Network Scanning Tools Catalogue

<h2 id="bkmrk-network-scanning-too">Network Scanning Tools Catalogue — SecuScan v0.28.0</h2>

<p id="bkmrk-the-secuscan-worker-">The SecuScan Worker integrates 22 network and infrastructure scanning tools, executed via a Redis job queue. Each tool is implemented in Go in the <code>internal/scanner/</code> package.</p>

<h3 id="bkmrk-phase-overview">Phase Overview</h3> <table id="bkmrk-phasenametools-phase"> <thead><tr><th>Phase</th><th>Name</th><th>Tools</th></tr></thead> <tbody> <tr><td>Phase 1</td><td>DNS Reconnaissance & Discovery</td><td>Subfinder, DNS Audit, DNSBL, Whois, Dnstwist</td></tr> <tr><td>Phase 2</td><td>Network Discovery</td><td>Nmap, WAF Detection, ASN/IP Cartography</td></tr> <tr><td>Phase 3</td><td>SSL/TLS Audit</td><td>TestSSL</td></tr> <tr><td>Phase 4</td><td>Vulnerability Scanning</td><td>Nuclei, NSE Service Audit, Threat Intelligence</td></tr> <tr><td>Phase 5</td><td>Web Application Audit (DAST)</td><td>HTTP Headers, Ffuf, Gowitness, Katana, DAST, Robots/Sitemap</td></tr> <tr><td>Phase 6</td><td>Compliance & Posture</td><td>Email Security, DMARC/MTA-STS</td></tr> <tr><td>Phase 7</td><td>Intelligence</td><td>Subdomain Takeover</td></tr> </tbody> </table>

<h3 id="bkmrk-detailed-catalogue">Detailed Catalogue</h3> <table id="bkmrk-%23toolfiledescription"> <thead><tr><th>#</th><th>Tool</th><th>File</th><th>Description</th></tr></thead> <tbody> <tr><td>1</td><td><strong>Nmap</strong></td><td>nmap.go</td><td>TCP/UDP port scanning, OS and service fingerprinting, version detection. Supports SYN scan, full scan, top ports.</td></tr> <tr><td>2</td><td><strong>Subfinder</strong></td><td>subfinder.go</td><td>Passive subdomain enumeration via CT logs, public APIs, OSINT. Integration with VirusTotal, Shodan, SecurityTrails.</td></tr> <tr><td>3</td><td><strong>Nuclei</strong></td><td>nuclei.go</td><td>Vulnerability scanning with templates: known CVEs, misconfigurations, exposures, default credentials. Severity classification (critical/high/medium/low/info).</td></tr> <tr><td>4</td><td><strong>TestSSL</strong></td><td>testssl.go</td><td>Complete TLS audit: protocols (SSLv2-TLS 1.3), cipher suites, certificates, vulnerabilities (BEAST, POODLE, Heartbleed, ROBOT), HSTS, OCSP. Input validation via ValidateHostPort().</td></tr> <tr><td>5</td><td><strong>DNSBL</strong></td><td>dnsbl.go</td><td>DNS blacklist checking (Spamhaus, Barracuda, etc.). IP reputation detection. Domain sanitization via SanitizeDomainForExec().</td></tr> <tr><td>6</td><td><strong>DNS Audit</strong></td><td>dns.go</td><td>Complete DNS analysis: records (A, AAAA, MX, NS, TXT, SOA, CAA), zone transfer (AXFR), DNSSEC, open recursion. Domain validation before execution.</td></tr> <tr><td>7</td><td><strong>Email Security</strong></td><td>email_security.go</td><td>SPF, DKIM and DMARC audit. Email security DNS record verification, DMARC policy analysis, DKIM selector validation.</td></tr> <tr><td>8</td><td><strong>Whois</strong></td><td>whois.go</td><td>Domain registration information: registrant, expiration dates, nameservers, RDAP history.</td></tr> <tr><td>9</td><td><strong>HTTP Headers</strong></td><td>http_headers.go</td><td>HTTP security header analysis: CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy. Security score.</td></tr> <tr><td>10</td><td><strong>WAF Detection</strong></td><td>waf.go</td><td>WAF, CDN and reverse proxy detection. Identification of Cloudflare, AWS WAF, Akamai, Imperva, etc.</td></tr> <tr><td>11</td><td><strong>Robots/Sitemap</strong></td><td>robots_sitemap.go</td><td>robots.txt and sitemap.xml analysis. Hidden/forbidden path extraction, sensitive file exposure detection.</td></tr> <tr><td>12</td><td><strong>Ffuf</strong></td><td>ffuf.go</td><td>Directory and file brute-forcing: /admin, /backup, /.git, /.env, /wp-admin. Custom wordlists.</td></tr> <tr><td>13</td><td><strong>Gowitness</strong></td><td>gowitness.go</td><td>Automated web service screenshot capture for quick visual review. HTML gallery generation.</td></tr> <tr><td>14</td><td><strong>Katana</strong></td><td>katana.go</td><td>Advanced web crawling: link discovery, forms, API endpoints, JavaScript files. Redirect following.</td></tr> <tr><td>15</td><td><strong>Dnstwist</strong></td><td>dnstwist.go</td><td>Typosquatting and similar domain detection. Permutation generation (homoglyphs, transpositions, insertions) and DNS verification.</td></tr> <tr><td>16</td><td><strong>Threat Intelligence</strong></td><td>threat_intel.go</td><td>Enrichment via VirusTotal and AbuseIPDB. IP reputation, malware detection, abuse history.</td></tr> <tr><td>17</td><td><strong>DAST</strong></td><td>dast.go</td><td>Dynamic Application Security Testing: automated OWASP Top 10 tests, XSS, SQLi, CSRF, open redirect detection.</td></tr> <tr><td>18</td><td><strong>ASN/IP Cartography</strong></td><td>asn.go</td><td>Autonomous System mapping, associated IP ranges, hosting provider identification.</td></tr> <tr><td>19</td><td><strong>DMARC/MTA-STS</strong></td><td>dmarc_mta_sts.go</td><td>Advanced DMARC and MTA-STS policy verification. Reporting URI detection, enforce/quarantine/none modes.</td></tr> <tr><td>20</td><td><strong>Subdomain Takeover</strong></td><td>takeover.go</td><td>Detection of subdomains pointing to abandoned cloud services (dangling CNAME). Checks AWS S3, Azure, GitHub Pages, Heroku, etc. Sanitization via SanitizeDomainForExec().</td></tr> <tr><td>21</td><td><strong>NSE Service Audit</strong></td><td>nse_service.go</td><td>Per-service/protocol security testing via Nmap NSE scripts: SSH algorithms, anonymous FTP, SMTP open relay, SMB signing, RDP NLA, SNMP community strings.</td></tr> <tr><td>22</td><td><strong>Certificate Transparency</strong></td><td>ct_monitor.go</td><td>Certificate monitoring via crt.sh API. Detection of unauthorized or unexpected certificates.</td></tr> </tbody> </table>

<h3 id="bkmrk-available-scan-types">Available Scan Types</h3> <table id="bkmrk-typedescriptiontools"> <thead><tr><th>Type</th><th>Description</th><th>Tools Used</th></tr></thead> <tbody> <tr><td><code>full</code></td><td>Complete scan (all phases)</td><td>All 22 tools</td></tr> <tr><td><code>quick</code></td><td>Quick scan (main ports + known vulns)</td><td>Nmap, Nuclei, HTTP Headers</td></tr> <tr><td><code>port_scan</code></td><td>Port scan only</td><td>Nmap</td></tr> <tr><td><code>vuln_scan</code></td><td>Vulnerability scan only</td><td>Nuclei, NSE</td></tr> <tr><td><code>dns_audit</code></td><td>Complete DNS audit</td><td>DNS Audit, Subfinder, DNSBL, Whois</td></tr> <tr><td><code>ssl_audit</code></td><td>SSL/TLS audit only</td><td>TestSSL</td></tr> <tr><td><code>web_audit</code></td><td>Web application audit</td><td>HTTP Headers, DAST, Katana, Ffuf</td></tr> <tr><td><code>email_audit</code></td><td>Email security audit</td><td>Email Security, DMARC/MTA-STS</td></tr> </tbody> </table>

<h3 id="bkmrk-tool-security-%28v0.27">Tool Security (v0.27.x)</h3> <p id="bkmrk-scanning-tools-inclu">Scanning tools include command injection protections:</p> <ul id="bkmrk-pkg%2Fvalidator%2Fvalida"> <li><code>pkg/validator/validator.go</code>: 6 sanitization functions (SanitizeDomainForExec, ValidateHostPort, ValidateURL, etc.)</li> <li>Input validation before every <code>exec.Command</code> call</li> <li><code>--</code> separator in git arguments to prevent option injection</li> <li>Strict regular expressions for domains, IPs and ports</li> </ul>