Linux Vuln Scanner

Linux Vulnerability Scanner

Overview

Generates a complete vulnerability assessment workflow for Linux servers, Docker containers, and web applications. Uses open-source tools: Trivy (CVE scanning), nmap (port/service discovery), testssl.sh (TLS audit), and Nikto (web app scanning). Writes all scan scripts to disk, never outputs raw findings in chat.

Language: Respond in the user's language. Commands and configs in English.

When to Use

• User wants to check if their server or containers have known CVEs
• User wants to see what ports/services are exposed to the internet
• User wants to audit their SSL/TLS configuration
• User wants to run a web application security scan
• User is preparing for a security audit or compliance review
• User asks "is my server vulnerable?" or "what CVEs affect my system?"

When NOT to Use

• User wants to harden a server → /linux-security-hardener
• User wants to audit config files → /linux-config-auditor
• User wants to scan systems they do not own → refuse

⚠️ Authorization Requirement

Before generating any scan commands, confirm:

Only run these scans on systems you own or have explicit written permission to test. Unauthorized scanning is illegal in most jurisdictions regardless of intent. Keep all scan results confidential — they reveal attack surface to anyone who reads them.

If the user's target is not their own infrastructure, do not proceed.

Step 1 — Detect Scan Type

Scan Profiles

Profile 1 — OS/Package CVE Scan (Trivy)

Trivy scans the local OS or Docker images against NVD + OS advisory databases.

Install:

# Debian/Ubuntu
apt install wget apt-transport-https gnupg lsb-release
wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key \
  | gpg --dearmor > /etc/apt/trusted.gpg.d/trivy.gpg
echo "deb https://aquasecurity.github.io/trivy-repo/deb $(lsb_release -sc) main" \
  > /etc/apt/sources.list.d/trivy.list
apt update && apt install trivy

# RHEL/Rocky
cat > /etc/yum.repos.d/trivy.repo << 'EOF'
[trivy]
name=Trivy repository
baseurl=https://aquasecurity.github.io/trivy-repo/rpm/releases/$releasever/$basearch/
gpgcheck=1
enabled=1
gpgkey=https://aquasecurity.github.io/trivy-repo/rpm/public.key
EOF
dnf install trivy

Scan commands:

# Scan local filesystem for OS package CVEs
trivy fs / \
  --scanners vuln \
  --severity HIGH,CRITICAL \
  --format table \
  --output /tmp/trivy-os-report.txt

# Scan a specific Docker image
trivy image nginx:latest \
  --severity HIGH,CRITICAL \
  --format table \
  --output /tmp/trivy-image-report.txt

# Scan all running containers
docker ps --format '{{.Image}}' | sort -u | while read img; do
  echo "=== Scanning: $img ===" >> /tmp/trivy-containers.txt
  trivy image "$img" --severity HIGH,CRITICAL --quiet >> /tmp/trivy-containers.txt 2>&1
done

# Scan for misconfigurations too
trivy fs . --scanners misconfig --format table

Severity triage:

Profile 2 — Port & Service Discovery (nmap)

nmap maps open ports and identifies running services and versions.

Install: apt install nmap / dnf install nmap

# Quick scan — top 1000 ports, service detection
nmap -sV -sC --open TARGET_IP \
  -oA /tmp/nmap-quick

# Full TCP scan — all 65535 ports (slower but thorough)
nmap -p- -sV --open TARGET_IP \
  -oA /tmp/nmap-full

# UDP scan — DNS, SNMP, NTP, TFTP
nmap -sU --top-ports 50 TARGET_IP \
  -oA /tmp/nmap-udp

# Scan from inside the server (loopback + all interfaces)
nmap -sV -p- localhost

# Run vuln detection scripts
nmap --script vuln TARGET_IP \
  -oA /tmp/nmap-vulns

High-risk findings:

Profile 3 — SSL/TLS Audit (testssl.sh)

testssl.sh audits protocols, ciphers, certificates, and known vulnerabilities.

Install:

git clone --depth 1 https://github.com/drwetter/testssl.sh.git /opt/testssl.sh

Scans:

# Full audit with HTML report
/opt/testssl.sh/testssl.sh \
  --htmlfile /tmp/testssl-report.html \
  --logfile /tmp/testssl-report.txt \
  https://yourdomain.com

# Check only known vulnerabilities (Heartbleed, POODLE, ROBOT, etc.)
/opt/testssl.sh/testssl.sh --vulnerable https://yourdomain.com

# Check certificate expiry and chain
/opt/testssl.sh/testssl.sh --certinfo https://yourdomain.com

# Non-HTTPS port (e.g. SMTP STARTTLS)
/opt/testssl.sh/testssl.sh yourdomain.com:587

Issues to flag immediately:

Profile 4 — Web Application Scan (Nikto)

Nikto performs non-destructive scanning for common web vulnerabilities.

Install: apt install nikto / dnf install nikto

# Basic scan with HTML output
nikto -h https://yourdomain.com \
  -o /tmp/nikto-report.html \
  -Format html

# Scan with authentication
nikto -h https://yourdomain.com \
  -id username:password \
  -o /tmp/nikto-auth.txt

# Targeted: injection tests only
nikto -h https://yourdomain.com -Tuning 9   # SQL injection
nikto -h https://yourdomain.com -Tuning 4   # XSS / HTML injection
nikto -h https://yourdomain.com -Tuning 1 2 # Interesting files + misconfigs

Nikto tuning flags:

Profile 5 — Dependency CVE Scan

# Node.js (built-in)
npm audit --audit-level=high
npm audit fix   # auto-fix where safe

# Python
pip install pip-audit
pip-audit -r requirements.txt

# Java (Maven)
./mvnw org.owasp:dependency-check-maven:check
# Report: target/dependency-check-report.html

# Java (Gradle)
# Add to build.gradle: id "org.owasp.dependencycheck" version "9.0.7"
./gradlew dependencyCheckAnalyze

# Trivy for any repo
trivy fs . --scanners vuln --format table

Full-Assessment Playbook

Generate vuln-scan/full-scan.sh when user asks for a complete assessment:

#!/usr/bin/env bash
# full-scan.sh — runs all scan types, saves to /tmp/security-assessment/
set -euo pipefail

TARGET="${1:?Usage: $0 <TARGET_IP_OR_HOSTNAME>}"
OUTPUT_DIR="/tmp/security-assessment-$(date +%Y%m%d_%H%M%S)"
mkdir -p "$OUTPUT_DIR"

echo "[1/4] Trivy OS CVE scan..."
trivy fs / --scanners vuln --severity HIGH,CRITICAL \
  --format table --output "$OUTPUT_DIR/trivy-os.txt" 2>/dev/null || true

echo "[2/4] nmap port scan..."
nmap -sV -p- --open "$TARGET" -oA "$OUTPUT_DIR/nmap" 2>/dev/null || true

echo "[3/4] testssl.sh TLS audit..."
if [[ -x /opt/testssl.sh/testssl.sh ]]; then
  /opt/testssl.sh/testssl.sh \
    --htmlfile "$OUTPUT_DIR/testssl.html" \
    --logfile "$OUTPUT_DIR/testssl.txt" \
    "https://$TARGET" 2>/dev/null || true
else
  echo "testssl.sh not installed — skipping TLS audit" >> "$OUTPUT_DIR/testssl.txt"
fi

echo "[4/4] Nikto web scan..."
nikto -h "https://$TARGET" -o "$OUTPUT_DIR/nikto.html" -Format html 2>/dev/null || true

echo "✓ All scans complete."
echo "  Reports saved to: $OUTPUT_DIR/"
echo "  Start with CRITICAL/HIGH findings in: $OUTPUT_DIR/trivy-os.txt"

Output Format

Write scripts to ./vuln-scan/ in the current working directory:

vuln-scan/
  install-tools.sh     ← installs Trivy, nmap, testssl.sh, Nikto
  full-scan.sh         ← runs all scans against a target
  trivy-scan.sh        ← CVE scan only
  nmap-scan.sh         ← port scan only
  tls-audit.sh         ← TLS audit only
  nikto-scan.sh        ← web app scan only

Then print ONLY:

✅ Vulnerability scan scripts created in ./vuln-scan/

⚠️  Run ONLY on systems you own or have written authorization to test.

▶ Install tools (run once as root):
  chmod +x vuln-scan/install-tools.sh
  sudo ./vuln-scan/install-tools.sh

▶ Run full assessment:
  chmod +x vuln-scan/full-scan.sh
  sudo ./vuln-scan/full-scan.sh <TARGET_IP_OR_HOSTNAME>

▶ Reports saved to:
  /tmp/security-assessment-YYYYMMDD_HHMMSS/

💡 Review CRITICAL and HIGH findings first.
💡 Next: /linux-security-hardener to remediate discovered issues.
💡 Next: /linux-config-auditor to audit specific service configs.