Skip to main content

​
Overview

The Network Scanner identifies security weaknesses in network infrastructure, including servers, services, and network devices. It tests for known CVEs, misconfigurations, and security issues across network services. The Network Scanner is a vulnerability scanner: it actively tests your network infrastructure for security weaknesses. Discovered ports, services, OS information, and technologies are added to your Attack Surface. Identified vulnerabilities are reported as findings.

​
Supported targets

To scan multiple hosts, add IP ranges (CIDR notation like 192.168.1.0/24) or IP ranges (like 10.10.0.1-255) from the Assets page. You can also import multiple targets from a file.

​
Scan types

​
Parameters comparison

​
Engines comparison

The Deep scan performs active vulnerability testing and generates significant network traffic. Most correctly configured security monitoring systems will detect this scan. Do not use it if you don’t have proper authorization from the target owner.

​
Custom scan

Full control over scan parameters:
  • Select any combination of scanning engines (including OpenVAS)
  • Define custom port ranges, lists, or common port presets
  • Scan for specific CVEs (up to 10)
  • Adjust request rate for Nuclei and OpenVAS engines

​
Scanning engines

​
Version-based

Runs Nmap to detect open ports and services, then queries a vulnerability database to find CVEs affecting detected versions. Fast but may produce false positives if version strings are inaccurate or backported patches aren’t reflected.

​
Sniper

Custom vulnerability checks developed by the Pentest-Tools.com research team. Actively tests for vulnerabilities with targeted payloads. Browse the vulnerability database for the complete list. See Sniper for standalone usage.

​
Nuclei

Open-source vulnerability scanner using network and CVE templates. Performs active verification of vulnerabilities with proof-of-concept payloads. See Nuclei on GitHub for more information.

​
OpenVAS

Full-featured open-source vulnerability scanner with 10,000+ plugins. Provides comprehensive testing including service-specific checks. See OpenVAS for more information.
Sniper modules only work with TCP protocol. If you select UDP with Sniper enabled, the scan will fail.

​
Custom scan options

​
Port selection

You can also specify a port range (e.g., 1-1024) or a port list (comma-separated, e.g., 22,80,443,8080).
The “Top X ports” options use different, curated port lists for TCP and UDP based on which ports are most commonly open for each protocol. TCP lists emphasize web (80, 443, 8080), SSH (22), and database ports, while UDP lists focus on DNS (53), DHCP (67-68), SNMP (161-162), and NTP (123) ports.
See Port lists for the exact ports covered by each preset.

​
Protocol

​
Additional options

​
Custom CVE scanning

Scan for up to 10 specific CVEs. This feature:
  • Is supported by Sniper, Nuclei, and OpenVAS engines (not version-based)
  • Validates that the specified CVEs are detectable by the selected engines
  • Only runs engines that can actually detect the specified CVEs
To check which CVEs are detectable, browse the Pentest-Tools.com vulnerability database.

​
Rate limiting

When using Nuclei or OpenVAS engines, you can adjust the request rate:
Lower the request rate when scanning production systems to reduce impact, or increase it for faster scans on test environments.

​
Follow-up actions

After running a network scan:
  1. Prioritize by severity: Address critical and high severity findings first. Use EPSS scores to prioritize actively exploited vulnerabilities.
  2. Check CISA KEV: Vulnerabilities in the CISA Known Exploited Vulnerabilities catalog should be remediated urgently.
  3. Verify findings: Use the evidence provided to confirm vulnerabilities.
  4. Discover open ports: Use the Port Scanner for detailed port enumeration.
  5. Test SSL/TLS: Run the SSL/TLS Scanner on web services.
  6. Audit credentials: Use the Password Auditor to test for weak passwords.
  7. Exploit verified vulnerabilities: Use Sniper to validate exploitability.
  8. Generate reports: Export findings for remediation tracking and compliance documentation.