nmap-vulners
Nmap NSE script that uses Vulners.com API to detect software vulnerabilities during network scans.
What is nmap-vulners?
nmap-vulners is an Nmap Scripting Engine (NSE) script that enhances network security scans by detecting known vulnerabilities in discovered software versions. It queries the Vulners.com vulnerability database to provide CVE information directly within nmap output, helping identify security risks during penetration testing or security assessments.
Security professionals, penetration testers, and system administrators who use nmap for network reconnaissance and vulnerability assessment.
It provides free, real-time vulnerability intelligence directly within nmap scans, eliminating the need for separate vulnerability database lookups and integrating seamlessly with existing security workflows.
Overview
NSE script based on Vulners.com API
Use Cases
Best For
- Quick vulnerability assessment during penetration testing engagements
- Identifying CVEs in network services during security audits
- Prioritizing patching based on CVSS scores in discovered software
- Enhancing nmap scans with vulnerability intelligence
- Detecting web application software versions via HTTP responses
- Integrating vulnerability scanning into automated security pipelines
Not Ideal For
- Scenarios requiring offline vulnerability scanning without internet access
- Projects needing deep, application-specific vulnerability analysis beyond CVE matching
- Environments with custom or legacy software not indexed in the Vulners.com database
Pros & Cons
Pros
Integrates directly into nmap's version detection (-sV), allowing vulnerability data to appear in standard scan outputs without external tools, as highlighted in the README's usage examples.
Supports filtering vulnerabilities by minimum CVSS score (v2 or v3) via script arguments, enabling prioritization of critical issues during security assessments.
Includes the http-vulners-regex companion script that scans HTTP responses to identify software, boosting detection rates for web applications, as shown in the example images.
Offers vulners_enterprise with API key support and CVSS v3 scoring, catering to professional teams with advanced needs, though it requires a paid Vulners Enterprise subscription.
Cons
Relies on real-time queries to the Vulners.com database, making it ineffective for air-gapped networks or offline scanning scenarios, as no local cache is mentioned.
Installation requires copying files to specific system directories and running nmap --script-updatedb, which can be error-prone and varies by OS, as detailed in the README's installation steps.
Effectiveness hinges on nmap's -sV flag; if version detection fails or is omitted, the script provides no vulnerability data, limiting its use in broader scan types.
Frequently Asked Questions
Related Projects
VaultA tool for secrets management, encryption as a service, and privileged access management
How-to-Secure-A-Linux-ServerAn evolving how-to guide for securing a Linux server.
fail2banDaemon to ban hosts that cause multiple authentication errors
lynisLynis - Security auditing tool for Linux, macOS, and UNIX-based systems. Assists with compliance testing (HIPAA/ISO27001/PCI DSS) and system hardening. Agentless, and installation optional.
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.