Pipeline Phases

The reconnaissance pipeline runs through four sequential phases. Each phase is a set of independent modules that write structured results into the shared session JSON, which the next phase reads. Two orchestrators drive the same phase model:

• scripts/run_pipeline.sh (Bash), sourced by vulnscan_recon.sh and the menu.
• The netvuln Python package (netvuln/pipeline.py), a typed drop-in that shells out to the same Bash modules. See Python Orchestrator.

Phase Summary

Phase	Modules	Description
Discovery	discover_hosts, discover_dns, discover_whois	Host detection (nmap -sn + OS fingerprint), DNS records (A, AAAA, MX, NS, TXT, SOA, CNAME, PTR, SRV, CAA), SPF/DKIM/DMARC, zone-transfer attempts, subdomain enumeration, WHOIS/ASN.
Enumeration	enum_ports, enum_web, enum_smb, enum_ssh, enum_snmp	Port and service-version detection, HTTP security headers, SSL/TLS analysis, SMB shares and signing, SSH algorithms, SNMP communities.
Vulnerability	vuln_assess, cve_lookup, classify_severity	Nmap vuln scripts, CVE extraction, CVSS lookup + description fetching via cve.org and the NVD API, severity classification.
Reporting	aggregate_results, risk_score, remediation_playbook, remediation_tracker, scan_diff, generate_report, executive_summary, alert_notifier, compliance_mapper, network_topology	Dedup and summary stats, dual-model risk scoring, remediation tracking, cross-session diff, self-contained HTML report, executive summary, multi-channel alerts, compliance mapping, topology visualization.

Phase tokens

The -p / --phases flag and scan profiles use phase tokens: discovery, enumeration, email_security, vuln, report. email_security is a dedicated deep email-authentication step (DKIM, MTA-STS, DANE, BIMI, open-relay) that the full_recon profile runs between enumeration and vulnerability assessment; --full expands to discovery,enumeration,email_security,vuln,report.

Phase Details

Phase 1: Discovery

Identifies live hosts and gathers passive intelligence about the target environment.

• discover_hosts.sh: host discovery with nmap -sn plus OS fingerprinting.
• discover_dns.sh: DNS enumeration across 10 record types, plus DMARC/SPF analysis, zone-transfer attempts, and subdomain enumeration.
• email_security.sh: email-security assessment: DKIM, MTA-STS, DANE, BIMI, and open-relay detection (runs as the email_security phase token).
• discover_whois.sh: WHOIS and OSINT lookups for registrar, ASN, and domain expiration.

Phase 2: Enumeration

Detailed service-level inspection of discovered hosts.

• enum_ports.sh: TCP port and service-version detection.
• enum_web.sh: HTTP security-header analysis, SSL/TLS certificate inspection, technology fingerprinting.
• enum_smb.sh: SMB null-session testing, share enumeration, SMB-signing verification.
• enum_ssh.sh: SSH algorithm enumeration and weak-cipher detection.
• enum_snmp.sh: SNMP community-string testing and system-information extraction.

Phase 3: Vulnerability Assessment

Identifies specific issues and maps them to known CVEs.

• vuln_assess.sh: runs nmap vulnerability scripts against discovered services and extracts CVE references.
• cve_lookup.sh: fetches CVSS scores and real descriptions from cve.org and the NVD API (disable with --no-cve-lookup).
• classify_severity.sh: classifies findings into Critical, High, Medium, Low, or Informational using CVSS scores and title/port/service pattern matching.

Phase 4: Reporting

Aggregates results and produces deliverables.

• aggregate_results.sh: deduplicates findings by (host, port, title), re-numbers IDs, sorts by severity, computes summary statistics.
• risk_score.sh: severity-weighted 0-100 risk score with letter grades (A-F) and a dual model (base + operational). See Scoring Methodology.
• remediation_playbook.sh: card-based remediation playbook with difficulty ratings.
• remediation_tracker.sh: tracks status across sessions (new, persistent, resolved, deferred).
• scan_diff.sh: cross-session diff (terminal, JSON, quiet modes); exit code 2 signals new critical/high findings for CI. Opt-in via --diff.
• generate_report.sh / report_template.sh: self-contained HTML report with inline CSS/JS. See Report Template.
• executive_summary.sh: one-page executive summary (opt-in via --exec-summary).
• alert_notifier.sh: multi-channel alerts (email, Slack, webhook) with threshold evaluation.
• compliance_mapper.sh: maps findings to CIS Controls v8, NIST CSF, PCI-DSS v4.0, SOC 2, and ORC 9.64. See Compliance Mapping.
• network_topology.sh: SVG topology visualization with subnet grouping and per-host risk grades.

Plugin Hooks Between Phases

The pipeline fires non-fatal hooks at phase boundaries (post-discovery, post-enumeration, post-assessment, pre-report, post-report, post-upload, post-pipeline). Enterprise features (compliance, topology, executive summary, portal upload) are wired in through this mechanism, with safe no-op stubs when a plugin is absent or unlicensed. See Plugin System.

Interruption Handling

run_pipeline.sh installs a SIGINT/SIGTERM handler that preserves partial results: it stamps the session end_time, records metadata.interrupted (with the interrupted phase and module), runs normal cleanup, and exits 130. Partial session data is retained on disk rather than discarded.

Scan Profiles

Profiles bundle a phase set, nmap timing, port scope, and skipped modules. They are defined in templates/scan_profile.conf and selected with -P:

./scripts/vulnscan_recon.sh -t 192.168.1.0/24 -P quick_recon -R report.html

Profile	Phases	Timing	Ports	Skipped
quick_recon	discovery, enumeration, report	-T4	-F (top 100)	SMB, SNMP
full_recon	discovery, enumeration, email_security, vuln, report	-T4	-p- (all)	none
stealth	discovery, enumeration, report	-T2	-F	SMB, SNMP
web_focus	discovery, enumeration, report	-T4	80,443,8080,8443,8000,8888	SMB, SNMP, SSH
email_security	discovery, email_security, report	-T4	25,465,587,993,995,143,110	none

See the Recon Pipeline CLI reference for the full flag set.

Standard Scan Modes

In addition to the recon pipeline, vulnscan_cli.sh supports standalone scan modes:

Mode	Description	Nmap Command
quick	Top 1000 TCP ports	nmap -T4 -F
full	All TCP ports	nmap -T4 -p-
vuln	Vulnerability detection	nmap -T4 -sV --script vuln
custom	User-defined options	nmap <user_options>

Session Output

Every run writes a timestamped session directory containing session_results.json, raw per-module output, the pipeline log, and the generated report. The schema and directory layout are documented in Session Data.