nmap-vulners

<div align="center">

# nmap-vulners

**Turn an nmap service scan into a ranked list of CVEs, exploits and what is
being attacked in the wild.**

One NSE script that takes the software nmap already identified, asks the
[Vulners](https://vulners.com) database what is known about it, and prints the
answer inside the scan report - worst first, by what is actually exploitable.

[![tests](https://img.shields.io/github/actions/workflow/status/vulnersCom/nmap-vulners/ci.yml?branch=master&label=tests&logo=github)](https://github.com/vulnersCom/nmap-vulners/actions)
[![license](https://img.shields.io/badge/license-Nmap%20Public%20Source-0e7c86)](LICENSE)
[![nmap](https://img.shields.io/badge/nmap-7.x-4b8bbe?logo=gnu)](https://nmap.org)
[![data](https://img.shields.io/badge/data-vulners.com-ff5f56)](https://vulners.com)
[![stars](https://img.shields.io/github/stars/vulnersCom/nmap-vulners?logo=github&color=yellow)](https://github.com/vulnersCom/nmap-vulners/stargazers)

<img src="docs/demo.gif" alt="Three scans: an SSH port with no API key, the same port with one, and a web port where the sweep names the Tomcat behind a Coyote banner" width="900">

<sub>Real scans of hosts published for scanning. No key, then a key, then a web
port: nmap's <code>-sV</code> reports a Coyote banner and the sweep names the
Tomcat and the jQuery behind it.</sub>

</div>

---

## Contents

|  |  |
|---|---|
| **Start here** | [What it does](#what-it-does) · [Install](#install) · [Your first scan](#your-first-scan) |
| **Understand the answer** | [Reading the output](#reading-the-output) · [**With a key and without**](#with-a-key-and-without) · [Ranking](#ranking) |
| **Understand the machine** | [How it works](#how-it-works) · [The web sweep](#the-web-sweep) · [Where the fingerprints come from](#where-the-fingerprints-come-from) · [Scanning politely](#scanning-politely) |
| **Reference** | [Options](#options) · [Where to keep the API key](#where-to-keep-the-api-key) · [Machine-readable output](#machine-readable-output) |
| **When something is off** | [Troubleshooting](#troubleshooting) · [FAQ](#faq) |

## What it does

nmap already tells you **what software** is listening on a port. This tells you
**what is wrong with it**.

You run one command. For every open port, the script takes the software nmap
identified, asks vulners.com what is known about it, and prints the answer
under that port - ordered so the things people are actually being attacked with
come first, rather than merely the things with the highest score.

It works with no account and no API key. A free key makes each answer richer,
and [With a key and without](#with-a-key-and-without) shows exactly how, with
the same scan run both ways.

## Install

**macOS, Linux, Kali, WSL** - one line, no arguments:

```sh
curl -fsSL https://raw.githubusercontent.com/vulnersCom/nmap-vulners/master/install.sh | sh
```

**Windows** - PowerShell as Administrator:

```powershell
irm https://raw.githubusercontent.com/vulnersCom/nmap-