Reconnaissance Guide

The NetVuln Tool reconnaissance pipeline (v4.2.4) is a multi-phase network assessment framework for authorized penetration testing and security assessment engagements. It automates host discovery, DNS and email-security analysis, service enumeration, vulnerability assessment, risk scoring, and self-contained HTML report generation with interactive features.

Two front ends drive the same pipeline:

scripts/vulnscan_recon.sh (Bash) is the original CLI documented throughout this guide.
python3 -m netvuln recon (Python orchestrator) is a drop-in equivalent with matching flags. See Python Orchestrator for the full command surface.

For a condensed command reference, see Recon Pipeline. For the module internals, see Pipeline Phases.

Quick Start

Full Reconnaissance (Recommended)

bash

# Full recon with HTML report
./scripts/vulnscan_recon.sh -t 192.168.1.0/24 --full -R report.html

# Multiple targets (comma-separated)
./scripts/vulnscan_recon.sh -t 192.168.1.0/24,10.0.0.0/24,example.com --full -R report.html

# Nmap-style IP range
./scripts/vulnscan_recon.sh -t 192.168.50.1-20 --full -R report.html

# Targets from a file
./scripts/vulnscan_recon.sh -T targets.txt --full -R report.html

# Full recon with a per-engagement client config
./scripts/vulnscan_recon.sh -t 192.168.1.0/24 --full -R report.html \
    -c ~/netvuln-tool/configs/acme_corp.conf

The Python orchestrator accepts the same arguments:

bash

python3 -m netvuln recon -t 192.168.1.0/24 --full -R report.html \
    -c ~/netvuln-tool/configs/acme_corp.conf

Using Scan Profiles

bash

# Quick recon (discovery + enumeration, skip SMB/SNMP)
./scripts/vulnscan_recon.sh -t example.com -P quick_recon -R scan.html

# Stealth mode (low timing, minimal footprint)
./scripts/vulnscan_recon.sh -t 10.0.0.1 -P stealth -R stealth_report.html

# Web-focused (HTTP/HTTPS ports only)
./scripts/vulnscan_recon.sh -t web.example.com -P web_focus -R web_report.html

# Email-security focused (SPF/DKIM/DMARC/MTA-STS and SMTP checks)
./scripts/vulnscan_recon.sh -t example.com -P email_security -R email_report.html

bash

./scripts/vulnscan_menu.sh
# Select the Full Reconnaissance option

Target File Format

When using -T <file>, provide one target per line. Blank lines and # comments are skipped:

# targets.txt: example target file for a multi-network engagement
192.168.1.0/24
10.0.0.0/24

# Client domains
example.com
staging.example.com

Pipeline Phases

Phase 1: Discovery

Identifies live hosts and gathers DNS and OSINT information.

Module	Tool	Description
`discover_hosts`	nmap	Ping sweep (`nmap -sn`), OS fingerprinting
`discover_dns`	dig/host/nslookup	DNS records, DMARC/SPF checks, zone transfers, subdomain enum
`discover_whois`	whois	Domain registrar info, expiry checks, ASN lookup

DNS Record Types Queried: A, AAAA, MX, NS, TXT, SOA, CNAME, PTR, SRV, CAA

Subdomain Wordlist: 50+ common prefixes (www, mail, api, admin, vpn, dev, staging, and more)

Phase 2: Enumeration

Detailed service and protocol analysis on discovered hosts.

Module	Tool	Description
`enum_ports`	nmap	Port/service version detection (`nmap -sV`)
`enum_web`	curl, openssl	HTTP headers, SSL/TLS analysis, tech fingerprinting, path probing
`enum_smb`	smbclient, nmap	Null sessions, share listing, SMBv1 detection, signing analysis
`enum_ssh`	nmap, nc	Key exchange/cipher/MAC enumeration, weak algorithm detection
`enum_snmp`	snmpwalk/snmpget, nmap	Default community strings, system info extraction, version detection

HTTP Security Headers Checked: HSTS, CSP, X-Frame-Options, X-Content-Type-Options, X-XSS-Protection, Referrer-Policy, Permissions-Policy

Common Paths Probed: robots.txt, .git/HEAD, .env, wp-login.php, server-status, phpinfo.php, and others

Phase 3: Email Security

A dedicated phase (email_security module) that runs against domain targets only. IP-only scans skip it automatically.

Check	Description
DKIM	Enumerates common provider selectors and validates published keys
SPF	Records the policy and analyzes lookup depth
DMARC	Extended validation of policy, reporting addresses, and alignment
MTA-STS / TLS-RPT	Detects transport security policy publication
DANE / TLSA	Checks for DNS-authenticated TLS records
SMTP / STARTTLS	Banner grab, STARTTLS support, open-relay testing
BIMI	Brand Indicators for Message Identification detection

Required tool: dig. Optional: openssl (DKIM key and STARTTLS validation), curl (MTA-STS), nmap (SMTP banner and open-relay checks).

Phase 4: Vulnerability Assessment

Automated vulnerability scanning and cross-referencing.

Module	Tool	Description
`vuln_assess`	nmap	Nmap vuln scripts (`--script vuln`), CVE extraction, description fetching, cross-referencing
`cve_lookup`	curl	CVSS score lookup (cvedetails.com/NVD) and CVE description fetching (cve.org API)
`classify_severity`	bash	Rule-based severity classification engine (fallback when CVE lookup is unavailable)

Severity Levels:

Critical: RCE, default credentials, SQL injection, known critical CVEs (EternalBlue, Heartbleed, Log4Shell)
High: Weak SSL/TLS, SMB null sessions, telnet/FTP, path traversal
Medium: Missing security headers, outdated software, weak SSH algorithms, self-signed certs, zone transfers
Low: Information disclosure, cookie flags, directory listing
Info: Open ports, DNS records, general observations

Phase 5: Reporting

Aggregation, scoring, remediation tracking, and HTML report generation.

Module	Description
`aggregate_results`	Deduplicates findings, sorts by severity, generates summary statistics
`risk_score`	Computes the dual-model risk score and A-F letter grade
`remediation_playbook` / `remediation_tracker`	Builds the remediation plan and carries status forward across scans
`compliance_mapper` / `network_topology`	Enterprise plugins mapped in as pre-report hooks (no-ops without a business-tier license)
`generate_report`	Self-contained interactive HTML report
`executive_summary` / `alert_notifier`	Post-report hooks (opt-in)

The scoring model is documented in Scoring Methodology. Compliance framework mapping is covered in Compliance Mapping.

CLI Reference

vulnscan_recon.sh -t <target> [options]

Required (one of):
  -t <targets>        Target IPs, CIDRs, ranges, or domains (comma-separated)
  -T <file>           Target file (one per line, # comments allowed)

Phase Selection (pick one):
  --full              Run all phases (discovery, enumeration, email_security, vuln, report)
  -p <phases>         Comma-separated: discovery,enumeration,email_security,vuln,report
  -P <profile>        Scan profile: quick_recon, full_recon, stealth, web_focus, email_security

Report Options:
  -R <file>           HTML report output file
  -c <file>           Report config file (client name, scope, etc.)

Scan Tuning:
  --timing <T0-T5>    Nmap timing template (default: -T4)
  --ports <spec>      Nmap port specification (default: -F)
  --no-cve-lookup     Disable online CVE CVSS lookups (use pattern matching only)

Executive Summary:
  --exec-summary      Generate a one-page executive summary (PDF-ready)
  --email <addr>      Email the executive summary (comma-separated for multiple)

Remediation Tracking:
  --compare <dir>     Compare remediation against a specific prior session directory

Diff Report:
  --diff              Show a findings diff after the scan completes (vs prior session)

Other:
  -h, --help          Show help

TIP

--email implies --exec-summary. The email backend is configured through the engagement config file (EMAIL_FROM, EMAIL_SUBJECT, and the local mail/sendmail toolchain). See Executive Summary.

CVE Lookup

When vulnerability scanning discovers CVEs, NetVuln Tool performs two lookups:

Severity: Queries cvedetails.com for a CVSS score and maps it to a severity (critical/high/medium/low/info). Falls back to the NVD REST API if unreachable, then to pattern-based classification if both fail.
Description: Queries the cve.org API (cveawg.mitre.org) for the official CVE description text. This replaces the generic "Vulnerability detected by nmap scripts" placeholder with the real vulnerability description in the report.

Both lookups are enabled by default with a 2-second rate limit and session-level file caching to avoid redundant requests. CVE links in reports point to https://www.cve.org/CVERecord?id=CVE-XXXX-XXXXX. Disable with --no-cve-lookup for air-gapped or offline environments.

Scan Profiles

Profiles are defined in templates/scan_profile.conf:

Profile	Phases	Timing	Ports	Skipped Modules
`quick_recon`	discovery, enumeration, report	-T4	-F (top 100)	enum_smb, enum_snmp
`full_recon`	discovery, enumeration, email_security, vuln, report	-T4	-p- (all)	none
`stealth`	discovery, enumeration, report	-T2	-F	enum_smb, enum_snmp
`web_focus`	discovery, enumeration, report	-T4	80,443,8080,8443,8000,8888	enum_smb, enum_snmp, enum_ssh
`email_security`	discovery, email_security, report	-T4	25,465,587,993,995,143,110	none

Report Configuration

Per-engagement config files hold client metadata and are never committed to the repository. Full variable reference lives in Report Configuration.

Setup Workflow

bash

# 1. Create a configs directory (first time only)
mkdir -p ~/netvuln-tool/configs

# 2. Copy the template for your engagement
cp templates/report_config.conf.example ~/netvuln-tool/configs/acme_corp.conf

# 3. Uncomment and fill in the values
vim ~/netvuln-tool/configs/acme_corp.conf

Example Config

bash

# ~/netvuln-tool/configs/acme_corp.conf
CLIENT_NAME="Acme Corporation"
CLIENT_CONTACT="security@acme.com"
ASSESSMENT_START="2026-02-20"
ASSESSMENT_END="2026-02-24"
ASSESSMENT_SCOPE="192.168.1.0/24, web.acme.com"
ASSESSOR_NAME="Jane Analyst"
REPORT_CLASSIFICATION="CONFIDENTIAL"
COMPANY_NAME="Bullium Consulting LLC"

# Consultation upload (optional; enables the Submit Collection button and auto-submit)
CONSULTATION_API_URL="https://bullium.com/api/upload"
NV_API_KEY="nvt_pro_<hex>"

WARNING

.gitignore excludes *.conf files to prevent accidental commits of populated configs containing client data or license keys. Never place a live key in a file that is tracked by git. See Secrets Management.

NV_API_KEY is the canonical license key: it authenticates portal uploads and unlocks tier-gated features locally. CONSULTATION_API_KEY is the legacy alias, still supported for backward compatibility. See License Provisioning.

Session Data

All scan data is stored in $HOME/netvuln-tool/sessions/<timestamp>/:

sessions/20260224_120000/
├── session_results.json    # Master JSON with all findings
├── pipeline.log            # Per-session execution log
├── dns_enumeration.txt     # Raw DNS output
├── email_security.txt      # Raw email-security output
├── smb_enumeration.txt     # Raw SMB output
├── snmp_enumeration.txt     # Raw SNMP output
└── report_20260224_121500.html  # Generated HTML report

The full session JSON schema is documented in Session Data. A condensed example:

json

{
  "metadata": {
    "session_id": "20260224_120000",
    "target": "192.168.1.0/24,10.0.0.0/24,example.com",
    "targets": ["192.168.1.0/24", "10.0.0.0/24", "example.com"],
    "scope": "192.168.1.0/24,10.0.0.0/24,example.com",
    "start_time": "2026-02-24T12:00:00-0500",
    "end_time": "2026-02-24T12:15:00-0500",
    "phases_executed": ["discovery", "enumeration", "email_security", "vuln", "report"]
  },
  "hosts": [
    {
      "ip": "192.168.1.1",
      "hostname": "gateway.local",
      "os_guess": "Linux 4.x",
      "status": "up",
      "mac_address": "AA:BB:CC:DD:EE:FF",
      "hop_distance": 1,
      "ports": [
        { "port": 22, "protocol": "tcp", "state": "open", "service": "ssh", "version": "OpenSSH 8.9" }
      ]
    }
  ],
  "findings": [
    {
      "id": "F001",
      "severity": "high",
      "category": "ssl",
      "host": "192.168.1.1",
      "port": 443,
      "title": "Weak SSL/TLS Configuration",
      "description": "Server supports TLS 1.0",
      "evidence": "TLS 1.0 enabled",
      "recommendation": "Disable TLS 1.0 and 1.1",
      "phase": "enumeration",
      "module": "enum_web"
    }
  ],
  "summary": {
    "total_hosts": 3,
    "total_findings": 6,
    "by_severity": { "critical": 1, "high": 1, "medium": 2, "low": 1, "info": 1 }
  }
}

Report Features

Button	Function	Output
Print / PDF	Opens the browser print dialog	PDF via print-to-PDF
Export CSV	Downloads findings as CSV	`netvuln_findings_<date>.csv`
Export JSON	Downloads raw session data	`session_results.json`

The export toolbar is hidden automatically when printing. CSV export includes columns: ID, Severity, Host, Port, Finding, Description.

Interactive Features

Findings Search: Filter findings by IP, domain, CVE ID, or any keyword alongside the severity filter buttons.
Host Links: Host IPs and domains in the findings table link to the corresponding host detail section with auto-expand.
Expand/Collapse All: Bulk toggle buttons for host detail sections.
Module Timing Summary: Per-module and per-phase runtime grid with total pipeline duration.
MAC Address and Hop Distance: Network-layer details in host detail cards when available.
Domain/DNS Details: Dedicated section showing all DNS records collected per domain (A, AAAA, MX, NS, TXT, SOA, CNAME, PTR, SRV, CAA, DMARC, SPF, DKIM).
CVE Descriptions: Real descriptions from the cve.org API with direct links to CVE records.
Pipeline Log in PDF: When the log section is expanded before printing, it is included in the PDF output.

The report internals are documented in Report Template.

Session Logging

Each scan produces a per-session execution log at pipeline.log inside the session directory, capturing timestamped entries for every pipeline action: phase transitions, module execution, tool output, and errors.

Main log: $HOME/netvuln-tool/logs/vulnscan.log
Per-session log: $HOME/netvuln-tool/sessions/<timestamp>/pipeline.log
Scan results: $HOME/netvuln-tool/logs/scan_results.log

Session logs are embedded in generated HTML reports as a searchable, collapsible section with keyword filtering. All log files use secure permissions (600/700).

Dependencies

Required

bash 4.0+
nmap (core scanning engine)
jq (JSON processing, required for reports)

Optional (gracefully skipped if missing)

dig / host / nslookup (DNS and email-security enumeration)
whois (WHOIS/OSINT lookups)
openssl (SSL/TLS analysis, DKIM key validation, STARTTLS)
curl (HTTP header checks, path probing, CVE lookups, MTA-STS)
smbclient (SMB share enumeration)
snmpwalk / snmpget (SNMP enumeration)
nc / ncat (SSH banner grabbing)
wkhtmltopdf (executive summary PDF export)

Run the dependency checker to see what is available:

bash

./scripts/dependency_check.sh

Regenerating a Report from a Previous Session

To regenerate or create a report from an existing scan session:

bash

./scripts/generate_report.sh session_results.json report.html \
    ~/netvuln-tool/configs/client.conf

Uploading Session Data

Sessions can be pushed to the Bullium Consulting portal from the command line, or auto-submitted at the end of the pipeline. When CONSULTATION_API_URL and a license key are configured, the session is submitted automatically after pipeline completion and a shareable report link is returned.

bash

# Manual upload of the latest session (reuses the same config)
./scripts/upload_session.sh -c ~/netvuln-tool/configs/acme_corp.conf

# Preview without sending
./scripts/upload_session.sh -c ~/netvuln-tool/configs/acme_corp.conf --dry-run

# Push a specific session directory with a shareable link
./scripts/push_session.sh -d ~/netvuln-tool/sessions/20260224_120000 \
    -c ~/netvuln-tool/configs/acme_corp.conf

Full upload options, session selection, and portal round-trip details are in Session Management. The wire format is documented in API Contract.

Standard Scan Modes

The original single-mode scans remain available and unchanged:

bash

./scripts/vulnscan_cli.sh -m quick -t 192.168.1.1
./scripts/vulnscan_cli.sh -m full -t 192.168.1.0/24
./scripts/vulnscan_cli.sh -m vuln -t 10.0.0.1 -o results.csv

See Standard Scans for the full mode matrix.

WiFi Discovery: opt-in, Linux-only 802.11 access-point discovery (not part of this pipeline).
Alert Notifications: multi-channel alerting on scan results.
Executive Summary: one-page summaries for decision-makers.

Reconnaissance Guide ​

Quick Start ​

Full Reconnaissance (Recommended) ​

Using Scan Profiles ​

Interactive Menu ​

Target File Format ​

Pipeline Phases ​

Phase 1: Discovery ​

Phase 2: Enumeration ​

Phase 3: Email Security ​

Phase 4: Vulnerability Assessment ​

Phase 5: Reporting ​

CLI Reference ​

CVE Lookup ​

Scan Profiles ​

Report Configuration ​

Setup Workflow ​

Example Config ​

Session Data ​

Report Features ​

Export Toolbar ​

Interactive Features ​

Session Logging ​

Dependencies ​

Regenerating a Report from a Previous Session ​

Uploading Session Data ​

Standard Scan Modes ​

Related Guides ​

Reconnaissance Guide

Quick Start

Full Reconnaissance (Recommended)

Using Scan Profiles

Interactive Menu

Target File Format

Pipeline Phases

Phase 1: Discovery

Phase 2: Enumeration

Phase 3: Email Security

Phase 4: Vulnerability Assessment

Phase 5: Reporting

CLI Reference

CVE Lookup

Scan Profiles

Report Configuration

Setup Workflow

Example Config

Session Data

Report Features

Export Toolbar

Interactive Features

Session Logging

Dependencies

Regenerating a Report from a Previous Session

Uploading Session Data

Standard Scan Modes

Related Guides