A Bash script designed for automated scanning, vulnerability analysis and credential gathering of vulnerable ports and services in a network.

The script performs the following operations:

• Receives a network range from the user and tests whether or not the range is valid.
• Asks the user to choose between a "Basic" (stealth TCP + UDP port scan, as well as services) or a "Full" NMAP scan (scans full TCP port range with services, and includes vulnerability analysis).
• Scans the given network range and informs the user whether or not vulnerable ports and services (ftp, ssh, rdp, telnet) were located.
• Generates a CVE file if full scan was chosen and vulnerable services were found by applying Searchsploit on the vulnerabilities.
• Attempts to Brute Force vulnerable ports by using Hydra with either the user-given username and password lists, or with a default password list (set to use John the Ripper's list as default).
• Gives the user the option to go over the results.
• Saves the results in a designated and timestamped folder.
• Gives the user the option of whether or not they'd want to zip the designated folder.

Notes: Script was tested with Windows Server 2019, and Metasploitable Virtual Machines as a proof of concept.

Full Script Run:

Folder Contents:

Scan File Contents