Skip to content
This repository was archived by the owner on Mar 23, 2026. It is now read-only.

config: update config and add more scans #115

Open
ikstream wants to merge 2 commits into
base: develop
Choose a base branch
from
Open

config: update config and add more scans #115

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
4df4f9e
config: update config and add more scans
ikstream Nov 4, 2025
b67b157
Merge branch 'develop' into dev
4elta Jan 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 28 additions & 4 deletions config/scanner.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -106,7 +106,7 @@ command = 'curl --silent --include --insecure --show-error --max-time 10 $([[ "{
[[services.scans]]
name = 'nikto'
transport_protocol = 'tcp'
command = 'nikto -ask no -Cgidirs all -host {hostname} -port {port} -nointeractive -Format json -output "{result_file}.json" 2>&1 | tee "{result_file}.log"'
command = '#nikto -ask no -Cgidirs all -host {hostname} -port {port} -nointeractive -Format json -output "{result_file}.json" 2>&1 | tee "{result_file}.log"'

@4elta 4elta Nov 4, 2025

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

i like that you "disabled" Nikto again, after we've enabled it not so long ago 😁
perhaps, it's better to move it to config/scanner/additional.toml (enabled).


[[services.scans]]
name = 'whatweb'
Expand All @@ -121,6 +121,14 @@ application_protocol = 'imap(s|(4-ssl))?'
name = 'nmap'
command = 'nmap -Pn -sV -p {port} --script="banner,imap* and not (brute or broadcast or dos or external or fuzzer)" -oN "{result_file}.log" -oX "{result_file}.xml" {address}'

[[services]]
name = 'ipmi'
application_protocol = 'ipmi|asf-rmcp'
Comment thread
ikstream marked this conversation as resolved.

[[services.scans]]
name = 'nmap'
command = 'nmap -Pn -sU -sV -p {port} --script="banner,ipmi-version,ipmi-brute,ipmi-cipher-zero" -oN "{result_file}.log" -oX "{result_file}.xml" {address}'

[[services]]
name = 'isakmp'
application_protocol = 'isakmp'
Expand All @@ -133,6 +141,14 @@ command = '"{PATH_TO_SCANNERS}/ike.py" {address} --port {port} | tee "{result_fi
name = 'nmap'
command = 'nmap -sU -Pn -sV -p {port} --script="banner,ike-version" -oN "{result_file}.log" -oX "{result_file}.xml" {address}'

[[services]]
name = 'jdwp'
application_protocol = 'jdwp|msgsrvr'
Comment thread
4elta marked this conversation as resolved.

[[services.scans]]
name = 'nmap'
command = 'nmap -Pn -sT -sV --version-all -p {port} --script="banner,jdwp* and not exploit" -oN "{result_file}.log" -oX "{result_file}.xml" {address}'

[[services]]
name = 'kerberos'
application_protocol = 'kerberos|kpasswd'
Expand Down Expand Up @@ -223,12 +239,20 @@ command = 'nmap $([[ "{transport_protocol}" == "udp" ]] && echo "-sU") -Pn -sV -

[[services]]
name = 'rmi'
application_protocol = 'rmiregistry'
application_protocol = 'rmiregistry|java-rmi'
Comment thread
4elta marked this conversation as resolved.

[[services.scans]]
name = 'nmap'
command = 'nmap -Pn -sV -p {port} --script="banner,rmi-vuln-classloader,rmi-dumpregistry" -oN "{result_file}.log" -oX "{result_file}.xml" {address}'

[[services.scans]]
name = 'rmg-enum'
command = 'rmg enum {address} {port} | tee {result_file}.log'
Comment thread
4elta marked this conversation as resolved.

[[services.scans]]
name = 'rmg-guess'
command = 'rmg guess {address} {port} | tee {result_file}.log'

[[services]]
name = 'rpc'
application_protocol = '^erpc|msrpc|rpcbind'
Expand Down Expand Up @@ -283,15 +307,15 @@ application_protocol = 'smtp'

[[services.scans]]
name = 'nmap'
command = 'nmap -Pn -sV -p {port} --script="banner,smtp* and not (brute or broadcast or dos or external or fuzzer)" -oN "{result_file}.log" -oX "{result_file}.xml" {address}'
command = 'nmap -Pn -sV -p {port} --script="banner,smtp* and not (brute or dos or exploit)" -oN "{result_file}.log" -oX "{result_file}.xml" {address}'

@4elta 4elta Nov 4, 2025

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why did you remove the external filter from the SMTP script scan?
for example, smtp-open-relay would send mail to nmap.scanme.org.


[[services]]
name = 'snmp'
application_protocol = 'snmp'

[[services.scans]]
name = 'nmap'
command = 'nmap $([[ "{transport_protocol}" == "udp" ]] && echo "-sU") -Pn -sV -p {port} --script="banner,snmp* and not (brute or broadcast or dos or external or fuzzer)" -oN "{result_file}.log" -oX "{result_file}.xml" {address}'
command = 'nmap $([[ "{transport_protocol}" == "udp" ]] && echo "-sU") -Pn -sV -p {port} --script="banner,snmp* and not (broadcast or dos or external or fuzzer)" --script-args snmp-brute.communitiesdb="/usr/share/seclists/Discovery/SNMP/common-snmp-community-strings-onesixtyone.txt" -oN "{result_file}.log" -oX "{result_file}.xml" {address}'

[[services]]
name = 'ssh'
Expand Down