03-scanning-vulnerability-assessment.md

3. Scanning & Vulnerability Assessment

With the attack surface mapped, scanning identifies open ports, running services, and known vulnerabilities. ShellGPT streamlines Nmap and the common web scanners.

⚠️ Scan only authorized, in-scope targets — see ../DISCLAIMER.md.

Port & service discovery with Nmap

sgpt --shell "Perform a full port scan on 192.168.1.1"
#  -> nmap -p- -sV -sC 192.168.1.1

sgpt --chat nmap --shell "Scan all 65535 ports on 192.168.1.1"
#  -> nmap -p- 192.168.1.1

sgpt --chat nmap --shell "Detect OS and services running on 192.168.1.1"
#  -> nmap -A 192.168.1.1

Using --chat nmap keeps context across follow-up prompts, so you can refine the scan conversationally (add OS detection, narrow to discovered ports, etc.).

Goal	Typical generated flags
All TCP ports	-p-
Service/version detection	-sV
Default NSE scripts	-sC
OS + version + scripts + traceroute	-A
Faster timing	-T4

Vulnerability scanning (Nmap NSE)

sgpt --shell "Scan a target for vulnerabilities using Nmap"
#  -> nmap --script=vuln 192.168.1.1

Host discovery automation

For quick liveness checks across a subnet, ShellGPT can emit a Bash sweep:

sgpt --shell "Write a Bash script to ping all hosts in the 192.168.1.0/24 subnet"
#  -> for i in {1..254}; do ping -c 1 -W 1 192.168.1.$i & done

A tidied version is at scripts/helpers/ping_sweep.sh.

Web application scanning

sgpt --shell "Scan example.com for vulnerabilities with Nikto"
#  -> nikto -h example.com

sgpt --shell "Brute force directories on http://example.com with Gobuster"
#  -> gobuster dir -u http://example.com -w /usr/share/wordlists/dirb/common.txt

sgpt --shell "Fuzz directories on http://example.com with ffuf"
#  -> ffuf -u http://example.com/FUZZ -w /usr/share/wordlists/dirb/common.txt

Using the scanner role

sgpt --role pentest-scanner --shell "find the web server version and headers on example.com"

The pentest-scanner role constrains output to scanning commands only (no exploitation).

Good practice

• Start light (service/version) before heavy NSE scripts.
• Save output (-oA) for reporting — but keep scan artifacts out of the repo (.gitignore already excludes *.nmap, *.xml, scans/).
• Correlate findings to the exploitation phase deliberately; do not auto-exploit.

Next

→ 4. Exploitation & Post-Exploitation