Skip to main content

​
Overview

The Network Scanner identifies security weaknesses in network infrastructure, including servers, services, and network devices. It tests for known CVEs, misconfigurations, and security issues across network services. The Network Scanner is a vulnerability scanner: it actively tests your network infrastructure for security weaknesses. Discovered ports, services, OS information, and technologies are added to your Attack Surface. Identified vulnerabilities are reported as findings.

​
Supported targets

To scan multiple hosts, add IP ranges (CIDR notation like 192.168.1.0/24) or IP ranges (like 10.10.0.1-255) from the Assets page. You can also import multiple targets from a file.

​
Scan types

​
Parameters comparison

​
Engines comparison

The Deep scan performs active vulnerability testing and generates significant network traffic. Most correctly configured security monitoring systems will detect this scan. Do not use it if you don’t have proper authorization from the target owner.

​
Custom scan

Full control over scan parameters:
  • Select any combination of scanning engines (including OpenVAS and SSL/TLS)
  • Define custom port ranges, lists, or common port presets
  • Scan for specific CVEs (up to 500), or only for CISA KEV CVEs
  • Adjust request rate for Nuclei and OpenVAS engines

​
Scanning engines

​
Version-based

Runs Nmap to detect open ports and services, then queries a vulnerability database to find CVEs affecting detected versions. Fast but may produce false positives if version strings are inaccurate or backported patches aren’t reflected.

​
Sniper

Custom vulnerability checks developed by the Pentest-Tools.com research team. Actively tests for vulnerabilities with targeted payloads. Browse the vulnerability database for the complete list. See Sniper for standalone usage.

​
Nuclei

Open-source vulnerability scanner using network and CVE templates. Performs active verification of vulnerabilities with proof-of-concept payloads. See Nuclei on GitHub for more information.

​
OpenVAS

Full-featured open-source vulnerability scanner with 10,000+ plugins. Provides comprehensive testing including service-specific checks. See OpenVAS for more information.

​
SSL/TLS

The SSL/TLS engine runs the same checks as the former SSL/TLS Scanner. It runs testssl.sh on every open port that uses SSL/TLS, directly (e.g. HTTPS) or through STARTTLS (e.g. SMTP, IMAP, POP3, FTP). It checks the server certificate (trust, expiration, issuer), deprecated protocols and weak ciphers, and tests for known SSL/TLS vulnerabilities such as Heartbleed, ROBOT, POODLE, DROWN, BEAST and SWEET32. Each finding includes a link to the server certificate. The engine is available in Custom scans.
The Sniper and SSL/TLS engines only work with the TCP protocol. You can’t start a UDP scan that uses only these engines.

​
Custom scan options

​
Port selection

You can also specify a port range (e.g., 1-1024) or a port list (comma-separated, e.g., 22,80,443,8080).
The “Top X ports” options use different, curated port lists for TCP and UDP based on which ports are most commonly open for each protocol. TCP lists emphasize web (80, 443, 8080), SSH (22), and database ports, while UDP lists focus on DNS (53), DHCP (67-68), SNMP (161-162), and NTP (123) ports.
See Port lists for the exact ports covered by each preset.

​
Protocol

​
Additional options

​
Custom CVE scanning

Scan for up to 500 specific CVEs. This feature:
  • Is supported by Sniper, Nuclei, and OpenVAS engines (the Version-based and SSL/TLS engines don’t detect specific CVEs, but they still run if selected)
  • Validates that the specified CVEs are detectable by the selected engines
  • Only runs engines that can actually detect the specified CVEs
To check which CVEs are detectable, browse the Pentest-Tools.com vulnerability database.

​
CISA KEV scanning

Enable Scan only CISA KEV CVEs to limit the scan to vulnerabilities in the CISA Known Exploited Vulnerabilities catalog. You don’t need to list the CVEs yourself: the scan uses every KEV CVE that the selected engines can detect. This option:
  • Is supported by Sniper, Nuclei, and OpenVAS engines
  • Only runs engines that cover at least one KEV CVE
  • Can’t be combined with a custom CVE list

​
Rate limiting

When using Nuclei or OpenVAS engines, you can adjust the request rate:
Lower the request rate when scanning production systems to reduce impact, or increase it for faster scans on test environments.

​
Follow-up actions

After running a network scan:
  1. Prioritize by severity: Address critical and high severity findings first. Use EPSS scores to prioritize actively exploited vulnerabilities.
  2. Check CISA KEV: Vulnerabilities in the CISA Known Exploited Vulnerabilities catalog should be remediated urgently.
  3. Verify findings: Use the evidence provided to confirm vulnerabilities.
  4. Discover open ports: Use the Port Scanner for detailed port enumeration.
  5. Test SSL/TLS: Run a Custom scan with the SSL/TLS engine selected.
  6. Audit credentials: Use the Password Auditor to test for weak passwords.
  7. Exploit verified vulnerabilities: Use Sniper to validate exploitability.
  8. Generate reports: Export findings for remediation tracking and compliance documentation.