Quick Start

Once you have installed the tool, you can scan a target in one command. NetVuln Tool offers three ways in: the interactive menu, the Bash CLIs, and the netvuln Python orchestrator (a drop-in that wraps the same pipeline).

Standard scan modes

The fastest way to point nmap at a host, with v1.x-compatible modes.

Interactive menu

./scripts/vulnscan_menu.sh

The menu presents numbered options for quick scan, full scan, vulnerability scan, the recon pipeline, and session upload (option 9).

CLI scans

# Quick scan (top 1000 TCP ports)
./scripts/vulnscan_cli.sh -m quick -t 192.168.1.1

# Vulnerability scan with CSV export
./scripts/vulnscan_cli.sh -m vuln -t 192.168.1.0/24 -o results.csv

Mode	Description	Underlying nmap
quick	Top 1000 TCP ports	nmap -T4 -F
full	All TCP ports	nmap -T4 -p-
vuln	Vulnerability detection	nmap -T4 -sV --script vuln
custom	User-defined options (-x)	nmap <user_options>

See Standard Scans for the full flag reference.

Reconnaissance pipeline

The recon pipeline runs multi-phase discovery, enumeration, vulnerability assessment, and reporting, then emits a self-contained HTML report.

# Full recon with HTML report
./scripts/vulnscan_recon.sh -t 192.168.1.0/24 --full -R report.html

# Multiple targets (comma-separated)
./scripts/vulnscan_recon.sh -t 192.168.1.0/24,10.0.0.0/24,example.com --full -R report.html

# Nmap-style IP range
./scripts/vulnscan_recon.sh -t 192.168.50.1-20 --full -R report.html

# Targets from a file (one per line, # comments allowed)
./scripts/vulnscan_recon.sh -T targets.txt --full -R report.html

# Full recon with a client config
./scripts/vulnscan_recon.sh -t 192.168.1.0/24 --full -R report.html \
    -c ~/netvuln-tool/configs/acme_corp.conf

# Quick recon profile (skip SMB/SNMP)
./scripts/vulnscan_recon.sh -t example.com -P quick_recon -R scan.html

# Select specific phases
./scripts/vulnscan_recon.sh -t 10.0.0.1 -p discovery,enumeration -R enum_report.html

Scan profiles bundle phase selection and timing:

Profile	Phases	Timing	Skipped
quick_recon	discovery, enumeration, report	-T4	SMB, SNMP
full_recon	all phases	-T4	none
stealth	discovery, enumeration, report	-T2	SMB, SNMP
web_focus	discovery, enumeration, report	-T4	SMB, SNMP, SSH

See Recon Pipeline and the Recon Guide for the complete workflow.

Python orchestrator (netvuln)

The netvuln package provides a native CLI that wraps the same pipeline with typed data models, native scoring, and portal upload/push/diff/status. Install it via pip install -e . (done for you by setup.sh and install.sh) to get the netvuln console script, or invoke it as python3 -m netvuln.

# Full recon pipeline (drives run_pipeline.sh internally)
netvuln recon -t 192.168.1.0/24 --full -R report.html

# Recon with exec summary, email delivery, and post-scan diff
netvuln recon -t 10.0.0.0/24 --full --exec-summary --email ciso@client.com --diff

# Quick scan mode
netvuln scan -m quick -t 192.168.1.1

# Upload the latest session to the portal
netvuln upload -c ~/netvuln-tool/configs/acme_corp.conf --latest

# Push with a share link, custom report, and exec summary
netvuln push -c ~/netvuln-tool/configs/acme_corp.conf --latest -R report.html -e exec_summary.html

# Diff two sessions
netvuln diff --baseline ~/netvuln-tool/sessions/<earlier> --current ~/netvuln-tool/sessions/<latest>

# Local session + daemon status
netvuln status

# Remote portal session listing (JWT bearer auth)
netvuln status --remote -c ~/netvuln-tool/configs/acme_corp.conf --jwt "$NV_JWT"

# Daemon control (wraps netvuln_daemon_ctl.sh)
netvuln daemon status
netvuln daemon start

Subcommands: recon, scan, upload, push, diff, status, daemon, version. See the Python Orchestrator architecture page for details.

Session upload

Upload session data to the consultation portal from the command line, using the same config file from the scan.

# Upload the most recent session (default)
./scripts/upload_session.sh -c ~/netvuln-tool/configs/acme_corp.conf

# Upload a specific session by ID
./scripts/upload_session.sh -c ~/netvuln-tool/configs/acme_corp.conf -i 20260224_120000

# Upload a specific session by path
./scripts/upload_session.sh -c ~/netvuln-tool/configs/acme_corp.conf -s ~/netvuln-tool/sessions/20260224_120000

# Preview what would be uploaded without sending
./scripts/upload_session.sh -c ~/netvuln-tool/configs/acme_corp.conf --dry-run

The config file must contain CONSULTATION_API_URL and NV_API_KEY (or the legacy CONSULTATION_API_KEY). Upload is also available as option 9 in the interactive menu.

Auto-submit and push

When CONSULTATION_API_URL and NV_API_KEY (or CONSULTATION_API_KEY) are set in the config, sessions are automatically submitted after the pipeline completes, and a shareable report link is returned on success.

To push a previously completed session manually:

# Push a session directory using a config file
./scripts/push_session.sh -d ~/netvuln-tool/sessions/20260224_120000 \
    -c ~/netvuln-tool/configs/acme_corp.conf

# Push with explicit URL/key
./scripts/push_session.sh -d ~/netvuln-tool/sessions/20260224_120000 \
    -u https://bullium.com/api/upload -k your-api-key

# Push a specific JSON with a report
./scripts/push_session.sh -j /path/to/session_results.json \
    -R /path/to/report.html -c config.conf

On success a shareable link is generated:

https://bullium.com/share/?token=<64-hex-chars>

This link requires no login. The long random token is the credential. See Session Management for the full upload/push/refresh reference.

Authorization

Only scan networks and hosts you are explicitly authorized to assess.

Where to next

• Report Configuration: client metadata, branding, and portal credentials.
• Scheduling: recurring scans via cron or the daemon.
• Post-Scan Tools: diff, alerts, remediation tracking, and compliance mapping.