Appearance
Standard Scans
scripts/vulnscan_cli.sh runs a single-shot nmap scan against a target using one of four predefined modes. These are the v1.x-compatible scan modes, kept fully supported alongside the multi-phase Recon Pipeline. Use them when you want a fast, self-contained port or vulnerability scan without the full discovery, enumeration, and reporting stack.
Usage
vulnscan_cli.sh -m <mode> -t <target> [-o <csv>] [-x <nmap_opts>]| Flag | Description |
|---|---|
-m <mode> | Scan mode: quick, full, vuln, or custom (required) |
-t <target> | Target host, IP, CIDR, or nmap range, for example 192.168.1.1-20 (required) |
-o <file> | CSV export file (optional) |
-x <opts> | Extra nmap options, required for custom mode |
-h | Show help |
Both -m and -t are required. An invalid mode or a missing argument prints usage and exits non-zero.
Scan Modes
| Mode | Description | Underlying nmap |
|---|---|---|
quick | Top 1000 TCP ports | nmap -T4 -F |
full | All 65535 TCP ports | nmap -T4 -p- |
vuln | Vulnerability detection with service versions | nmap -T4 -sV --script vuln |
custom | User-supplied nmap options | nmap <user_options> |
custom mode requires the -x flag. Passing -m custom without -x is an error, since there are no options to run.
Interactive Mode
For a menu-driven experience, run vulnscan_menu.sh instead. Options 1 through 4 map to the four standard scan modes, and higher-numbered options launch the recon pipeline and session upload.
bash
./scripts/vulnscan_menu.shExamples
bash
# Quick scan of a single host
./scripts/vulnscan_cli.sh -m quick -t 192.168.1.1
# Quick scan with CSV export
./scripts/vulnscan_cli.sh -m quick -t 192.168.1.1 -o quick_scan.csv
# Vulnerability scan of a subnet
./scripts/vulnscan_cli.sh -m vuln -t 192.168.1.0/24 -o vuln_results.csv
# Custom nmap options (SYN scan + OS detection + banner script)
./scripts/vulnscan_cli.sh -m custom -t 10.0.0.1 -x "-sS -O --script=banner"Output and Logging
Scans write to a per-user log directory under your home directory (mode 700), and the log files themselves are created mode 600:
| Path | Contents |
|---|---|
$HOME/netvuln-tool/logs/vulnscan.log | Main tool log |
$HOME/netvuln-tool/logs/scan_results.log | Latest scan results (nmap normal output) |
When you pass -o, results are also exported to CSV with the columns IP, ScanMode, Timestamp, OpenPorts, Services.
Dependencies
nmap is required. If it is missing, the tool prompts to install it (in interactive shells) or exits with an error under CI, cron, or piped input. bash and coreutils round out the requirements. See Installation for platform-specific setup.
When to use the recon pipeline instead
Standard scans are ideal for a fast look at a single host or subnet. For client engagements that need DNS and WHOIS discovery, service enumeration, CVE lookups, risk scoring, and a self-contained HTML report, use the Recon Pipeline or the Python orchestrator.