Kali Vulnerability Scanning & Forensics Scripts
Vulnerability scanning and forensics — Nmap vulnerability scripts, Nikto and WPScan wrappers, CVE database lookup, steganography detection, packet capture and file integrity monitoring for incident response.
Kali · Vuln Scanning — script list
| Script | Category | What it does |
|---|---|---|
ssh_log_analyzer.py | Forensics | Extracts IPs with repeated failed SSH logins from a mock `auth.log`. |
malware_hash_checker.py | Forensics | Hashes files in a directory and compares them to known signatures. |
packet_sniffer_scapy_basic.py | Forensics | Captures and summarises local packets with Scapy. |
steganography_detector.py | Forensics | Detects data appended after an image's end-of-file marker. |
termux_environment_checker.py | Environment | Validates packages, tools, and paths for a Termux environment. |
cve_database_lookup.py | Vuln Scanning | Queries a local JSON database for CVE details. |
port_scanner_banner_grab.py | Vuln Scanning | Multi-threaded port scan with service banner grabbing. |
subdomain_takeover_check.py | Vuln Scanning | Checks subdomains for dangling-CNAME takeover risk. |
vulnerability_report_generator.py | Reporting | Formats scan results into a readable text/PDF report. |
api_endpoint_fuzzer.py | Vuln Scanning | Fuzzes common API paths and reports `200 OK` responses. |
kali_usb_persistence_check.sh | Forensics | Verifies partition health and mount status of a persistent Kali USB. |
outbound_connection_monitor.sh | Forensics | Logs suspicious outbound connections via `ss`/`netstat`. |
file_integrity_monitor.sh | Forensics | Cron-friendly hashing of critical files with change alerts. |
firewall_iptables_setup.sh | Hardening | Configures basic defensive iptables rules (default-drop inbound). |
suspicious_process_hunter.sh | Forensics | Flags high-resource or suspiciously-located processes. |
nmap_vuln_automator.sh | Vuln Scanning | Runs Nmap with `--script vuln` and formats the output. |
nikto_web_scanner_wrapper.sh | Vuln Scanning | Automates Nikto scans and saves timestamped output. |
wp_scan_updater.sh | Vuln Scanning | Updates the WPScan database and runs basic enumeration. |
ssh_audit_tool.sh | Vuln Scanning | Checks SSH config for weak ciphers and root login. |
daily_security_summary.sh | Reporting | Compiles prior script output into a daily summary. |
Code samples
nmap_vuln_automator.sh — Nmap --script vuln wrapper
#!/bin/bash
# Day 10: Nmap Vulnerability Automator
# Wraps Nmap with the --script vuln flag and formats the output.
TARGET=$1
if [ -z "$TARGET" ]; then
echo "Usage: $0 <target_ip_or_domain>"
exit 0
fi
OUTPUT_FILE="nmap_vuln_$(date +%Y%m%d_%H%M%S).txt"
echo "[*] Starting Nmap Vulnerability Scan on $TARGET..."
echo "[*] Using scripts: vuln, auth, discovery"
# In a real Kali environment, this command would run:
# nmap -Pn --script vuln,auth,discovery -oN "$OUTPUT_FILE" "$TARGET"
# Mock output for demonstration
echo "--- Nmap Vuln Scan Results for $TARGET ---" > "$OUTPUT_FILE"
echo "Scan Date: $(date)" >> "$OUTPUT_FILE"
echo "Host is up." >> "$OUTPUT_FILE"
echo "PORT STATE SERVICE" >> "$OUTPUT_FILE"
echo "80/tcp open http" >> "$OUTPUT_FILE"
echo "|_http-vuln-cve2017-10010: VULNERABLE" >> "$OUTPUT_FILE"
echo "22/tcp open ssh" >> "$OUTPUT_FILE"
echo "[+] Scan complete. Results saved to $OUTPUT_FILE"
cat "$OUTPUT_FILE"