Reconnaissance Pipeline

scripts/vulnscan_recon.sh is the CLI front end for the multi-phase reconnaissance pipeline. It runs discovery, enumeration, vulnerability assessment, and reporting against one or many targets, then emits a self-contained HTML report and a structured session directory. It is the workhorse for client engagements and the Bash counterpart to the Python orchestrator.

For a phase-by-phase walk-through of what each stage does, see Pipeline Phases and the Recon Guide.

Usage

vulnscan_recon.sh -t <target> [options]

Required (one of):
  -t <targets>        Target IPs, CIDRs, ranges, or domains (comma-separated)
  -T <file>           Target file (one per line, # comments allowed)

Phase Selection (pick one):
  --full              Run all phases (discovery, enumeration, vuln, report)
  -p <phases>         Comma-separated: discovery,enumeration,email_security,vuln,report
  -P <profile>        Scan profile (see table below)

Report Options:
  -R <file>           HTML report output file
  -c <file>           Report config file (client name, scope, credentials)

Scan Tuning:
  --timing <T0-T5>    Nmap timing template (default: -T4)
  --ports <spec>      Nmap port specification (default: -F)
  --no-cve-lookup     Disable online CVE CVSS lookups (pattern matching only)

Executive Summary:
  --exec-summary      Generate a one-page executive summary (PDF-ready)
  --email <addr>      Email the executive summary (comma-separated for multiple)

Remediation Tracking:
  --compare <dir>     Compare remediation against a specific prior session directory

Diff Report:
  --diff              Show a findings diff after the scan completes (vs prior session)

Other:
  -h, --help          Show help

Targets

Supply targets one of two ways. -t takes a comma-separated list of IPs, CIDR blocks, nmap-style ranges, or domain names. -T reads a target file, one entry per line, with # comments allowed. The two are mutually exclusive.

# Single subnet
vulnscan_recon.sh -t 192.168.1.0/24 --full -R report.html

# Mixed targets in one run
vulnscan_recon.sh -t 192.168.1.0/24,10.0.0.0/24,example.com --full -R report.html

# Nmap-style range
vulnscan_recon.sh -t 192.168.50.1-20 --full -R report.html

# Targets from a file
vulnscan_recon.sh -T targets.txt --full -R report.html

Phase Selection

Choose exactly one of three ways to decide which phases run:

• --full runs every phase: discovery, enumeration, vulnerability assessment, and reporting.
• -p <phases> takes an explicit comma-separated list. Valid phases are discovery, enumeration, email_security, vuln, and report.
• -P <profile> loads a predefined profile that sets phases, timing, port spec, and skipped modules in one shot.

# Explicit phase list, no vuln stage
vulnscan_recon.sh -t 10.0.0.1 -p discovery,enumeration,report -R enum_report.html

Scan Profiles

Profiles are defined in templates/scan_profile.conf and selected with -P. Each bundles a phase list, an nmap timing template, a port specification, and a set of enumeration modules to skip.

Profile	Phases	Timing	Ports	Skipped modules
quick_recon	discovery, enumeration, report	-T4	-F	enum_smb, enum_snmp
full_recon	discovery, enumeration, email_security, vuln, report	-T4	-p-	none
stealth	discovery, enumeration, report	-T2	-F	enum_smb, enum_snmp
web_focus	discovery, enumeration, report	-T4	-p 80,443,8080,8443,8000,8888	enum_smb, enum_snmp, enum_ssh
email_security	discovery, email_security, report	-T4	-p 25,465,587,993,995,143,110	none

# Quick recon profile (skips SMB and SNMP)
vulnscan_recon.sh -t example.com -P quick_recon -R scan.html

# Low-and-slow stealth profile
vulnscan_recon.sh -T targets.txt -P stealth

# Full assessment with every module
vulnscan_recon.sh -t 192.168.1.0/24 -P full_recon -R report.html

Scan Tuning

--timing overrides the nmap timing template (-T0 through -T5, default -T4), and --ports overrides the port specification (default -F, nmap's fast top-100 list). Both take precedence over a profile's built-in values when combined. --no-cve-lookup disables the online CVE and CVSS enrichment step, falling back to local pattern matching, which is useful on air-gapped hosts or when you want a faster run.

# Custom phases at a slower timing template
vulnscan_recon.sh -t 10.0.0.1 -p discovery,enumeration --timing -T2

# Offline run with no online CVE lookups
vulnscan_recon.sh -t 192.168.1.0/24 --full --no-cve-lookup -R report.html

Client Configuration

The -c flag points at a report config file that carries the client name, engagement scope, white-label branding, and portal credentials. When that config defines CONSULTATION_API_URL and NV_API_KEY (or the legacy CONSULTATION_API_KEY), the session is automatically submitted to the portal after the pipeline completes, and a shareable report link is returned. See Report Configuration and Session Management for details.

vulnscan_recon.sh -t 192.168.1.0/24 --full -R report.html \
    -c ~/netvuln-tool/configs/acme_corp.conf

Executive Summary and Diff

--exec-summary produces a one-page, PDF-ready executive summary in addition to the full report. --email <addr> emails that summary to one or more comma-separated recipients and implies --exec-summary. See Executive Summary for the template engine.

--diff runs a cross-session findings diff after the scan and prints new, resolved, and changed findings against the most recent prior session. --compare <dir> points the remediation-tracking comparison at a specific prior session directory instead of the latest. The standalone diff tool is documented in Post-Scan Tools.

# Full recon with an executive summary emailed to the CISO
vulnscan_recon.sh -t 10.0.0.0/24 --full --exec-summary --email ciso@example.com

# Full scan followed by a diff against the prior session
vulnscan_recon.sh -t 192.168.1.0/24 --full --diff -R report.html

Session Output

Each run writes a timestamped session directory under $HOME/netvuln-tool/sessions/<timestamp>/, containing the structured session_results.json, a per-session pipeline.log, raw per-module output files, and the generated HTML report. See Session Data for the full layout and JSON schema.