Skills scanning-tools
📦
scanning-tools
v1.1 Content revision r1 Critical ⚙️ External commands🌐 Network access📁 Filesystem access
Run Authorized Security Scans
Security teams need consistent workflows for scanning authorized systems without missing common checks. This skill organizes tool choices, commands, reporting steps, and validation guidance for Claude, Codex, and Claude Code.
Supports: Claude Codex Code(CC)
Do not auto-install this skill.
The canonical policy requires operator review before any installation action.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "scanning-tools" from https://skillstore.io/skills/sickn33-scanning-tools.md and its manifest at https://skillstore.io/api/skills/sickn33-scanning-tools/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "scanning-tools". Create a scan plan for an approved internal subnet and a web application.
Expected outcome:
A phased plan with authorization checks, host discovery, web crawler boundaries, vulnerability validation, evidence handling, and reporting milestones.
Using "scanning-tools". Summarize scanner findings for leadership.
Expected outcome:
An executive summary with risk themes, affected systems, business impact, remediation owners, and follow-up validation steps.
Using "scanning-tools". Troubleshoot a scan that missed expected hosts.
Expected outcome:
A checklist covering scope confirmation, firewall behavior, discovery methods, DNS settings, scanner timing, and connectivity verification.
Security Audit
Criticalv5 • 7/9/2026 Open versioned report
The audit confirms substantial high-risk scanning and exploitation guidance throughout SKILL.md, including Nmap, Masscan, Aircrack-ng, Metasploit, sudo-driven tools, and active web scanners. Several Markdown backtick detections are documentation artifacts, but the skill still instructs users to run intrusive commands and includes critical Internet-scale scanning and exploit validation workflows. No prompt injection text was found.
1
Files scanned
595
Lines analyzed
86
Review items
0
False positives ignored
Confirmed security concerns (59)
Critical
Metasploit framework
#### Metasploit Vulnerability Validation
The skill explicitly introduces Metasploit vulnerability validation and starts msfconsole. Metasploit is exploitation tooling and is a critical marketplace risk indicator.
Critical
Metasploit framework
# Start Metasploit
The skill explicitly introduces Metasploit vulnerability validation and starts msfconsole. Metasploit is exploitation tooling and is a critical marketplace risk indicator.
Critical
Global Internet Mass Scanning Guidance
The skill includes Masscan guidance for scanning 0.0.0.0/0 at a high rate. This enables indiscriminate Internet probing outside an authorized scope.
The exact command targets 0.0.0.0/0 and specifies a very high scan rate, which directly confirms global mass scanning intent.
High
Certificate/key files
zap.sh -daemon -port 8080 -config api.key=<your_key>
The command places a ZAP API key value in command-line arguments. Even with a placeholder, this encourages handling sensitive API material in an exposed process command.
High
System reconnaissance
nmap -T0 192.168.1.100 # Paranoid (slowest, IDS evasion)
The Nmap timing option is described as paranoid and for IDS evasion. That context supports stealthy reconnaissance, not just benign inventory.
High
System reconnaissance
sudo airodump-ng -c <channel> --bssid <target_bssid> -w capture wlan0mon
The Aircrack-ng capture command targets a specific wireless BSSID and writes captures. That is targeted wireless reconnaissance activity.
High
Network scanning tools
#### Nmap (Network Mapper)
The line names a network scanning tool section that is followed by executable scanner guidance. It is enabling context for high-risk scanning workflows.
High
Network scanning tools
nmap -sn 192.168.1.0/24 # Ping scan (no port scan)
The line provides or references executable Nmap or Masscan scanning guidance. These tools actively probe network targets and require strict authorization.
Show all 59 confirmed findings
High
Network scanning tools
nmap -sL 192.168.1.0/24 # List scan (DNS resolution)
The line provides or references executable Nmap or Masscan scanning guidance. These tools actively probe network targets and require strict authorization.
High
Network scanning tools
nmap -Pn 192.168.1.100 # Skip host discovery
The line provides or references executable Nmap or Masscan scanning guidance. These tools actively probe network targets and require strict authorization.
High
Network scanning tools
nmap -sS 192.168.1.100 # TCP SYN scan (stealth)
The line provides or references executable Nmap or Masscan scanning guidance. These tools actively probe network targets and require strict authorization.
High
Network scanning tools
nmap -sT 192.168.1.100 # TCP connect scan
The line provides or references executable Nmap or Masscan scanning guidance. These tools actively probe network targets and require strict authorization.
High
Network scanning tools
nmap -sU 192.168.1.100 # UDP scan
The line provides or references executable Nmap or Masscan scanning guidance. These tools actively probe network targets and require strict authorization.
High
Network scanning tools
nmap -sA 192.168.1.100 # ACK scan (firewall detection)
The line provides or references executable Nmap or Masscan scanning guidance. These tools actively probe network targets and require strict authorization.
High
Network scanning tools
nmap -p 80,443 192.168.1.100 # Specific ports
The line provides or references executable Nmap or Masscan scanning guidance. These tools actively probe network targets and require strict authorization.
High
Network scanning tools
nmap -p- 192.168.1.100 # All 65535 ports
The line provides or references executable Nmap or Masscan scanning guidance. These tools actively probe network targets and require strict authorization.
High
Network scanning tools
nmap -p 1-1000 192.168.1.100 # Port range
The line provides or references executable Nmap or Masscan scanning guidance. These tools actively probe network targets and require strict authorization.
High
Network scanning tools
nmap --top-ports 100 192.168.1.100 # Top 100 common ports
The line provides or references executable Nmap or Masscan scanning guidance. These tools actively probe network targets and require strict authorization.
High
Network scanning tools
nmap -sV 192.168.1.100 # Service version detection
The line provides or references executable Nmap or Masscan scanning guidance. These tools actively probe network targets and require strict authorization.
High
Network scanning tools
nmap -O 192.168.1.100 # OS detection
The line provides or references executable Nmap or Masscan scanning guidance. These tools actively probe network targets and require strict authorization.
High
Network scanning tools
nmap -A 192.168.1.100 # Aggressive (OS, version, scripts)
The line provides or references executable Nmap or Masscan scanning guidance. These tools actively probe network targets and require strict authorization.
High
Network scanning tools
nmap -T0 192.168.1.100 # Paranoid (slowest, IDS evasion)
The line provides or references executable Nmap or Masscan scanning guidance. These tools actively probe network targets and require strict authorization.
High
Network scanning tools
nmap -T4 192.168.1.100 # Aggressive (faster)
The line provides or references executable Nmap or Masscan scanning guidance. These tools actively probe network targets and require strict authorization.
High
Network scanning tools
nmap -T5 192.168.1.100 # Insane (fastest)
The line provides or references executable Nmap or Masscan scanning guidance. These tools actively probe network targets and require strict authorization.
High
Network scanning tools
nmap --script=vuln 192.168.1.100 # Vulnerability scripts
The line provides or references executable Nmap or Masscan scanning guidance. These tools actively probe network targets and require strict authorization.
High
Network scanning tools
nmap --script=http-enum 192.168.1.100 # Web enumeration
The line provides or references executable Nmap or Masscan scanning guidance. These tools actively probe network targets and require strict authorization.
High
Network scanning tools
nmap --script=smb-vuln* 192.168.1.100 # SMB vulnerabilities
The line provides or references executable Nmap or Masscan scanning guidance. These tools actively probe network targets and require strict authorization.
High
Network scanning tools
nmap --script=default 192.168.1.100 # Default script set
The line provides or references executable Nmap or Masscan scanning guidance. These tools actively probe network targets and require strict authorization.
High
Network scanning tools
nmap -oN scan.txt 192.168.1.100 # Normal output
The line provides or references executable Nmap or Masscan scanning guidance. These tools actively probe network targets and require strict authorization.
High
Network scanning tools
nmap -oX scan.xml 192.168.1.100 # XML output
The line provides or references executable Nmap or Masscan scanning guidance. These tools actively probe network targets and require strict authorization.
High
Network scanning tools
nmap -oG scan.gnmap 192.168.1.100 # Grepable output
The line provides or references executable Nmap or Masscan scanning guidance. These tools actively probe network targets and require strict authorization.
High
Network scanning tools
nmap -oA scan 192.168.1.100 # All formats
The line provides or references executable Nmap or Masscan scanning guidance. These tools actively probe network targets and require strict authorization.
High
Network scanning tools
#### Masscan
The line names a network scanning tool section that is followed by executable scanner guidance. It is enabling context for high-risk scanning workflows.
High
Network scanning tools
masscan -p80 192.168.1.0/24 --rate=1000
The line provides or references executable Nmap or Masscan scanning guidance. These tools actively probe network targets and require strict authorization.
High
Network scanning tools
masscan -p80,443,8080 192.168.1.0/24 --rate=10000
The line provides or references executable Nmap or Masscan scanning guidance. These tools actively probe network targets and require strict authorization.
High
Network scanning tools
masscan -p0-65535 192.168.1.0/24 --rate=5000
The line provides or references executable Nmap or Masscan scanning guidance. These tools actively probe network targets and require strict authorization.
High
Network scanning tools
masscan 0.0.0.0/0 -p443 --rate=100000 --excludefile exclude.txt
The line provides or references executable Nmap or Masscan scanning guidance. These tools actively probe network targets and require strict authorization.
High
Network scanning tools
masscan -p80 192.168.1.0/24 -oG results.gnmap
The line provides or references executable Nmap or Masscan scanning guidance. These tools actively probe network targets and require strict authorization.
High
Network scanning tools
masscan -p80 192.168.1.0/24 -oJ results.json
The line provides or references executable Nmap or Masscan scanning guidance. These tools actively probe network targets and require strict authorization.
High
Network scanning tools
masscan -p80 192.168.1.0/24 -oX results.xml
The line provides or references executable Nmap or Masscan scanning guidance. These tools actively probe network targets and require strict authorization.
High
Network scanning tools
masscan -p80 192.168.1.0/24 --banners
The line provides or references executable Nmap or Masscan scanning guidance. These tools actively probe network targets and require strict authorization.
High
Network scanning tools
# Import Nmap results
The line imports Nmap results into the Metasploit workflow. It connects network scan data to exploitation-oriented tooling.
High
Network scanning tools
- Host discovery (Nmap ping sweep)
The line recommends host discovery or Masscan/Nmap for network discovery. This supports active reconnaissance of networks.
High
Network scanning tools
| Network Discovery | Nmap, Masscan |
The line recommends host discovery or Masscan/Nmap for network discovery. This supports active reconnaissance of networks.
High
Network scanning tools
### Nmap Cheat Sheet
The line names a network scanning tool section that is followed by executable scanner guidance. It is enabling context for high-risk scanning workflows.
High
Network scanning tools
| Ping Scan | `nmap -sn <target>` |
The line provides or references executable Nmap or Masscan scanning guidance. These tools actively probe network targets and require strict authorization.
High
Network scanning tools
| Quick Scan | `nmap -T4 -F <target>` |
The line provides or references executable Nmap or Masscan scanning guidance. These tools actively probe network targets and require strict authorization.
High
Network scanning tools
| Full Scan | `nmap -p- <target>` |
The line provides or references executable Nmap or Masscan scanning guidance. These tools actively probe network targets and require strict authorization.
High
Network scanning tools
| Service Scan | `nmap -sV <target>` |
The line provides or references executable Nmap or Masscan scanning guidance. These tools actively probe network targets and require strict authorization.
High
Network scanning tools
| OS Detection | `nmap -O <target>` |
The line provides or references executable Nmap or Masscan scanning guidance. These tools actively probe network targets and require strict authorization.
High
Network scanning tools
| Aggressive | `nmap -A <target>` |
The line provides or references executable Nmap or Masscan scanning guidance. These tools actively probe network targets and require strict authorization.
High
Network scanning tools
| Vuln Scripts | `nmap --script=vuln <target>` |
The line provides or references executable Nmap or Masscan scanning guidance. These tools actively probe network targets and require strict authorization.
High
Network scanning tools
| Stealth Scan | `nmap -sS -T2 <target>` |
The line provides or references executable Nmap or Masscan scanning guidance. These tools actively probe network targets and require strict authorization.
High
Network scanning tools
1. Try different discovery methods: `nmap -Pn` or `nmap -sn -PS/PA/PU`
The line provides or references executable Nmap or Masscan scanning guidance. These tools actively probe network targets and require strict authorization.
High
Network scanning tools
3. Use TCP SYN scan: `nmap -PS22,80,443`
The line provides or references executable Nmap or Masscan scanning guidance. These tools actively probe network targets and require strict authorization.
High
Network scanning tools
1. Increase timing: `nmap -T4` or `-T5`
The line provides or references executable Nmap or Masscan scanning guidance. These tools actively probe network targets and require strict authorization.
High
Network scanning tools
3. Use Masscan for initial discovery
The line recommends host discovery or Masscan/Nmap for network discovery. This supports active reconnaissance of networks.
High
Wireless Deauthentication And Credential Cracking Guidance
The skill provides Aircrack-ng commands for targeted capture, deauthentication, WPA handshake cracking, and WEP cracking. These actions can disrupt networks or recover credentials.
The line range explicitly labels a deauthentication attack and includes WPA and WEP cracking commands, leaving little ambiguity about offensive capability.
Medium
Destructive Malware Scan Removal Command
The skill recommends a ClamAV removal option that can delete files during a scan. Running this on production paths could cause data loss.
The command includes the removal option on a scan path, which directly supports deletion behavior even if intended for infected files.
Capability review items (86)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Critical
Ruby/shell backtick execution
```bash
The line range contains Metasploit startup, database import, scanner module use, target setting, and exploit suggestion commands. This is explicit exploitation workflow guidance.
High
Ruby/shell backtick execution
```bash
The line range is a shell block with Nmap host discovery, port scanning, service detection, OS detection, and vulnerability scripts. These commands actively probe network targets and can be misused outside authorization.
High
Ruby/shell backtick execution
```bash
The line range documents Masscan commands, including high-rate and Internet-wide scanning examples. This is real external scanner guidance with significant abuse potential.
High
Ruby/shell backtick execution
```bash
The line range contains OWASP ZAP commands for quick scans, spidering, active scanning, and daemon API configuration. Active web scanning can affect external applications.
High
Ruby/shell backtick execution
```bash
The line range contains Docker-based OWASP ZAP scan commands against a target URL. These commands run external web scanning tools.
High
Ruby/shell backtick execution
```bash
The line range contains Aircrack-ng commands for monitor mode, wireless capture, deauthentication, and password cracking. These are offensive wireless testing commands.
High
Ruby/shell backtick execution
```bash
The line range contains privileged Lynis audit commands and report generation. These commands read broad host security state with elevated permissions.
High
Ruby/shell backtick execution
| Ping Scan | `nmap -sn <target>` |
The table entry provides an Nmap ping scan command template. It is an executable network discovery command.
High
Ruby/shell backtick execution
| Quick Scan | `nmap -T4 -F <target>` |
The table entry provides an Nmap quick scan command template. It is an executable network scanning command.
High
Ruby/shell backtick execution
| Full Scan | `nmap -p- <target>` |
The table entry provides an Nmap full-port scan command template. Full port scans can be intrusive without authorization.
High
Ruby/shell backtick execution
| Service Scan | `nmap -sV <target>` |
The table entry provides an Nmap service detection command template. Service enumeration actively probes target systems.
High
Ruby/shell backtick execution
| OS Detection | `nmap -O <target>` |
The table entry provides an Nmap OS detection command template. OS fingerprinting is active reconnaissance.
High
Ruby/shell backtick execution
| Aggressive | `nmap -A <target>` |
The table entry provides an Nmap aggressive scan command template. Aggressive scanning combines multiple probes and scripts.
High
Ruby/shell backtick execution
| Vuln Scripts | `nmap --script=vuln <target>` |
The table entry provides an Nmap vulnerability script command template. Vulnerability scripts can be intrusive on targets.
High
Ruby/shell backtick execution
| Stealth Scan | `nmap -sS -T2 <target>` |
The table entry provides an Nmap stealth scan command template. Stealth scan guidance can support unauthorized reconnaissance.
High
Ruby/shell backtick execution
1. Try different discovery methods: `nmap -Pn` or `nmap -sn -PS/PA/PU`
The troubleshooting guidance provides Nmap discovery commands for hosts that are not detected. These commands can expand active probing behavior.
High
Ruby/shell backtick execution
3. Use TCP SYN scan: `nmap -PS22,80,443`
The troubleshooting guidance provides an Nmap TCP SYN discovery command. It is active network reconnaissance guidance.
High
Ruby/shell backtick execution
1. Increase timing: `nmap -T4` or `-T5`
The troubleshooting guidance recommends faster Nmap timing settings. Higher timing can increase scan intensity and operational impact.
High
sudo privilege escalation
sudo systemctl start nessusd
The command starts the Nessus daemon with sudo. It launches a privileged vulnerability scanning service on the host.
High
sudo privilege escalation
sudo apt install openvas
The command uses sudo to install, configure, or start OpenVAS services. Privileged scanner setup changes the host and expands attack surface if misused.
High
sudo privilege escalation
sudo gvm-setup
The command uses sudo to install, configure, or start OpenVAS services. Privileged scanner setup changes the host and expands attack surface if misused.
High
sudo privilege escalation
sudo gvm-start
The command uses sudo to install, configure, or start OpenVAS services. Privileged scanner setup changes the host and expands attack surface if misused.
High
sudo privilege escalation
sudo airmon-ng start wlan0
The command uses sudo with Aircrack-ng tooling to change wireless mode, capture traffic, or perform deauthentication. Elevated wireless attack commands are high risk.
High
sudo privilege escalation
sudo airodump-ng wlan0mon
The command uses sudo with Aircrack-ng tooling to change wireless mode, capture traffic, or perform deauthentication. Elevated wireless attack commands are high risk.
High
sudo privilege escalation
sudo airodump-ng -c <channel> --bssid <target_bssid> -w capture wlan0mon
The command uses sudo with Aircrack-ng tooling to change wireless mode, capture traffic, or perform deauthentication. Elevated wireless attack commands are high risk.
High
sudo privilege escalation
sudo aireplay-ng -0 10 -a <bssid> wlan0mon
The command uses sudo with Aircrack-ng tooling to change wireless mode, capture traffic, or perform deauthentication. Elevated wireless attack commands are high risk.
High
sudo privilege escalation
sudo freshclam
The command updates antivirus definitions with sudo. It modifies system-maintained security data and requires elevated trust.
High
sudo privilege escalation
sudo lynis audit system
The command runs Lynis with sudo and can read broad system configuration or write reports. Privileged host audit commands require explicit authorization.
High
sudo privilege escalation
sudo lynis audit system --quick
The command runs Lynis with sudo and can read broad system configuration or write reports. Privileged host audit commands require explicit authorization.
High
sudo privilege escalation
sudo lynis audit system --profile server
The command runs Lynis with sudo and can read broad system configuration or write reports. Privileged host audit commands require explicit authorization.
High
sudo privilege escalation
sudo lynis audit system --report-file /tmp/lynis-report.dat
The command runs Lynis with sudo and can read broad system configuration or write reports. Privileged host audit commands require explicit authorization.
High
sudo privilege escalation
sudo lynis show profiles
The command runs Lynis with sudo and can read broad system configuration or write reports. Privileged host audit commands require explicit authorization.
High
sudo privilege escalation
sudo lynis audit system --tests-from-group malware
The command runs Lynis with sudo and can read broad system configuration or write reports. Privileged host audit commands require explicit authorization.
High
Hardcoded IP address
masscan 0.0.0.0/0 -p443 --rate=100000 --excludefile exclude.txt
The command scans 0.0.0.0/0 with Masscan at a very high rate. That is Internet-wide probing guidance with clear misuse potential.
High
Hardcoded IP address
set RHOSTS 192.168.1.0/24
The IP range is assigned to Metasploit RHOSTS for an SMB scanner module. This defines targets for exploitation-oriented scanning.
Medium
Ruby/shell backtick execution
```bash
The line range contains Nessus service and scan commands that create and launch vulnerability scans against a network range. This is external scanner execution guidance, not inert prose.
Medium
Ruby/shell backtick execution
```bash
The line range contains OpenVAS installation, service startup, and scan target creation commands. These commands run scanner tooling and define network targets.
Medium
Ruby/shell backtick execution
```bash
The line range contains Nikto web server scanner commands and tuning options. This is executable scanner guidance for probing web targets.
Medium
Ruby/shell backtick execution
```bash
The line range contains Kismet commands for wireless detection and hidden network observation. The commands gather wireless network information.
Medium
Ruby/shell backtick execution
```bash
The line range contains ClamAV commands that scan directories and can move or remove files. These external commands can alter local files if run.
Medium
Ruby/shell backtick execution
```bash
The line range contains Prowler installation and AWS assessment commands. These commands access cloud security data and require careful authorization.
Medium
Ruby/shell backtick execution
```bash
The line range contains ScoutSuite installation and cloud audit commands for AWS, Azure, and GCP. These commands access cloud account configuration data.
Medium
Ruby/shell backtick execution
```bash
The line range contains OpenSCAP evaluation and fix generation commands. These commands inspect compliance state and can generate remediation scripts.
Medium
Ruby/shell backtick execution
```bash
The line range contains report conversion and scanner report export commands. It is external command guidance tied to security scan results.
Medium
Ruby/shell backtick execution
2. Reduce port range: `--top-ports 100`
The troubleshooting guidance recommends changing the scanned port range. This is scanner operation guidance even though it is presented as an option.
Medium
Hardcoded URL
zap-cli quick-scan https://target.com
The URL appears in active web scanner commands against a target site. Even as a placeholder, it documents network traffic to a web application target.
Medium
Hardcoded URL
zap-cli spider https://target.com
The URL appears in active web scanner commands against a target site. Even as a placeholder, it documents network traffic to a web application target.
Medium
Hardcoded URL
zap-cli active-scan https://target.com
The URL appears in active web scanner commands against a target site. Even as a placeholder, it documents network traffic to a web application target.
Medium
Hardcoded URL
-t https://target.com -r report.html
The URL appears in active web scanner commands against a target site. Even as a placeholder, it documents network traffic to a web application target.
Medium
Hardcoded URL
-t https://target.com -r report.html
The URL appears in active web scanner commands against a target site. Even as a placeholder, it documents network traffic to a web application target.
Medium
Hardcoded URL
nikto -h https://target.com
The URL appears in active web scanner commands against a target site. Even as a placeholder, it documents network traffic to a web application target.
Medium
Hardcoded IP address
nmap -sn 192.168.1.0/24 # Ping scan (no port scan)
The address is an RFC1918 example, but it is embedded in commands that perform active network scanning or vulnerability assessment. The operational behavior is real scanner traffic.
Medium
Hardcoded IP address
nmap -sL 192.168.1.0/24 # List scan (DNS resolution)
The address is an RFC1918 example, but it is embedded in commands that perform active network scanning or vulnerability assessment. The operational behavior is real scanner traffic.
Medium
Hardcoded IP address
nmap -Pn 192.168.1.100 # Skip host discovery
The address is an RFC1918 example, but it is embedded in commands that perform active network scanning or vulnerability assessment. The operational behavior is real scanner traffic.
Medium
Hardcoded IP address
nmap -sS 192.168.1.100 # TCP SYN scan (stealth)
The address is an RFC1918 example, but it is embedded in commands that perform active network scanning or vulnerability assessment. The operational behavior is real scanner traffic.
Medium
Hardcoded IP address
nmap -sT 192.168.1.100 # TCP connect scan
The address is an RFC1918 example, but it is embedded in commands that perform active network scanning or vulnerability assessment. The operational behavior is real scanner traffic.
Medium
Hardcoded IP address
nmap -sU 192.168.1.100 # UDP scan
The address is an RFC1918 example, but it is embedded in commands that perform active network scanning or vulnerability assessment. The operational behavior is real scanner traffic.
Medium
Hardcoded IP address
nmap -sA 192.168.1.100 # ACK scan (firewall detection)
The address is an RFC1918 example, but it is embedded in commands that perform active network scanning or vulnerability assessment. The operational behavior is real scanner traffic.
Medium
Hardcoded IP address
nmap -p 80,443 192.168.1.100 # Specific ports
The address is an RFC1918 example, but it is embedded in commands that perform active network scanning or vulnerability assessment. The operational behavior is real scanner traffic.
Medium
Hardcoded IP address
nmap -p- 192.168.1.100 # All 65535 ports
The address is an RFC1918 example, but it is embedded in commands that perform active network scanning or vulnerability assessment. The operational behavior is real scanner traffic.
Medium
Hardcoded IP address
nmap -p 1-1000 192.168.1.100 # Port range
The address is an RFC1918 example, but it is embedded in commands that perform active network scanning or vulnerability assessment. The operational behavior is real scanner traffic.
Medium
Hardcoded IP address
nmap --top-ports 100 192.168.1.100 # Top 100 common ports
The address is an RFC1918 example, but it is embedded in commands that perform active network scanning or vulnerability assessment. The operational behavior is real scanner traffic.
Medium
Hardcoded IP address
nmap -sV 192.168.1.100 # Service version detection
The address is an RFC1918 example, but it is embedded in commands that perform active network scanning or vulnerability assessment. The operational behavior is real scanner traffic.
Medium
Hardcoded IP address
nmap -O 192.168.1.100 # OS detection
The address is an RFC1918 example, but it is embedded in commands that perform active network scanning or vulnerability assessment. The operational behavior is real scanner traffic.
Medium
Hardcoded IP address
nmap -A 192.168.1.100 # Aggressive (OS, version, scripts)
The address is an RFC1918 example, but it is embedded in commands that perform active network scanning or vulnerability assessment. The operational behavior is real scanner traffic.
Medium
Hardcoded IP address
nmap -T0 192.168.1.100 # Paranoid (slowest, IDS evasion)
The address is an RFC1918 example, but it is embedded in commands that perform active network scanning or vulnerability assessment. The operational behavior is real scanner traffic.
Medium
Hardcoded IP address
nmap -T4 192.168.1.100 # Aggressive (faster)
The address is an RFC1918 example, but it is embedded in commands that perform active network scanning or vulnerability assessment. The operational behavior is real scanner traffic.
Medium
Hardcoded IP address
nmap -T5 192.168.1.100 # Insane (fastest)
The address is an RFC1918 example, but it is embedded in commands that perform active network scanning or vulnerability assessment. The operational behavior is real scanner traffic.
Medium
Hardcoded IP address
nmap --script=vuln 192.168.1.100 # Vulnerability scripts
The address is an RFC1918 example, but it is embedded in commands that perform active network scanning or vulnerability assessment. The operational behavior is real scanner traffic.
Medium
Hardcoded IP address
nmap --script=http-enum 192.168.1.100 # Web enumeration
The address is an RFC1918 example, but it is embedded in commands that perform active network scanning or vulnerability assessment. The operational behavior is real scanner traffic.
Medium
Hardcoded IP address
nmap --script=smb-vuln* 192.168.1.100 # SMB vulnerabilities
The address is an RFC1918 example, but it is embedded in commands that perform active network scanning or vulnerability assessment. The operational behavior is real scanner traffic.
Medium
Hardcoded IP address
nmap --script=default 192.168.1.100 # Default script set
The address is an RFC1918 example, but it is embedded in commands that perform active network scanning or vulnerability assessment. The operational behavior is real scanner traffic.
Medium
Hardcoded IP address
nmap -oN scan.txt 192.168.1.100 # Normal output
The address is an RFC1918 example, but it is embedded in commands that perform active network scanning or vulnerability assessment. The operational behavior is real scanner traffic.
Medium
Hardcoded IP address
nmap -oX scan.xml 192.168.1.100 # XML output
The address is an RFC1918 example, but it is embedded in commands that perform active network scanning or vulnerability assessment. The operational behavior is real scanner traffic.
Medium
Hardcoded IP address
nmap -oG scan.gnmap 192.168.1.100 # Grepable output
The address is an RFC1918 example, but it is embedded in commands that perform active network scanning or vulnerability assessment. The operational behavior is real scanner traffic.
Medium
Hardcoded IP address
nmap -oA scan 192.168.1.100 # All formats
The address is an RFC1918 example, but it is embedded in commands that perform active network scanning or vulnerability assessment. The operational behavior is real scanner traffic.
Medium
Hardcoded IP address
masscan -p80 192.168.1.0/24 --rate=1000
The address is an RFC1918 example, but it is embedded in commands that perform active network scanning or vulnerability assessment. The operational behavior is real scanner traffic.
Medium
Hardcoded IP address
masscan -p80,443,8080 192.168.1.0/24 --rate=10000
The address is an RFC1918 example, but it is embedded in commands that perform active network scanning or vulnerability assessment. The operational behavior is real scanner traffic.
Medium
Hardcoded IP address
masscan -p0-65535 192.168.1.0/24 --rate=5000
The address is an RFC1918 example, but it is embedded in commands that perform active network scanning or vulnerability assessment. The operational behavior is real scanner traffic.
Medium
Hardcoded IP address
masscan -p80 192.168.1.0/24 -oG results.gnmap
The address is an RFC1918 example, but it is embedded in commands that perform active network scanning or vulnerability assessment. The operational behavior is real scanner traffic.
Medium
Hardcoded IP address
masscan -p80 192.168.1.0/24 -oJ results.json
The address is an RFC1918 example, but it is embedded in commands that perform active network scanning or vulnerability assessment. The operational behavior is real scanner traffic.
Medium
Hardcoded IP address
masscan -p80 192.168.1.0/24 -oX results.xml
The address is an RFC1918 example, but it is embedded in commands that perform active network scanning or vulnerability assessment. The operational behavior is real scanner traffic.
Medium
Hardcoded IP address
masscan -p80 192.168.1.0/24 --banners
The address is an RFC1918 example, but it is embedded in commands that perform active network scanning or vulnerability assessment. The operational behavior is real scanner traffic.
Medium
Hardcoded IP address
nessuscli scan --create --name "Internal Scan" --targets 192.168.1.0/24
The address is an RFC1918 example, but it is embedded in commands that perform active network scanning or vulnerability assessment. The operational behavior is real scanner traffic.
Medium
Hardcoded IP address
<hosts>192.168.1.0/24</hosts>
The address is an RFC1918 example, but it is embedded in commands that perform active network scanning or vulnerability assessment. The operational behavior is real scanner traffic.
Medium
Temp directory access
sudo lynis audit system --report-file /tmp/lynis-report.dat
The command writes a privileged Lynis report to /tmp. Security reports can contain sensitive host details and temp paths may have weaker handling controls.
Risk Factors
⚙️ External commands (50)
SKILL.md:44-83 SKILL.md:83-89 SKILL.md:89-107 SKILL.md:107-115 SKILL.md:115-127 SKILL.md:127-140 SKILL.md:140-161 SKILL.md:161-169 SKILL.md:169-183 SKILL.md:183-197 SKILL.md:197-213 SKILL.md:213-216 SKILL.md:216-224 SKILL.md:224-230 SKILL.md:230-251 SKILL.md:251-259 SKILL.md:259-280 SKILL.md:280-286 SKILL.md:286-299 SKILL.md:299-307 SKILL.md:307-328 SKILL.md:328-334 SKILL.md:334-353 SKILL.md:353-361 SKILL.md:361-382 SKILL.md:382-388 SKILL.md:388-403 SKILL.md:403-411 SKILL.md:411-427 SKILL.md:427-433 SKILL.md:433-447 SKILL.md:447-497 SKILL.md:497-514 SKILL.md:514-522 SKILL.md:522-523 SKILL.md:523-524 SKILL.md:524-525 SKILL.md:525-526 SKILL.md:526-527 SKILL.md:527-528 SKILL.md:528-529 SKILL.md:529-571 SKILL.md:571 SKILL.md:573-579 SKILL.md:579 SKILL.md:580-582 SKILL.md:117 SKILL.md:142 SKILL.md:143 SKILL.md:146
🌐 Network access (48)
SKILL.md:505 SKILL.md:120 SKILL.md:149 SKILL.md:202 SKILL.md:205 SKILL.md:206 SKILL.md:219 SKILL.md:223 SKILL.md:232 SKILL.md:294 SKILL.md:46 SKILL.md:47 SKILL.md:48 SKILL.md:51 SKILL.md:52 SKILL.md:53 SKILL.md:54 SKILL.md:57 SKILL.md:58 SKILL.md:59 SKILL.md:60 SKILL.md:63 SKILL.md:64 SKILL.md:65 SKILL.md:68 SKILL.md:69 SKILL.md:70 SKILL.md:73 SKILL.md:74 SKILL.md:75 SKILL.md:76 SKILL.md:79 SKILL.md:80 SKILL.md:81 SKILL.md:82 SKILL.md:91 SKILL.md:92 SKILL.md:95 SKILL.md:98 SKILL.md:101 SKILL.md:102 SKILL.md:103 SKILL.md:106 SKILL.md:123 SKILL.md:159 SKILL.md:171 SKILL.md:347 SKILL.md:538
📁 Filesystem access (3)
Detected Patterns
Metasploit framework×2System reconnaissance×2Network scanning tools×51
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/sickn33-scanning-tools/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/sickn33-scanning-tools?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/sickn33-scanning-tools?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-scanning-tools/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/sickn33-scanning-tools.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
sickn33. (2026). scanning-tools security audit report (audit version 5) [Author version 1.1]. Skillstore. https://skillstore.io/skills/sickn33-scanning-tools/audits/5BibTeX citation
@techreport{sickn33-sickn33-scanning-tools-2026,
author = {sickn33},
title = {scanning-tools security audit report (audit version 5)},
institution = {Skillstore},
year = {2026},
number = {5},
url = {https://skillstore.io/skills/sickn33-scanning-tools/audits/5},
note = {Author version 1.1}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "scanning-tools security audit report (audit version 5)"
version: "1.1"
type: report
authors:
- name: "sickn33"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/sickn33-scanning-tools/audits/5"
identifiers:
- type: other
value: "skillstore:sickn33-scanning-tools:audit:5"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 55
Architecture
85
Maintainability
87
Content
69
Community
78
Spec Compliance
What You Can Build
Plan Internal Vulnerability Scans
Create a scoped scan plan that covers discovery, service enumeration, vulnerability checks, and reporting for approved assets.
Prepare Web Application Testing
Select web scanning tools, define crawl and active test boundaries, and organize findings for remediation review.
Collect Compliance Evidence
Use compliance scanners and reporting steps to gather evidence for CIS, PCI-DSS, HIPAA, or internal control reviews.
Try These Prompts
Check Readiness
Review my authorized scan scope, time window, and tool list. Identify missing prerequisites and low-impact starting checks.
Build A Scan Plan
Create a phased security scan plan for these approved assets: [asset list]. Include discovery, vulnerability checks, validation, and reporting.
Compare Scanner Results
Compare these authorized scanner findings. Group duplicates, flag likely false positives, and prioritize issues by business impact.
Design An Assessment Program
Design a recurring scanning program for my organization. Include scope controls, safe scan windows, evidence handling, reporting, and escalation rules.
Best Practices
- Confirm written authorization and scope before any scan.
- Start with low-impact discovery, then increase intensity only when approved.
- Record tool versions, time windows, targets, and evidence for every assessment.
Avoid
- Scanning public or third-party targets without written permission.
- Using high-rate or intrusive scans during business hours without coordination.
- Publishing raw scan output that includes secrets, internal addresses, or exploitable details.
Frequently Asked Questions
Does this skill run scans automatically?
No. It provides workflow and command guidance that users may apply in their own authorized environment.
Who should use this skill?
It is intended for security professionals working within a clearly authorized assessment scope.
Can it validate scan results?
It can help organize validation steps, but a qualified reviewer must confirm findings and business impact.
Does it include web application scanning?
Yes. It covers Burp Suite, OWASP ZAP, Nikto, crawl planning, active testing, and report generation.
What are the main safety concerns?
The guidance includes intrusive scanners, privileged commands, wireless attacks, and exploit validation examples.
Can it support compliance work?
Yes. It references tools and workflows for CIS, PCI-DSS, HIPAA, Lynis, OpenSCAP, and evidence reporting.