diff --git a/secator/configs/workflows/host_recon.yaml b/secator/configs/workflows/host_recon.yaml index 33e47bc6..7edb8ccb 100644 --- a/secator/configs/workflows/host_recon.yaml +++ b/secator/configs/workflows/host_recon.yaml @@ -9,6 +9,7 @@ input_types: tasks: naabu: description: Find open ports + ports: "-" # scan all ports nmap: description: Search for vulnerabilities on open ports skip_host_discovery: True diff --git a/secator/configs/workflows/port_scan.yaml b/secator/configs/workflows/port_scan.yaml index f522d9d3..54040129 100644 --- a/secator/configs/workflows/port_scan.yaml +++ b/secator/configs/workflows/port_scan.yaml @@ -5,15 +5,17 @@ description: Port scan tags: [recon, network, http, vuln] input_types: - host + - cidr_range tasks: naabu: description: Find open ports + ports: "-" # scan all ports nmap: description: Search for vulnerabilities on open ports - targets_: port.host - ports_: port.port skip_host_discovery: True version_detection: True + targets_: port.host + ports_: port.port _group: searchsploit: description: Search for related exploits diff --git a/secator/tasks/naabu.py b/secator/tasks/naabu.py index 398e6ea1..21eb826f 100644 --- a/secator/tasks/naabu.py +++ b/secator/tasks/naabu.py @@ -14,7 +14,7 @@ class naabu(ReconPort): file_flag = '-list' json_flag = '-json' opts = { - PORTS: {'type': str, 'short': 'p', 'help': 'Ports'}, + PORTS: {'type': str, 'short': 'p', 'help': 'Ports (default: nmap\'s top 100 ports'}, TOP_PORTS: {'type': str, 'short': 'tp', 'help': 'Top ports'}, 'scan_type': {'type': str, 'help': 'Scan type (SYN (s)/CONNECT(c))'}, # 'health_check': {'is_flag': True, 'short': 'hc', 'help': 'Health check'} diff --git a/secator/tasks/nmap.py b/secator/tasks/nmap.py index 6d13ea4e..025a0891 100644 --- a/secator/tasks/nmap.py +++ b/secator/tasks/nmap.py @@ -31,7 +31,7 @@ class nmap(VulnMulti): opt_prefix = '--' output_types = [Port, Vulnerability, Exploit] opts = { - PORTS: {'type': str, 'short': 'p', 'help': 'Ports to scan'}, + PORTS: {'type': str, 'short': 'p', 'help': 'Ports to scan (default: most common 1000 ports for each protocol)'}, TOP_PORTS: {'type': int, 'short': 'tp', 'help': 'Top ports to scan [full, 100, 1000]'}, SCRIPT: {'type': str, 'default': 'vulners', 'help': 'NSE scripts'}, 'skip_host_discovery': {'is_flag': True, 'short': 'Pn', 'default': False, 'help': 'Skip host discovery (no ping)'},