VulnScan
An interactive network scanner that finds hosts, fingerprints services, matches them to known CVEs and writes offline reports.
Overview#
VulnScan is a command-line network vulnerability assessment scanner. It is distinct from AutoBugBounty (web bug-bounty recon) and VulnTrust (a monitoring platform): VulnScan focuses on assessing hosts on a network and correlating what it finds with known exploits and CVEs.
What I built#
- Host discovery and interactive host selection with Nmap.
- Three scan profiles: fast, full TCP, and custom ports.
- Service and version detection, with misconfiguration checks (FTP, SMB, Redis, MongoDB, HTTP security headers, and more).
- SearchSploit correlation and CVE lookup via the CIRCL CVE API.
- Web reconnaissance: WHOIS, DNS records, subdomain enumeration and HTTP technology detection.
Architecture#
The scan runs as a staged pipeline: discovery and host selection, scan profile, service and version detection, misconfiguration checks, exploit and CVE correlation, web reconnaissance, and finally offline JSON and HTML reports per host. It is built in Python with Typer, Rich, Pydantic and Jinja2.