SpooNMAP

SpooNMAP is a wrapper script for penetration testing that orchestrates masscan and nmap into a single automated recon pipeline. It handles host discovery, port discovery, service banner grabbing, and NSE based vulnerability identification, automatically tuning scan rate and tool selection based on target size and scan type (external vs. internal, single port vs. full port) to stay safe on production networks, including enterprise firewalls carrying live traffic.

Key Capabilities

• Automated host discovery (masscan plus nmap, external and internal profiles) narrows targets before port scanning begins
• Intelligent tool selection: automatically chooses masscan or nmap for port discovery based on a work units calculation, since masscan's stateless scanning is unreliable on small target sets
• Adaptive, firewall safe rate management. Internal scans are rate capped to keep concurrent state table entries low on production infrastructure
• NSE driven security findings engine. Runs curated, context aware NSE scripts (different sets for external vs. internal scans) and produces a severity sorted findings report. CRITICAL findings include EternalBlue, DoublePulsar, SambaCry, unauthenticated Docker API, VNC with no authentication, IPMI Cipher Zero, and exposed debugger ports (JDWP, Node.js Inspector, Delve). HIGH, MEDIUM, and LOW findings cover weak SSH configuration, SMB signing issues, exposed NFS shares, unauthenticated local LLM APIs (Ollama, Gradio, KoboldCpp, OpenAI compatible servers), WSUS detection, and Azure SQL vs. on prem SQL Server classification (to avoid false EOL findings)
• Config file driven or fully interactive. A config.json skips all prompts for repeatable, scriptable runs; interactive runs persist their answers to config.json automatically
• Resumable scans. --resume picks up an interrupted scan without re running completed discoverars prior output non interactively
• Structured output for downstream tooling: merged XML, plus JSON (spoonmap_output.json, findings.json) for direct ingestion into other frameworks or custom pipelines
• Hostname aware targeting. Resolves hostnames to IPs for scanning while preserving the originst aware checks)

Integration

Findings and host/port data export cleanly to JSON or XML for import into other security tooling and reporting pipelines.

How to Get SpooNMAP

Option 1
To download SpooNMAP, type the following command in Linux:
git clone https://github.com/trustedsec/spoonmap

Option 2
View on Git.

Requires Python 3.6+, masscan, and nmap (installed separately)

Support with SpooNMAP
For bug reports or enhancements, please open an issue on this projects GitHub page.