Vulnerability Scanner

Automated vulnerability scanning pipeline using OpenVAS/Greenbone for network-level scanning, BlackArch tools for targeted assessments, and CVE-MCP for real-time vulnerability intelligence enrichment. Produces prioritized remediation reports with CVSS scoring and exploitability analysis.

Runs on ARGUS infrastructure with 39 BlackArch tools available and MCP bridge to CVE-MCP, pentester-mcp, and aynops.

Prerequisites

• ARGUS host with BlackArch tools installed (39 tools available)
• OpenVAS/GVM running (default: https://localhost:9392)
• CVE-MCP available on localhost for CVE enrichment
• pentester-mcp available on localhost for exploit validation
• aynops available on localhost for scan orchestration
• curl, jq on PATH
• gvm-cli, nmap, nikto from BlackArch

Infrastructure

This skill runs on ARGUS infrastructure:

Core Commands

Quick Network Scan (Nmap + CVE Enrichment)

Run a targeted Nmap scan and enrich findings with CVE data:

TARGET="192.168.1.0/24"
SCAN_ID="scan-$(date +%Y%m%d-%H%M%S)"
OUTDIR="/tmp/vuln-scans/$SCAN_ID"
mkdir -p "$OUTDIR"

echo "=== Phase 1: Nmap Service Discovery ==="
nmap -sV -sC -O -oA "$OUTDIR/nmap" "$TARGET" 2>&1 | tee "$OUTDIR/nmap-output.txt"

echo ""
echo "=== Phase 2: Extract Service Versions ==="
grep -E "open|filtered" "$OUTDIR/nmap-output.txt" | awk '{print $1, $2, $3}' > "$OUTDIR/services.txt"
cat "$OUTDIR/services.txt"

echo ""
echo "=== Phase 3: CVE Enrichment via CVE-MCP ==="
while IFS= read -r line; do
  service=$(echo "$line" | awk '{print $3}')
  version=$(echo "$line" | awk '{print $4}')
  echo "--- $service $version ---"
  curl -s -X POST "http://localhost:8765/cve-mcp/search" \
    -H "Content-Type: application/json" \
    -d "{\"product\": \"$service\", \"version\": \"$version\"}" | \
    jq '{cve_id: .id, cvss: .cvss_score, summary: .description[:120]}' \
    2>/dev/null || echo "  (CVE-MCP query failed for $service)"
done < "$OUTDIR/services.txt" > "$OUTDIR/cve-enrichment.txt"

Full OpenVAS Scan

Launch a full authenticated GVM scan:

TARGET="192.168.1.100"
TASK_NAME="vuln-scan-$(date +%Y%m%d-%H%M%S)"

# Create target
TARGET_ID=$(gvm-cli --gmp-username admin --gmp-password "$GVM_PASSWORD" socket \
  --xml "<create_target><name>$TASK_NAME-target</name><hosts>$TARGET</hosts></create_target>" | \
  grep -oP 'id="\K[^"]+')

echo "Target created: $TARGET_ID"

# Create task with Full and Fast config
TASK_ID=$(gvm-cli --gmp-username admin --gmp-password "$GVM_PASSWORD" socket \
  --xml "<create_task><name>$TASK_NAME</name><config id='daba56c8-73ec-11df-a475-002264764cea'/><target id='$TARGET_ID'/></create_task>" | \
  grep -oP 'id="\K[^"]+')

echo "Task created: $TASK_ID"

# Start scan
gvm-cli --gmp-username admin --gmp-password "$GVM_PASSWORD" socket \
  --xml "<start_task task_id='$TASK_ID'/>"

echo "Scan started. Monitor with: gvm-cli socket --xml '<get_tasks task_id=\"$TASK_ID\"/>'"

OpenVAS Report Generation

Generate and prioritize a report:

TASK_ID="your-task-id"
REPORT_ID=$(gvm-cli --gmp-username admin --gmp-password "$GVM_PASSWORD" socket \
  --xml "<get_tasks task_id='$TASK_ID'/>" | \
  grep -oP 'last_report id="\K[^"]+')

# Get results in XML
gvm-cli --gmp-username admin --gmp-password "$GVM_PASSWORD" socket \
  --xml "<get_results filter='report_id=$REPORT_ID'/>" > /tmp/openvas-results.xml

# Parse and prioritize
echo "=== Critical (CVSS >= 9.0) ==="
grep -E "CVSS.*(9\.|10\.)" /tmp/openvas-results.xml | head -20

echo ""
echo "=== High (CVSS 7.0-8.9) ==="
grep -E "CVSS.*[78]\." /tmp/openvas-results.xml | head -20

echo ""
echo "=== Medium & Low ==="
grep -E "CVSS.*[4-6]\." /tmp/openvas-results.xml | head -20

Web Application Scan (Nikto + ZAP)

TARGET_URL="https://example.com"
SCAN_DIR="/tmp/vuln-scans/web-$(date +%Y%m%d-%H%M%S)"
mkdir -p "$SCAN_DIR"

# Nikto — quick scan
echo "=== Nikto Web Server Scan ==="
nikto -h "$TARGET_URL" -o "$SCAN_DIR/nikto.html" -Format html 2>&1 | \
  grep -E "OSVDB|CVE|vulnerab" | tee "$SCAN_DIR/nikto-findings.txt"

# OWASP ZAP — deeper scan (if available)
if command -v zap-cli &>/dev/null; then
  echo ""
  echo "=== OWASP ZAP Active Scan ==="
  zap-cli quick-scan --self-contained --start-options '-config api.disablekey=true' \
    "$TARGET_URL" 2>&1 | tee "$SCAN_DIR/zap-output.txt"
  
  # Extract alerts
  zap-cli alerts --alert-level High 2>&1 | tee "$SCAN_DIR/zap-high.txt"
fi

echo "Results in: $SCAN_DIR"

Container Image Scanning (Trivy)

IMAGE="nginx:latest"

echo "=== Trivy Container Scan ==="
trivy image --severity HIGH,CRITICAL --format json \
  --output "/tmp/vuln-scans/trivy-$(date +%Y%m%d-%H%M%S).json" \
  "$IMAGE" 2>&1

# Filter critical findings
trivy image --severity CRITICAL "$IMAGE" 2>&1 | grep -A5 "CRITICAL"

CVE Intelligence Enrichment

Query CVE-MCP for specific vulnerability intelligence:

CVE="CVE-2024-3094"  # Example: xz backdoor

echo "=== CVE Intelligence: $CVE ==="
curl -s -X POST "http://localhost:8765/cve-mcp/lookup" \
  -H "Content-Type: application/json" \
  -d "{\"cve_id\": \"$CVE\"}" | jq '{
    id: .id,
    cvss: .cvss_score,
    vector: .cvss_vector,
    published: .published_date,
    exploit_available: .exploit_maturity,
    kev: .cisa_kev,
    affected: .affected_products[:5],
    summary: .description[:200]
  }'

Batch CVE Search by Product

Search for all CVEs affecting a specific product+version:

PRODUCT="openssl"
VERSION="3.0.0"

curl -s -X POST "http://localhost:8765/cve-mcp/search" \
  -H "Content-Type: application/json" \
  -d "{\"product\": \"$PRODUCT\", \"version\": \"$VERSION\"}" | \
  jq '.[] | {
    id: .id,
    cvss: .cvss_score,
    severity: .severity,
    exploit: .exploit_available,
    fixed_in: .fixed_version
  }' | head -50

System Hardening Scan (Lynis)

echo "=== Lynis System Audit ==="
sudo lynis audit system --quick 2>&1 | tee "/tmp/vuln-scans/lynis-$(hostname)-$(date +%Y%m%d).txt"

# Extract hardening index
grep "Hardening index" /tmp/vuln-scans/lynis-*.txt | tail -1

# Show warnings
grep "WARNING" /tmp/vuln-scans/lynis-*.txt | head -30

# Show suggestions
grep "Suggestion" /tmp/vuln-scans/lynis-*.txt | head -30

Usage Patterns

Full Security Assessment

When the user requests a comprehensive security assessment of a target:

1. Discovery — Nmap service scan + OS fingerprinting
2. CVE Enrichment — Cross-reference discovered services against CVE-MCP
3. Network Scan — OpenVAS deep scan with authenticated checks
4. Web Scan — Nikto + ZAP for web application vulnerabilities
5. Container Scan — Trivy for any container images in scope
6. System Audit — Lynis for host-level hardening check
7. Report — Generate prioritized report with CVSS, exploitability, remediation steps

CI/CD Security Gate

Integrate scan results into deployment pipelines:

1. Run container/image scan (Trivy)
2. Run dependency scan (OWASP Dependency Check)
3. Block deployment if CRITICAL findings with known exploits
4. Flag HIGH findings for security review
5. Generate SBOM (Software Bill of Materials)

Weekly Vulnerability Sweep

Automated weekly scan for infrastructure:

1. Run Nmap discovery on defined subnets
2. Compare against previous week's results (new open ports = alert)
3. Refresh CVE intelligence via CVE-MCP
4. Flag newly published CVEs affecting discovered services
5. Generate delta report (new findings since last sweep)

Exploit Validation

When a vulnerability is found, validate exploitability via pentester-mcp:

CVE="CVE-2024-XXXX"
SERVICE="apache"
VERSION="2.4.49"

echo "=== Exploit Validation: $CVE ==="
curl -s -X POST "http://localhost:8765/pentester-mcp/check-exploit" \
  -H "Content-Type: application/json" \
  -d "{\"cve\": \"$CVE\", \"service\": {\"name\": \"$SERVICE\", \"version\": \"$VERSION\"}}" | \
  jq '{
    exploitable: .exploit_available,
    metasploit_module: .msf_module,
    exploitdb_id: .edb_id,
    poc_available: .poc_url != null,
    confidence: .confidence
  }'

Pricing Tiers

Free (Basic)

• Single-target Nmap scan with CVE enrichment (up to 5 hosts)
• Nikto web scan (1 URL)
• Manual CVE lookup (up to 10 queries/day)
• Text-only findings export

Premium ($9.99/report)

• Full OpenVAS authenticated scan (unlimited hosts)
• OWASP ZAP active web scan
• CVE-MCP enrichment with CVSS scoring
• Priority remediation report (PDF)
• Exploit validation via pentester-mcp
• Historical comparison (delta from previous scan)
• 30-day report storage

Enterprise ($49/month)

• Scheduled weekly scans with alerting
• CI/CD pipeline integration (webhook)
• Team dashboard access
• SBOM generation
• SLA-backed response: critical findings within 4 hours
• Custom scan policies and compliance templates

Configuration

Troubleshooting

Security

• Scan authorization required — never scan targets without explicit written authorization
• Rate limiting — Nmap uses -T3 by default to avoid overwhelming targets
• Credential handling — GVM passwords via environment variables, never in command history
• Data isolation — Scan results stored locally, never shared with third parties
• Responsible disclosure — Critical findings should follow coordinated disclosure timelines
• ARGUS isolation — All scans run on dedicated ARGUS host, not production infrastructure

BlackArch Integration

The following BlackArch tools are available on ARGUS:

CVE-MCP Integration

CVE-MCP provides real-time vulnerability intelligence:

• CVE Lookup — fetch full CVE details by ID
• Product Search — find all CVEs for a product+version combo
• KEV Check — verify CISA Known Exploited Vulnerabilities catalog status
• Exploit Maturity — check if public exploit/PoC exists
• CVSS Vector — get full CVSS 3.1 vector string for scoring
• EPSS Score — exploit prediction scoring system for prioritization

Related Skills

• cve-tracker — continuous CVE monitoring for tech stacks
• osint-investigator — OSINT reconnaissance and intelligence gathering
• incident-responder — playbook-based incident response
• gdpr-security-auditor — technical GDPR compliance audit