TrustedSec releases SpooNMAP update adding findings reports, exposed local LLM detection and resumable scans
TrustedSec has released a major update to SpooNMAP, its open-source wrapper that combines masscan for fast port discovery with Nmap for banner grabbing. The tool now runs context-aware NSE scripts against discovered services and writes severity-sorted findings (CRITICAL/HIGH/MEDIUM/LOW) to findings.txt, findings.md and findings.json, each with a reproduction command. A new Local LLM scan category flags unauthenticated Ollama, OpenAI-compatible endpoints, Gradio and KoboldCpp services, rated HIGH externally and MEDIUM internally. This is offensive-security tooling intended for authorized testing, not a report of an active threat or incident.
Detalhes técnicos
- Out-of-the-box checks cover anonymous FTP, weak SSH ciphers, SMBv1, NFS exports, exposed MSSQL, weak RDP encryption, expired certificates, LDAP without signing or channel binding, anonymous LDAP enumeration, default SNMP community strings and unauthenticated VNC.
- 15 custom NSE scripts are bundled, including RAKP hash capture from IPMI/BMC interfaces (Hashcat mode 7300), DameWare detection (CVE-2019-3980), cups-browsed detection (CVE-2024-47176) and LDAP signing/channel-binding checks.
- A new Containers & Debuggers category covers Docker APIs, kubelet, Node.js inspector, Delve and JDWP.
- Host discovery now starts with an ICMP Nmap -sn sweep plus masscan for large ranges, and takes the union of both. Internal scans cap the rate at 1,000 pps. External scans use an IDS-friendly port list and calibrate source-port spoofing. UDP discovery moved to Nmap -sU.
- A --resume flag saves choices to config.json and skips or limits re-discovery. The tool also adds JSON output, Metasploit-ready files, ETAs and a --cleanup command.
Remediação
Defenders can use the same checks to audit their own environments. Restrict network exposure of local LLM services, container APIs and debugger ports, and require authentication on them. Enforce LDAP signing and channel binding, disable SMBv1, and change default SNMP community strings. Use the tool only against systems you are authorized to test.
Linha do tempo
-
TrustedSec releases SpooNMAP update adding findings reports, exposed local LLM detection and resumable scans
ler a análise desta fonte ocultar
TrustedSec has released a major update to SpooNMAP, its open-source wrapper that combines masscan for fast port discovery with Nmap for banner grabbing. The tool now runs context-aware NSE scripts against discovered services and writes severity-sorted findings (CRITICAL/HIGH/MEDIUM/LOW) to findings.txt, findings.md and findings.json, each with a reproduction command. A new Local LLM scan category flags unauthenticated Ollama, OpenAI-compatible endpoints, Gradio and KoboldCpp services, rated HIGH externally and MEDIUM internally. This is offensive-security tooling intended for authorized testing, not a report of an active threat or incident.
Technical Details
- Out-of-the-box checks cover anonymous FTP, weak SSH ciphers, SMBv1, NFS exports, exposed MSSQL, weak RDP encryption, expired certificates, LDAP without signing or channel binding, anonymous LDAP enumeration, default SNMP community strings and unauthenticated VNC.
- 15 custom NSE scripts are bundled, including RAKP hash capture from IPMI/BMC interfaces (Hashcat mode 7300), DameWare detection (CVE-2019-3980), cups-browsed detection (CVE-2024-47176) and LDAP signing/channel-binding checks.
- A new Containers & Debuggers category covers Docker APIs, kubelet, Node.js inspector, Delve and JDWP.
- Host discovery now starts with an ICMP Nmap -sn sweep plus masscan for large ranges, and takes the union of both. Internal scans cap the rate at 1,000 pps. External scans use an IDS-friendly port list and calibrate source-port spoofing. UDP discovery moved to Nmap -sU.
- A --resume flag saves choices to config.json and skips or limits re-discovery. The tool also adds JSON output, Metasploit-ready files, ETAs and a --cleanup command.
Remediation
Defenders can use the same checks to audit their own environments. Restrict network exposure of local LLM services, container APIs and debugger ports, and require authentication on them. Enforce LDAP signing and channel binding, disable SMBv1, and change default SNMP community strings. Use the tool only against systems you are authorized to test.