PeterMosmans/security-scripts bundles a Python wrapper, analyze_hosts.py, that orchestrates nmap, Nikto, testssl.sh and friends into scheduled, JSON-reporting misconfiguration scans for authorized assessments.
| Tool | PeterMosmans/security-scripts — a collection of Python and Bash security scripts centered on the analyze_hosts wrapper |
| Category | Vulnerability scanning orchestration and SSL/TLS audit tooling |
| Primary Use | Running combined nmap, Nikto, testssl.sh, droopescan and WPScan sweeps against authorized targets from one command, with JSON output for CI pipelines and scan deltas |
| Safe Use | Intended for authorized security assessments, scheduled internal audits, lab environments and CI-based checks of hosts you own or have written permission to test |
| Telemetry Note | Scan traffic is loud and fingerprintable: nmap NSE probes, Nikto request patterns and testssl.sh handshakes will appear in web server logs, IDS alerts and SIEM events; the default User-Agent is analyze_hosts |
security-scripts is a GPL-3.0 licensed repository by Peter Mosmans that answers a deceptively simple question: what if a single, dependency-light wrapper could drive an entire open source scanning toolkit against a host and hand you a structured result? The centerpiece is analyze_hosts.py, a Python3 script whose only hard requirements are nmap and Python itself. It wraps the heavy lifting of external tools — droopescan, nikto, testssl.sh, WPScan and curl — and decides which of them to invoke based on what the port scan and service fingerprinting reveal. With 283 stars and a topic list spanning nmap, nikto, testssl and ssl, this is a pragmatic operator's utility rather than a framework, and that restraint is its strength.
The README is unusually candid about the project's lifecycle: the Bash version, analyze_hosts.sh, is explicitly frozen. No new features will be added to it, and the author recommends analyze_hosts.py as the maintained path. That honesty matters when you are deciding whether to build an audit pipeline on top of a repository. The Bash variant still exists and still works, leaning on tools like cipherscan, whatweb, a custom openssl-1.0.2-chacha build and whois, but treating it as legacy is the correct read. Everything new — the JSON output, the settings engine, the queue and resume logic — lives in the Python implementation.
Architecturally, analyze_hosts.py is an orchestrator, not a scanner. It starts with an nmap sweep whose arguments the README exposes verbatim in the JSON schema: -sV --open -sS plus a long --script list covering NSE modules like http-trace, smb-os-discovery, ssh2-enum-algos, smtp-open-relay and ntp-monlist. From the open ports and fingerprints it then triggers downstream scanners automatically. Flag --framework and it analyzes websites and runs web scans; --ssl engages the TLS checks; --nikto fires the web server scanner; --sslcert pulls the certificate. This fingerprint-driven chaining is what turns four separate tools into one command.
The HTTP-side checks are granular enough to be useful without being noisy. --compression tests whether the webserver negotiates compression (the BREACH-adjacent surface), --headers inspects the security header posture, --trace checks for an enabled HTTP TRACE method, and --redirect looks for insecure redirect behavior. --force-ssl extends TLS checks to every open port rather than the usual suspects. Individually these are small checks; collectively they form the standard first-pass hygiene audit you would run against a staging box before a pentest or a compliance deadline.
What elevates the tool above a shell one-liner is the operational plumbing. Targets can be a single address, an IP range, comma-separated hosts, or a file fed via -i/--inputfile. There is a --queuefile mechanism with --resume support, meaning a long scan against a large range can survive interruption and pick up where it left off — the kind of detail you only design in after losing a night's work. --threads caps concurrency at 5 by default, --timeout bounds requests at 10 seconds, and --maxtime limits individual scans at 600 seconds. The --exit-code flag makes the script return a non-zero exit when alerts are found, which is precisely what you need to gate a Continuous Integration pipeline.
The --dry-run flag deserves a mention because it doubles as a safety and documentation mechanism: it prints the commands the orchestrator would execute without running them. In an authorized engagement, that is how you review exactly which nmap and testssl invocations will hit the wire before they do, and it is also the fastest way to learn what the tool actually does internally. Combine it with --debug and -v and you get full visibility into the decision logic that maps open ports to downstream scanners.
Output is where the tool earns its place in scheduled workflows. With --json the results land in a structured file containing the full argument set, start and finish timestamps, per-host open ports and an alerts array. The README's example shows alerts like a LUCKY13 (CVE-2013-0169) finding from TLS CBC ciphers and OSVDB-3092 items from Nikto — misconfiguration-class findings, exactly the scope the tool targets. Because the format is stable, the author notes you can generate deltas between successive scans, turning a point-in-time scanner into a drift detector for your own infrastructure. The companion display_results.py formats these JSON files for human review, with an --info flag to surface informational items alongside alerts.
The settings system is the most mature feature and the thing most wrappers never get around to. Via --settings and a analyze_hosts.yml file, you can define per-host, per-port expectations: an allowed_ports list so that an open port outside 22, 80, 443 is not flagged, nikto_plugins and nikto_tuning overrides, and targeted testssl test selections such as --ccs-injection, --ticketbleed and --robot. The README's example also shows testssl_untrusted: true to suppress alerts on self-signed certificates. This is false-positive management as code — you encode organizational baseline knowledge into the scan configuration instead of manually triaging noise each run.
Deployment is deliberately low-friction. The repository ships a Dockerfile and publishes an image as gofwd/analyze_hosts bundling droopescan, nmap, Nikto and testssl.sh, invocable with docker run --rm gofwd/analyze_hosts. Overriding the entrypoint lets you run any bundled tool directly, e.g. docker run --rm --entrypoint 'testssl.sh' gofwd/analyze_hosts. For a bare-metal install, the README gives the standard three steps: git clone, cd, and pip3 install -r requirements.txt. If tools live outside standard paths, environment variables like NIKTO, TESTSSL, WPSCAN, DROOPESCAN, CURL and OPENSSL point the orchestrator at them.
Defensively, this tool is easy to spot and that is worth stating plainly for blue teams. nmap SYN scans and the NSE barrage generate classic IDS signatures; Nikto request patterns are among the most recognizable in web logs; testssl.sh handshakes have a distinctive rhythm; and the default User-Agent is literally analyze_hosts, overridable with --user-agent but a giveaway if left stock. Anyone seeing this fingerprint combination in their logs should treat it as a scan event to attribute — either an internal scheduled audit run from CI, or something requiring a conversation with whoever owns the source address.
Where does this fit in a professional workflow? Think internal attack-surface review, pre-pentest reconnaissance against your own estate in a lab, continuous monitoring in Continuous Integration where a merged config change that opens a port or weakens TLS fails the build, and compliance-style hygiene sweeps. It is not an exploitation tool and does not pretend to be: every finding it emits is a misconfiguration or known-vulnerability indicator. Copyright lines running 2015-2022 suggest a mature, stable project; the freeze on the Bash variant and the maintained Python path tell you which entry point to standardize on. For authorized professionals who want one command, open source tools, informative output and no framework tax, security-scripts is a quietly excellent piece of glue.
PeterMosmans/security-scripts.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.