scipag/vulscan

Vulscan is an add-on script for Nmap, a widely used network scanning tool. Where Nmap normally reports which software is running on each open port, vulscan takes those software names and version numbers and looks them up against offline vulnerability databases to flag known security weaknesses. The result is a combined scan: you run one command, get the standard Nmap port information, and see a list of potential vulnerabilities alongside each service. The tool ships with eight pre-packaged databases covering major sources such as CVE (the industry standard list of known vulnerabilities), Exploit-DB, OpenVAS, SecurityFocus, and IBM X-Force. These are stored as local CSV files so no internet connection is needed during the actual scan. You can update them using a bundled shell script, or download the files manually from the project website. It is also possible to point vulscan at a custom database, as long as it follows a simple two-column format of ID and title. Because vulscan depends on Nmap correctly identifying the software version on each port, its accuracy is tied to how well Nmap's version detection performs. If the version is wrong or missing, the vulnerability matches will be off. The tool tries to show only its best matches by default, but you can switch to a mode that shows every possible match, which tends to produce more false positives. There is also an interactive mode where you manually confirm or override version information before the lookup proceeds. Reporting is flexible. The default output prints each matching vulnerability on its own line with an ID and a title. You can switch to several preset formats or define a custom template using placeholder tokens for things like the vulnerability link, matched product, or version string. Vulscan is intended as a quick first pass for spotting software with known public vulnerabilities, not as a definitive verification. It does not attempt to exploit anything or confirm whether a vulnerability is actually reachable on the target system.