Master Security Scanning Tools

Provides working knowledge of essential security scanning tools across network discovery, vulnerability assessment, web application testing, wireless security, malware detection, cloud security, and compliance validation, for authorized scanning activities against systems the user has explicit permission to test.

Use this skill when discovering hosts and services on a network, running vulnerability scans, testing web applications for OWASP Top 10 issues, auditing wireless networks, scanning for malware, assessing cloud account security posture (AWS/Azure/GCP), or validating compliance against CIS/PCI-DSS/HIPAA benchmarks - always with proper written authorization and defined scope. Not for scanning systems without authorization, and heavy/aggressive scanning should be avoided against production systems without explicit permission given its potential to trigger IDS/IPS alerts or impact performance.

Covers ten phases of tooling: network scanning (Nmap host discovery, SYN/connect/UDP/ACK scans, NSE vulnerability scripts, timing templates from paranoid to insane; Masscan for high-rate large-network scanning), vulnerability scanning (Nessus with nessuscli scan creation and PDF reporting; OpenVAS/Greenbone via gvm-cli), web application scanning (Burp Suite's proxy/spider/scanner/intruder/repeater workflow; OWASP ZAP CLI and Docker baseline/full scans; Nikto web server scanning), wireless scanning (Aircrack-ng suite for monitor mode, handshake capture, and WPA/WEP cracking; Kismet for passive detection of hidden SSIDs), malware and exploit validation (ClamAV scanning with quarantine/remove options; Metasploit's db_import and auxiliary scanner modules for exploit-based vulnerability validation), cloud security (Prowler for AWS compliance checks; ScoutSuite for multi-cloud AWS/Azure/GCP auditing), and compliance scanning (Lynis system auditing; OpenSCAP XCCDF profile evaluation and remediation-script generation).

A nine-step tool-selection table maps each scenario (network discovery, vulnerability assessment, web app testing, wireless, malware, cloud, compliance, protocol analysis) to its recommended tools, and a five-phase methodology runs planning (scope and authorization) through discovery, vulnerability assessment, analysis (false-positive elimination, severity prioritization), and reporting.

Chains a broad open-source and commercial toolset: Nmap and Masscan for discovery, Nessus and OpenVAS for vulnerability scanning, Burp Suite and OWASP ZAP for web application testing, Aircrack-ng and Kismet for wireless, ClamAV and Metasploit for malware/exploit validation, Prowler and ScoutSuite for cloud security, and Lynis and OpenSCAP for compliance - with results exportable to XML/JSON/HTML for downstream reporting tools like Faraday or Dradis.

Security professionals and penetration testers running authorized assessments who need the right tool and exact command for each scanning category - network, web, wireless, cloud, or compliance - rather than searching each tool's documentation separately.

nmap -sV -A --script=vuln 192.168.1.100