A Curated Knowledge Base for Nmap Scripts, CVE Intelligence & Automated Reconnaissance Pipelines
A living reference of essential Nmap extensions, vulnerability feeds, and reporting tooling — maintained for security analysts, pentesters, and blue teams.
- Overview
- Repository Structure
- Core NSE Script Updates
- Alternative: Vulscan Integration
- NSE Script Collections
- CVE Search CLI Tools
- Dashboard & Visualization
- Reporting & Notifications
Awesomenmap is a knowledge-base repository that centralizes the most valuable Nmap NSE scripts, CVE search utilities, and post-scan reporting pipelines into a single, well-organized reference. Instead of hunting across dozens of GitHub repositories and forum posts, security practitioners can use this project as a definitive index and automation hub for all things Nmap.
The repository is intentionally kept lightweight — structured README files, shared resources, and upstream references. Third-party scripts are pulled from their original sources and kept up to date through a simple sync process.
| Capability | Description |
|---|---|
| Script Management | Pull and update the latest vulnerability, default-account, and version-detection NSE scripts from trusted upstream sources |
| CVE Intelligence | Search known CVEs and exploits directly from the command line without leaving your terminal |
| Automated Scanning | A dashboard-driven workflow assigns scanning targets, executes Nmap with the curated script set, and produces structured output |
| Rich Reporting | Generate HTML scan reports and Graphviz-compatible network topology graphs for every completed scan |
| Real-time Alerts | Push critical findings to a Telegram bot for instant visibility |
Awesomenmap/
│
├── README.md
├── LICENSE
├── .gitignore
│
├── scripts/
│ ├── nse/ # Curated NSE scripts
│ │ ├── vulners.nse # Vulners.com vulnerability detection
│ │ ├── nndefaccts.nse # Default account credential checker
│ │ ├── vicarius-nmap/ # Vicarius CVE mapping scripts
│ │ ├── vulscan/ # Vulscan alternative engine
│ │ ├── log4shell_nse.nse # Log4Shell (CVE-2021-44228) detector
│ │ ├── ms-exchange-version.nse # MS Exchange version enumeration
│ │ └── gitlab-version.nse # GitLab version enumeration
│ │
│ └── cli/ # CVE & exploit search tools
│ ├── getsploit/ # Vulners.com exploit downloader
│ └── search_vulns/ # Multi-source CVE searcher
│
└── visualize/
├── nmap-dashboard.xsl # XSLT stylesheet for HTML reports
└── nmap-formatter/ # Graphviz network topology generator
These scripts form the backbone of the vulnerability detection workflow. Keep them up to date by pulling from their official upstream repositories.
Source: vulnersCom/nmap-vulners
Queries the Vulners.com API to match detected service versions against a comprehensive vulnerability database. Returns associated CVEs, CVSS scores, and available exploit references in real time.
cd scripts/nse/
git clone https://github.com/vulnersCom/nmap-vulners.git
cp nmap-vulners/vulners.nse ./nmap -sV --script vulners.nse --script-args vulnersdebug=1 <target>Source: nnposter/nndefaccts
Checks network services for default or well-known credentials using an extensive, regularly updated dictionary of default username/password pairs. Covers routers, cameras, IoT devices, industrial controllers, and enterprise software — invaluable during initial reconnaissance to identify services using factory-default authentication.
cd scripts/nse/
git clone https://github.com/nnposter/nndefaccts.git
cp nndefaccts/nndefaccts.nse ./nmap -p 22,23,80,443,8080 --script nndefaccts.nse <target>Source: VicariusInc/vicarius-nmap
An alternative CVE mapping engine that cross-references detected software versions against the Vicarius vulnerability database. Complements the Vulners script by offering a second opinion on CVE coverage and surfacing discrepancies. Particularly strong for detecting known vulnerabilities in less common or niche software packages that may not receive immediate coverage in larger databases.
cd scripts/nse/
git clone https://github.com/VicariusInc/vicarius-nmap.git
cp -r vicarius-nmap/scripts/* ./nmap -sV --script vicarius-cve <target>Source: scipag/vulscan
A self-contained, offline-capable alternative to the API-dependent Vulners script. Ships with local vulnerability databases and can be extended with custom CSV/JSON feeds. Performs version-string matching against its bundled databases, making it ideal for air-gapped environments or scans where internet access during execution is restricted or undesirable.
cd scripts/nse/
git clone https://github.com/scipag/vulscan.gitnmap -sV --script=vulscan/vulscan.nse <target>Tip: Use Vulners and Vulscan together for maximum coverage — Vulscan as the offline baseline and Vulners for real-time API enrichment.
Community-maintained collections that expand Nmap's detection capabilities beyond the official script library. Each has been vetted for quality and relevance — periodically pull the latest versions to stay current.
| Collection | Source | Focus |
|---|---|---|
| nmap-extra-nse | sighook/nmap-extra-nse | General-purpose auxiliary scripts not yet merged into the official Nmap distribution — custom service probes, brute-force modules, and recon helpers |
| NSE_scripts | icarot/NSE_scripts | Vulnerability detection and information-gathering scripts tailored for web application auditing and service enumeration |
| Custom-Nse | ibrahmsql/Custom-Nse | Individually crafted NSE scripts targeting specific vulnerabilities, unusual protocols, and emerging threat landscapes |
| log4shell_nse | righel/log4shell_nse | Dedicated Log4Shell (CVE-2021-44228) detector for Java-based services — performs both header-based and DNS-based verification |
| ms-exchange-version | righel/ms-exchange-version-nse | Precise Microsoft Exchange Server version fingerprinting — essential for assessing Patch Tuesday compliance and ProxyShell/ProxyLogon exposure |
| gitlab-version | righel/gitlab-version-nse | GitLab instance version detection with associated CVE identification — helps prioritize remediation for self-hosted DevOps infrastructure |
| Official Nmap Scripts | nmap/nmap/scripts | The canonical upstream repository — always ensure your local scripts are at least as recent as this tree |
Command-line utilities to search for CVEs and exploits without leaving your terminal. They integrate into shell scripts, CI pipelines, and the Awesomenmap automation workflow.
Source: vulnersCom/getsploit
A lightweight Python CLI that queries the Vulners.com database for exploit code, shellcode, and proof-of-concept implementations. Returns direct links to exploit source code along with metadata such as publication date, exploit platform, and reliability rating.
pip install getsploit
getsploit -s "Apache Struts 2"
getsploit -s CVE-2021-44228Source: ra1nb0rn/search_vulns
Aggregates results from multiple vulnerability databases (NVD, ExploitDB, Vulners, and others) into a unified, deduplicated output. Particularly useful when you need a broad overview of all known vulnerabilities for a given product without manually checking each database separately.
git clone https://github.com/ra1nb0rn/search_vulns.git
cd search_vulns && pip install -r requirements.txt
python search_vulns.py -q "OpenSSH 7.2"Source: hackertarget/nmap-did-what · License: GPL-2.0 · Language: Python 3
A lightweight two-part tool by HackerTarget that turns raw Nmap XML scan results into a visual, interactive Grafana dashboard. It consists of a zero-dependency Python parser that loads scan data into SQLite, and a pre-configured Grafana Docker container with 13 ready-made visualization panels — no manual dashboard building required.
How it works:
┌──────────────┐ -oX ┌───────────────────┐ SQLite ┌──────────────────┐
│ Nmap │ ──────────────▶ │ nmap-to-sqlite.py │ ────────────────▶ │ Grafana Docker │
│ (scanner) │ XML output │ (Python parser) │ nmap_results.db │ (Dashboard) │
└──────────────┘ └───────────────────┘ └──────────────────┘
What it parses from Nmap XML:
| Data Point | Source |
|---|---|
| Host IPs & hostnames | <address> / <hostnames> elements |
| OS fingerprinting | <osmatch> elements, fallback to service_ostype |
| Port states (open/closed/filtered) | <port state="..."> per host |
| Service name, product, version | <service> elements (requires -sV) |
| HTTP page titles | Nmap http-title script output (requires -sC) |
| SSL certificate CN & issuer | Nmap ssl-cert script output (requires -sC) |
| Scan metadata | Nmap version, command line, timestamps, elapsed time |
Dashboard panels (13 total):
| Panel | Type | What It Shows |
|---|---|---|
| Hosts Up | Stat | Total live hosts discovered |
| Open Ports | Stat | Total open ports across all hosts |
| Unique Ports | Stat | Distinct port numbers found open |
| Scans | Stat | Total scans loaded into the database |
| Operating Systems | Pie Chart | OS distribution across discovered hosts |
| Unidentified Services | Pie Chart | Open ports with unknown services |
| Open Ports Found | Bar Chart | Ports ranked by frequency |
| Live Hosts & Open Ports over Time | Time Series | Scan trends across multiple runs |
| Port Tested Per Second | Bar Gauge | Scan performance per host |
| Identified Services | Table | Service name, product, version details |
| Open Services | Table | All open ports with service info |
| Hosts | Table | Per-host breakdown with OS and port counts |
| Scans Loaded | Table | Metadata for every imported scan |
Setup:
# 1. Clone
git clone https://github.com/hackertarget/nmap-did-what.git
cd nmap-did-what
# 2. Run your Nmap scan with XML output
nmap -sV -sC -O -oX scan_results.xml <target>
# 3. Parse XML into SQLite (zero external Python dependencies)
cd data/
python nmap-to-sqlite.py scan_results.xml
# → Creates data/nmap_results.db
# 4. Launch Grafana dashboard via Docker
cd ../grafana-docker/
docker-compose up -dOpen http://localhost:3000 — login admin/admin. The dashboard is auto-provisioned with all 13 panels.
Multiple scans accumulate in the same SQLite database over time, so Grafana's time-range filters let you compare trends across scan runs — perfect for tracking how a network's attack surface evolves between assessments.
Tutorial: Nmap Dashboard with Grafana — HackerTarget's full written walkthrough with screenshots.
Scan results are transformed into polished, interactive HTML reports using the included XSLT stylesheet — shareable with stakeholders or archived for compliance purposes.
- Executive summary with total hosts, open ports, and severity distribution
- Per-host detailed findings with service banners and detected vulnerabilities
- CVE reference links with CVSS scores and exploit availability indicators
- Sortable and filterable tables for efficient triage
xsltproc -o scan_out.html nmap-dashboard.xsl outscan.xml
Source: vdjagilev/nmap-formatter
Raw Nmap XML output is converted into Graphviz DOT files that render as network topology diagrams — making it immediately clear which hosts are interconnected, which services are exposed, and how vulnerabilities cluster across the target network.
./nmap-formatter dot ../../out-ex.xml --file ../../out-.dot --html-dark-mode
cat ../../out-.dot | dot -Tsvg > diagram.svg
telegram:
bot_token: "YOUR_BOT_TOKEN"
chat_id: "YOUR_CHAT_ID"
severity_threshold: "high" # Only notify for high/critical
include_cve_links: true
report_base_url: "https://your-dashboard.example.com/reports/"
