Vapt Network

Network & Port Scanning

When Invoked

The user runs /vapt network <url> or this skill is triggered as part of Wave 2 during /vapt audit.

Phase 1: Port Discovery

1.1 Quick Scan (Top Ports)

If nmap is installed:

nmap -sT -T4 --top-ports 1000 -oN - <target>

If rustscan is installed (fast alternative):

rustscan -a <target> --ulimit 5000 -- -sV

If masscan is installed (fastest for full range):

masscan <target_ip> -p1-65535 --rate=1000

Fallback (Python/netcat):

# Check common ports with netcat
for port in 21 22 23 25 53 80 110 111 135 139 143 443 445 993 995 1433 1521 3306 3389 5432 5900 6379 8080 8443 8888 9090 27017; do
    nc -z -w1 <target> $port 2>/dev/null && echo "Port $port: OPEN"
done

1.2 Service Version Detection

If nmap is installed:

nmap -sV -sC -p <open_ports> <target>

Flags:

• -sV — Probe open ports for service/version info
• -sC — Run default NSE scripts

1.3 OS Fingerprinting

nmap -O <target>

Note: OS detection requires root/sudo privileges. If not available, infer from service banners and TTL values.

1.4 NSE Vulnerability Scripts

Run targeted NSE scripts against discovered services:

# General vulnerability check
nmap --script vuln -p <open_ports> <target>

# Service-specific scripts
nmap --script http-vuln* -p 80,443,8080 <target>
nmap --script ssh-auth-methods -p 22 <target>
nmap --script mysql-vuln* -p 3306 <target>
nmap --script smb-vuln* -p 445 <target>

1.5 UDP Scan (Common Services)

nmap -sU --top-ports 20 <target>

Key UDP services to check:

• 53 (DNS)
• 67/68 (DHCP)
• 69 (TFTP)
• 123 (NTP)
• 161/162 (SNMP)
• 500 (IKE/IPSec)
• 514 (Syslog)

Phase 2: Analysis

2.1 Service Risk Assessment

For each discovered service, assess:

2.2 Unnecessary Exposure

Flag services that shouldn't be publicly accessible:

• Database ports (3306, 5432, 27017, 6379)
• Admin interfaces (management consoles, phpMyAdmin)
• Development services (debug ports, test servers)
• Internal services (SNMP, NFS, SMB)

2.3 Scoring

Phase 3: Output

Terminal Output

Display port scan results as a table with service, version, and risk level.

Dev mode: Explain why each open port matters, what an attacker can do with each service, and how to restrict access.

Pro mode: Port table with risk flags only.

VAPT-NETWORK.md

# VAPT Network Scan Report

## Target: <target>
## Date: <timestamp>

## Open Ports

| Port | State | Service | Version | Risk |
|------|-------|---------|---------|------|
| 22 | open | ssh | OpenSSH 8.9 | Low |
| 80 | open | http | nginx 1.24 | Info |
| 443 | open | https | nginx 1.24 | Info |
| 3306 | open | mysql | MySQL 8.0.32 | High |
| ... | ... | ... | ... | ... |

## OS Detection
<detected OS or best guess>

## UDP Services
<discovered UDP services>

## NSE Script Results
<vulnerability scan output>

## Findings
<scored findings table>

## Suggested Next Steps
- /vapt scan <url> — scan web services for vulnerabilities
- /vapt inject <url> — test web application for injections
- /vapt auth <url> — test authentication on discovered services

Cross-Skill Integration

• Open ports and services feed into Wave 2 context
• Discovered web services (8080, 8443, etc.) expand scope for vapt-scan
• Database ports inform vapt-inject testing (direct DB access)
• Service versions feed into CVE matching in vapt-scan