456789 # All tests nikto -h target.com -Tuning x # Exclude specific tests ``` ### Phase 4: Wireless Scanning Tools #### Aircrack-ng Suite Wireless network penetration testing: ```bash # Check wireless interface airmon-ng # Enable monitor mode sudo airmon-ng start wlan0 # Scan for networks sudo airodump-ng wlan0mon # Capture specific network sudo airodump-ng -c --bssid -w capture wlan0mon # Deauthentication attack sudo aireplay-ng -0 10 -a wlan0mon # Crack WPA handshake aircrack-ng -w wordlist.txt -b capture*.cap # Crack WEP aircrack-ng -b capture*.cap ``` #### Kismet Passive wireless detection: ```bash # Start Kismet kismet # Specify interface kismet -c wlan0 # Access web interface # http://localhost:2501 # Detect hidden networks # Kismet passively collects all beacon frames # including those from hidden SSIDs ``` ### Phase 5: Malware and Exploit Scanning #### ClamAV Open-source antivirus scanning: ```bash # Update virus definitions sudo freshclam # Scan directory clamscan -r /path/to/scan # Scan with verbose output clamscan -r -v /path/to/scan # Move infected files clamscan -r --move=/quarantine /path/to/scan # Remove infected files clamscan -r --remove /path/to/scan # Scan specific file types clamscan -r --include='\.exe$|\.dll$' /path/to/scan # Output to log clamscan -r -l scan.log /path/to/scan ``` #### Metasploit Vulnerability Validation Validate vulnerabilities with exploitation: ```bash # Start Metasploit msfconsole # Database setup msfdb init db_status # Import Nmap results db_import /path/to/nmap_scan.xml # Vulnerability scanning use auxiliary/scanner/smb/smb_ms17_010 set RHOSTS 192.168.1.0/24 run # Auto exploitation vulns # View vulnerabilities analyze # Suggest exploits ``` ### Phase 6: Cloud Security Scanning #### Prowler (AWS) AWS security assessment: ```bash # Install Prowler pip install prowler # Basic scan prowler aws # Specific checks prowler aws -c iam s3 ec2 # Compliance framework prowler aws --compliance cis_aws # Output formats prowler aws -M html json csv # Specific region prowler aws -f us-east-1 # Assume role prowler aws -R arn:aws:iam::123456789012:role/ProwlerRole ``` #### ScoutSuite (Multi-cloud) Multi-cloud security auditing: ```bash # Install ScoutSuite pip install scoutsuite # AWS scan scout aws # Azure scan scout azure --cli # GCP scan scout gcp --user-account # Generate report scout aws --report-dir ./reports ``` ### Phase 7: Compliance Scanning #### Lynis Security auditing for Unix/Linux: ```bash # Run audit sudo lynis audit system # Quick scan sudo lynis audit system --quick # Specific profile sudo lynis audit system --profile server # Output report sudo lynis audit system --report-file /tmp/lynis-report.dat # Check specific section sudo lynis show profiles sudo lynis audit system --tests-from-group malware ``` #### OpenSCAP Security compliance scanning: ```bash # List available profiles oscap info /usr/share/xml/scap/ssg/content/ssg--ds.xml # Run scan with profile oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_pci-dss \ --report report.html \ /usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml # Generate fix script oscap xccdf generate fix \ --profile xccdf_org.ssgproject.content_profile_pci-dss \ --output remediation.sh \ /usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml ``` ### Phase 8: Scanning Methodology Structured scanning approach: 1. **Planning** - Define scope and objectives - Obtain proper authorization - Select appropriate tools 2. **Discovery** - Host discovery (Nmap ping sweep) - Port scanning - Service enumeration 3. **Vulnerability Assessment** - Automated scanning (Nessus/OpenVAS) - Web application scanning (Burp/ZAP) - Manual verification 4. **Analysis** - Correlate findings - Eliminate false positives - Prioritize by severity 5. **Reporting** - Document findings - Provide remediation guidance - Executive summary ### Phase 9: Tool Selection Guide Choose the right tool for each scenario: | Scenario | Recommended Tools | |----------|-------------------| | Network Discovery | Nmap, Masscan | | Vulnerability Assessment | Nessus, OpenVAS | | Web App Testing | Burp Suite, ZAP, Nikto | | Wireless Security | Aircrack-ng, Kismet | | Malware Detection | ClamAV, YARA | | Cloud Security | Prowler, ScoutSuite | | Compliance | Lynis, OpenSCAP | | Protocol Analysis | Wireshark, tcpdump | ### Phase 10: Reporting and Documentation Generate professional reports: ```bash # Nmap XML to HTML xsltproc nmap-output.xml -o report.html # OpenVAS report export gvm-cli socket --xml '' # Combine multiple scan results # Use tools like Faraday, Dradis, or custom scripts # Executive summary template: # 1. Scope and methodology # 2. Key findings summary # 3. Risk distribution chart # 4. Critical vulnerabilities # 5. Remediation recommendations # 6. Detailed technical findings ``` ## Quick Reference ### Nmap Cheat Sheet | Scan Type | Command | |-----------|---------| | Ping Scan | `nmap -sn ` | | Quick Scan | `nmap -T4 -F ` | | Full Scan | `nmap -p- ` | | Service Scan | `nmap -sV ` | | OS Detection | `nmap -O ` | | Aggressive | `nmap -A ` | | Vuln Scripts | `nmap --script=vuln ` | | Stealth Scan | `nmap -sS -T2 ` | ### Common Ports Reference | Port | Service | |------|---------| | 21 | FTP | | 22 | SSH | | 23 | Telnet | | 25 | SMTP | | 53 | DNS | | 80 | HTTP | | 443 | HTTPS | | 445 | SMB | | 3306 | MySQL | | 3389 | RDP | ## Constraints and Limitations ### Legal Considerations - Always obtain written authorization - Respect scope boundaries - Follow responsible disclosure practices - Comply with local laws and regulations ### Technical Limitations - Some scans may trigger IDS/IPS alerts - Heavy scanning can impact network performance - False positives require manual verification - Encrypted traffic may limit analysis ### Best Practices - Start with non-intrusive scans - Gradually increase scan intensity - Document all scanning activities - Validate findings before reporting ## Troubleshooting ### Scan Not Detecting Hosts **Solutions:** 1. Try different discovery methods: `nmap -Pn` or `nmap -sn -PS/PA/PU` 2. Check firewall rules blocking ICMP 3. Use TCP SYN scan: `nmap -PS22,80,443` 4. Verify network connectivity ### Slow Scan Performance **Solutions:** 1. Increase timing: `nmap -T4` or `-T5` 2. Reduce port range: `--top-ports 100` 3. Use Masscan for initial discovery 4. Disable DNS resolution: `-n` ### Web Scanner Missing Vulnerabilities **Solutions:** 1. Authenticate to access protected areas 2. Increase crawl depth 3. Add custom injection points 4. Use multiple tools for coverage 5. Perform manual testing --- Source attribution: Dicklesworthstone Original project: https://github.com/Dicklesworthstone/pi_agent_rust/blob/f28fc46ee0db8e710d95b8b55592cd38d60f2b26/tests/ext_conformance/artifacts/templates-davila7/cli-tool/components/skills/security/scanning-tools/SKILL.md License: MIT License information: https://opensource.org/license/mit Original upstream instructions; downloaded from Mega AI Hub. ## Upstream license notice MIT License (with OpenAI/Anthropic Rider) Copyright (c) 2026 Jeffrey Emanuel Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: ADDITIONAL RIDER / RESTRICTION (OpenAI / Anthropic): This rider is part of the "conditions" of this License. In the event of any conflict between this rider and any other portion of this License, this rider controls. "Restricted Parties" means OpenAI, L.L.C.; Anthropic, PBC; any of their respective Affiliates; and any person or entity acting directly or indirectly on behalf of, for the benefit of, or under the direction of any of the foregoing (including any officer, director, employee, contractor, agent, consultant, service provider, or representative). Notwithstanding any other provision of this License, no rights are granted to any Restricted Party. Any purported license, sublicense, assignment, transfer, or other permission to any Restricted Party is null and void absent the express prior written permission of Jeffrey Emanuel. You may not provide, disclose, distribute, sublicense, sell, lease, lend, host, make available, or otherwise permit access to the Software or any derivative work of the Software (as defined in applicable copyright law) (collectively, "Derivative Works") to or for any Restricted Party. For purposes of this rider, "use" includes, without limitation: copying, modifying, merging, publishing, distributing, sublicensing, selling, transferring, making available, hosting, deploying, executing, benchmarking, testing, analyzing, indexing, or incorporating the Software or any Derivative Works into any dataset, training corpus, evaluation harness, or pipeline for machine learning or other automated systems. This rider applies to the Software and all Derivative Works. As a condition of use, you agree that this rider is a precondition to exercising any rights under this License, and you agree that any distribution of the Software or any Derivative Works must include this rider provision unmodified. Any breach of this rider automatically and immediately terminates the permissions granted by this License. Upon termination, you must immediately cease all use and distribution of the Software and any Derivative Works and destroy all copies under your control. You agree that a breach of this rider would cause irreparable harm and that Jeffrey Emanuel may seek injunctive or other equitable relief to enforce this rider, in addition to any other remedies available at law. To the maximum extent permitted by applicable law, the prevailing party in any action to enforce this rider shall be entitled to recover reasonable attorneys' fees and costs. For purposes of this rider, "Affiliate" means any entity that directly or indirectly controls, is controlled by, or is under common control with the specified party. "Control" means ownership of more than 50% of the voting securities or other ownership interest, or the power to direct management or policies by contract or otherwise. The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. # Mega AI Hub resource metadata Creator / publisher: Dicklesworthstone Original project: https://github.com/Dicklesworthstone/pi_agent_rust/blob/f28fc46ee0db8e710d95b8b55592cd38d60f2b26/tests/ext_conformance/artifacts/templates-davila7/cli-tool/components/skills/security/scanning-tools/SKILL.md Attribution basis: Source repository record Fields of work: Data & Analytics, Development & Engineering Roles: Data Analyst, QA / Test Engineer, Security Engineer Specialties: Backend, Testing Tools: Masscan, Nessus, Nmap Country applicability: Country not specified Classification basis: Source catalog labels Instruction SHA-256: fc980f1b5cce95e5c40c77feb00d9641761e86dc5c9f753e5a51d504462ff37d