Open source. Vulnerability scanners

30 May 2023 6 minutes Author: Lady Liberty

Security first: Open source and vulnerability scanners to reliably protect your system

Looking for powerful and effective tools to scan your system for vulnerabilities? Open source and vulnerability scanners can become your reliable assistant. Open source means that the source code of the application is available for viewing and modification. This allows users to test exactly how the program works, make changes and improve it according to their needs. This is especially useful in the case of vulnerability scanners, as they allow you to identify potential weaknesses in the system and suggest measures to fix them. Vulnerability scanners are tools that allow you to automatically detect and analyze potential vulnerabilities in computer systems, networks, or programs. They perform systematic security checks to identify potential problems, such as insufficient security measures, out-of-date applications, or weak configurations. With the help of vulnerability scanners, you can ensure a high level of security for your system and avoid potential threats.

The use of open source and vulnerability scanners allows you to have full control over the security of your system, as well as to ensure that it is effectively protected against potential threats. You can use these tools to test the security of your network, website, or application, identify weaknesses, and take the necessary steps to ensure that they are fixed. Open source and vulnerability scanners give you powerful analysis tools

Let’s start!

vMass Bot

vMass Bot — automates exploitation of remote hosts by trying to find environment files (.env) on target hosts and extract tools and information from them. The bot will then detect the target server’s CMS and automatically exploit the vulnerabilities to download shell payloads using the vMass vulnerability suite. vMass Bot can create server lists from IP ranges, URL lists, individual dotenv tracks, and snippets from search engines (eg Bing, DuckDuckGo). You can also use IP ranges from different hosting providers to get the best percentage of crawl results. The generated lists can be checked by a bot to remove invalid hosts. Removed tools can be filtered and checked to leave only working ones.


The entire installation will be carried out on Kali Linux.

  • Cloning the repository


Installation of necessary Perl modules using bash script only.


Running vMass Bot.



Only features not highlighted in yellow are available in the free version.

  1. (Security) Create target hosts from a given IP range, you can use as many ranges as you want

  2. Create target hosts from given dorks or using bot environment dorks, you can specify target hosts region, TLD and search engines.

  3. (Free) Create target hosts from a given list of websites, PS: URL lists must be only without www or https.

  4. (Free) Create target hosts from the provided hosting IP range, the range is randomly selected, you can change the range before starting.

  5. (Free) Check target hosts to filter Live Running IPS from inactive ones.

  6. (Free) Scan target hosts for possible .env files bot will check all host directories and save host if no env found.

  7. Scan target hosts for .env and perform automatic exploit based on host CMS to download payload (108 exploits)

  8. In development.

  9. (Free) Extract tools from hosts where the env file resides depending on the tool type.

  10. Check the removed SMTP, do you need to enter an email, if smtp is delivered, the smtp information will be in the body of the email.

  11. Check the correctness and balance of removed TWILIO APIs

  12. Try to navigate to the phpmyadmin login page and follow the admin capture method to load the shell on the WordPress CMS hosts.

  13. Move all tools to a private Telegram channel.

  14. Follows all the steps above one by one, you just configure the bot, run it and the results will be delivered to your telegram, best used for RDP/VPS and with a large list of target hosts.


The open source intelligence tool OSINT pulls data from services like Shodan, Censys, and more. in one program. It retrieves Common Vulnerabilities and Consequences (CVEs), Common Vulnerabilities Lists (CWEs), and has a database that maps CVEs to CWEs. The app now also has simple tools like a hash calculator and a very simple port scanner.


  • Get data from Censys by ip

  • Get data from Shodan by ip

  • Get data from Criminalip by ip

  • Get DNS data

  • Get WHOIS data

  • Find CVE by CWE

  • Create a report in pdf format

You can also:

  • Compute hashes on a per-user basis

  • Check whether the port is open or closed


Clone the repository


Go to the application directory


Create venv


Activate venv


Install dependencies


Compiling the program using the script


Getting Started

Before starting, you should create accounts on the services Shodan and  Censys .

By default, the program will be launched from the link http://localhost:8000/


Add user credentials to Settings


The multi-site script detector is equipped with four handwriting analyzers, an intelligent payload generator, a powerful discord engine, and an extremely fast scanner.

Instead of adding a payload and testing its performance like all other mechanisms do, XSStrike parses the response using multiple parsers and then generates payloads that are guaranteed to work using the tool’s built-in contextual analysis.

Main characteristics

  • Reflected and DOM XSS scanning

  • Multithreaded scanning

  • Contextual analysis

  • Configurable kernel

  • WAF detection and evasion

  • Scan for deprecated JS library

  • Intelligent payload generator

  • Homemade HTML and JavaScript parser

  • Powerful phasing engine

  • Blind XSS support

  • Thoroughly studied work process

  • Full HTTP support

  • Retrieval of useful data from a file

  • Works on Photon, Zetanize and Arjun

  • Payload encoding


Cloning the repository.


Establishing dependencies.





A modern port scanner. A quick port search at the speed of the Rust language turns a 17-minute Nmap scan into 19 seconds. Quickly find all open ports by automatically forwarding them to Nmap.


  • Scans all 65K ports in 8 seconds

  • Saves an hour by automatically sending ports to Nmap. No manual copying and pasting.

  • Good at his job. The only goal is to improve the Nmap scanner

  • Lets you choose which Nmap commands to run or use by default


For the fastest and most efficient installation in Kali Linux, it is enough to visit the release page and download the .deb file and install through dpkg -i the .deb file

To start the scan, just enter the code:


Today, after presenting you with a very detailed and extensive overview of effective vulnerability scanning tools, it’s up to you to decide which tool to use.

Other related articles
Found an error?
If you find an error, take a screenshot and send it to the bot.