# Vulnerability Scanners

[![ko-fi](https://ko-fi.com/img/githubbutton_sm.svg)](https://ko-fi.com/Y8Y41FQ2GA)

## Sirius

Open Source Vulnerability Scanner

{% embed url="<https://github.com/SiriusScan/Sirius>" %}

<figure><img src="https://4199783661-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFF3hT6DtJlHn9jAel9%2Fuploads%2FVQI780QOHsnd91fX1mda%2Fimage.png?alt=media&#x26;token=89b61ae6-c014-4f0f-a6bd-07bb35386713" alt=""><figcaption></figcaption></figure>

## Nessus

{% embed url="<https://www.digitalocean.com/community/tutorials/how-to-use-nessus-for-vulnerability-scanning-on-ubuntu-2204>" %}

* Download: <https://www.tenable.com/downloads/nessus?loginAttempted=true>

<figure><img src="https://4199783661-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFF3hT6DtJlHn9jAel9%2Fuploads%2FxocrQK9oDGyX9o7vPYsW%2Fdeb.webp?alt=media&#x26;token=6308f009-c041-49b6-b52c-6cf550705d8f" alt=""><figcaption></figcaption></figure>

* Request free licence: <https://www.tenable.com/products/nessus/activation-code>

<figure><img src="https://4199783661-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFF3hT6DtJlHn9jAel9%2Fuploads%2FN8LIIZZSZmuE1TGmPZ7F%2Fregister.webp?alt=media&#x26;token=cd128fdb-a220-4d9e-bda2-e6a754d88636" alt=""><figcaption></figcaption></figure>

* Install package:

```shell-session
dpkg -i Nessus-8.15.1-ubuntu910_amd64.deb
```

* Starting Nessus

```shell-session
sudo systemctl start nessusd.service
```

* Access Nessus: `https://localhost:8834`

<figure><img src="https://4199783661-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFF3hT6DtJlHn9jAel9%2Fuploads%2FV16mhsHJt1NpjxYQNDZM%2Fessentials.webp?alt=media&#x26;token=1caf1069-d2ad-4889-953b-27aa02f9c852" alt=""><figcaption></figcaption></figure>

### **Export Nessus Scan**

{% embed url="<https://raw.githubusercontent.com/eelsivart/nessus-report-downloader/master/nessus6-report-downloader.rb>" %}

```shell-session
$ ./nessus_downloader.rb 

Nessus 6 Report Downloader 1.0

Enter the Nessus Server IP: 127.0.0.1
Enter the Nessus Server Port [8834]: 8834
Enter your Nessus Username: admin
Enter your Nessus Password (will not echo): 

Getting report list...
Scan ID Name                                               Last Modified                  Status         
------- ----                                               -------------                  ------         
1     Windows_basic                                Aug 22, 2020 22:07 +00:00      completed      
         
Enter the report(s) your want to download (comma separate list) or 'all': 1

Choose File Type(s) to Download: 
[0] Nessus (No chapter selection)
[1] HTML
[2] PDF
[3] CSV (No chapter selection)
[4] DB (No chapter selection)
Enter the file type(s) you want to download (comma separate list) or 'all': 3

Path to save reports to (without trailing slash): /assessment_data/inlanefreight/scans/nessus

Downloading report(s). Please wait...

[+] Exporting scan report, scan id: 1, type: csv
[+] Checking export status...
[+] Report ready for download...
[+] Downloading report to: /assessment_data/inlanefreight/scans/nessus/inlanefreight_basic_5y3hxp.csv

Report Download Completed!
```

## OpenVAS

* Install on Ubuntu (OsBoxes)

`sudo su`

```shell-session
$ sudo apt-get update && apt-get -y full-upgrade
$ sudo apt-get install gvm && openvas
$ gvm-setup
```

* Start OpenVAS

```shell-session
gvm-start
```

Doesn't work on my ubuntu, use Docker: [https://greenbone.github.io/docs/latest/22.4/container/index.html](https://greenbone.github.io/docs/latest/22.4/container/index.html.)

```
osboxes@osboxes:~/greenbone-community-container$ xdg-open "http://127.0.0.1:9392" 2>/dev/null >/dev/null &
[1] 18911
osboxes@osboxes:~/greenbone-community-container$ 
```

Creds - admin::admin

<figure><img src="https://4199783661-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFF3hT6DtJlHn9jAel9%2Fuploads%2Fwe2RSgzpHwFqMjqu9fmu%2FPasted%20image%2020240407162643.png?alt=media&#x26;token=d6b54efb-681e-41b4-aacc-8df436af85fc" alt=""><figcaption></figcaption></figure>

### **Export result**

{% embed url="<https://github.com/TheGroundZero/openvasreporting>" %}

```shell-session
python3 -m openvasreporting -i report-2bf466b5-627d-4659-bea6-1758b43235b1.xml -f xlsx
```

stop all containers

`$ docker stop $(docker ps -a -q)`

***

## Web Apps Scan

### BBScan

{% embed url="<https://github.com/lijiejie/BBScan>" %}

### Nuclei

```
$ nuclei -update-templates
```

<pre><code>$ nuclei -u https://example.com -t ~/nuclei-templates/http/miscellaneous/robots-txt.yaml
<strong>$ nuclei -l hosts.txt
</strong></code></pre>

<figure><img src="https://4199783661-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFF3hT6DtJlHn9jAel9%2Fuploads%2Fn2KurNLNThJ78j7972St%2FPasted%20image%2020240522051018.png?alt=media&#x26;token=41e2c52a-c74f-4107-899c-81d2a491315f" alt=""><figcaption></figcaption></figure>

Reporting

```
$ nuclei -u https://www.google.com -t http/miscellaneous/robots-txt.yaml -include-rr -markdown-export ./
```

<figure><img src="https://4199783661-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFF3hT6DtJlHn9jAel9%2Fuploads%2FXHlhTSgBO2FRHm4t44Ta%2Fimage.png?alt=media&#x26;token=b855d087-93e8-4b3f-aae0-1f74cb1b9723" alt=""><figcaption></figcaption></figure>

#### Custom Templates

{% embed url="<https://github.com/solo10010/BugBounty-Hub/tree/main/endpoint-fuzz>" %}

{% embed url="<https://github.com/JoshMorrison99/url-based-nuclei-templates>" %}

{% embed url="<https://github.com/0xKayala/Custom-Nuclei-Templates>" %}

{% embed url="<https://github.com/coffinxp/priv8-Nuclei>" %}

{% embed url="<https://github.com/coffinxp/nuclei-templates>" %}

#### CVE Scanning Templates

{% embed url="<https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves>" %}

#### All Templates

{% embed url="<https://github.com/AggressiveUser/AllForOne>" %}

#### Nuclei AI Prompts

{% embed url="<https://nucleiprompts.com/>" %}

{% embed url="<https://github.com/huseyinstif/Nuclei-AI-Prompts>" %}

{% embed url="<https://www.youtube.com/watch?v=s7R8KAG8SeA>" %}

### NucleiFuzzer

{% embed url="<https://github.com/0xKayala/NucleiFuzzer>" %}

### Rogue - LLM agent

{% embed url="<https://github.com/faizann24/rogue?s=03>" %}

### OWASP Nettacker

{% embed url="<https://github.com/OWASP/Nettacker?s=03>" %}

### TerminatorZ

{% embed url="<https://github.com/blackhatethicalhacking/TerminatorZ?s=03>" %}

### Wapiti - Web Scan

{% embed url="<https://wapiti-scanner.github.io/>" %}

```
pip install wapiti3
```

```
 wapiti -u http://83.136.251.133:45582 -l 2
```

<figure><img src="https://4199783661-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFF3hT6DtJlHn9jAel9%2Fuploads%2F8Pa96vM9GZ1nHqmg72a6%2FPasted%20image%2020240522045653.png?alt=media&#x26;token=b327dbe6-3920-4624-9be0-aeaabebf4389" alt=""><figcaption></figcaption></figure>

### Scant3r

{% embed url="<https://github.com/knassar702/scant3r>" %}

### Mantis

{% embed url="<https://github.com/PhonePe/mantis>" %}

### GBounty

{% embed url="<https://bountysecurity.ai/blogs/news/bounty-security-releases-gbounty-our-web-scanning-tools-are-now-open-source?s=03>" %}

{% embed url="<https://github.com/BountySecurity/gbounty>" %}

### Lostools

{% embed url="<https://github.com/coffinxp/lostools?tab=readme-ov-file>" %}

### LOXS (LFI, Open Redirect, XSS, SQLi)

{% embed url="<https://github.com/coffinxp/loxs>" %}

### Nikto

```
apt install nikto
```

<figure><img src="https://4199783661-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFF3hT6DtJlHn9jAel9%2Fuploads%2FlbnIgcknU7VTdR7g1B0M%2FPasted%20image%2020240522050740.png?alt=media&#x26;token=74c7e92e-6beb-437b-81ce-124737d1c095" alt=""><figcaption></figcaption></figure>

### **reconFTW**

{% embed url="<https://github.com/six2dez/reconftw>" %}

## Interesting Books

{% content-ref url="../../interesting-books" %}
[interesting-books](https://0xss0rz.gitbook.io/0xss0rz/interesting-books)
{% endcontent-ref %}

{% hint style="info" %}
**Disclaimer**: As an Amazon Associate, I earn from qualifying purchases. This helps support this GitBook project at no extra cost to you.
{% endhint %}

* [**The Web Application Hacker’s Handbook**](https://www.amazon.fr/dp/1118026470?tag=0xss0rz-21) The go-to manual for web app pentesters. Covers XSS, SQLi, logic flaws, and more
* [**Bug Bounty Bootcamp: The Guide to Finding and Reporting Web Vulnerabilities**](https://www.amazon.fr/dp/1718501544?tag=0xss0rz-21) Learn how to perform reconnaissance on a target, how to identify vulnerabilities, and how to exploit them
* [**Real-World Bug Hunting: A Field Guide to Web Hacking**](https://www.amazon.fr/dp/1593278616?tag=0xss0rz-21) Learn about the most common types of bugs like cross-site scripting, insecure direct object references, and server-side request forgery.

## Support this Gitbook

I hope it helps you as much as it has helped me. If you can support me in any way, I would deeply appreciate it.

[![ko-fi](https://ko-fi.com/img/githubbutton_sm.svg)](https://ko-fi.com/Y8Y41FQ2GA)

[![buymeacoffee](https://cdn.buymeacoffee.com/buttons/v2/default-yellow.png)](https://buymeacoffee.com/0xss0rz)