--- LRL-Scan v1.1 --- LRL-Scan is a free open-source Vulnerability Scanner based off of Hacker Target's 'nmap-did-what' project. Our team has added improvements to the original schema, UI, and functionality by integrating SSLScan, Nuclei, NIST NVD lookups, and more. Perform full network, services, and vulnerability scanning on your network and discover any hidden threats in your environment. Have any questions 🐇? Reach out to us at [lostrabbitlabs.com](https://lostrabbitlabs.com) or join our Discord: [https://discord.gg/A6WqsyY](https://discord.gg/A6WqsyY)

Contributors

Jimi Allee & Will Lenzini

---

Features

• network-discovery.sh - Host discovery helper script
• lrl-scan.sh - Main scan flow automation script
• Nmap Port Scan - full port TCP scan and UDP top 1000 port scan
• LRL-Create-SQLite-schema.py - Initial schema/database creation script
• LRL-Nmap2SQLite.py - Nmap XML output parsing script with ASN info, mDNS, and NVD lookup enrichment
• LRL-Curl2SQLite.py - HTTP/HTTPs protocol probing script for discovered ports
• LRL-SSLScan2SQLLite.py - SSL scanner to identify weak crypto in use
• LRL-Nuclei2SQLLite.py - Nuclei scanner and parser to identify vulnerabilities

---

Installation

The following packages and dependencies are required to run LRL-Scan:

• curl
• docker (includes docker-compose)
• nmap
• nuclei
• python3
• python3-pip
• sslscan

1. Clone this repository

git clone https://gitlab.com/lostrabbitlabs/lrl-scan.git

2. After cloning this repository, several of the dependencies and pip requirements can be installed by running setup.sh as your root user.

cd lrl-scan && sudo sh setup.sh

3. Download and install Nuclei from the Nuclei repository and ensure that it is available in your system PATH. To check that it is within your system PATH run

nuclei -ut

4. Install Docker by following the official installation guide. Note: You may need to install docker-compose separately depending on your Docker version.

5. Request and obtain an NVD API key from NVD - API Key Request.

6. Signup and obtain an IPinfo free/paid-tier API key from IPinfo.

7. Configure your API keys in scan-scripts/LRL-Nmap2SQLite.py as follows:

17 # PLEASE CHANGE THESE API KEYS TO YOUR OWN
18 NIST_NVD_KEY = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
19 IPINFO_TOKEN = "xxxxxxxxxxxxxx"

Changing line numbers 18, 19 respectively

---

Configuring the scan-targets.txt file

Before running lrl-scan.sh, modify the scan-targets.txt file with your desired targets.

Method 1: Manual editing of scan-targets.txt

Modify the scan-targets.txt file with one target per line (domains or IPv4 addresses)

Example contents of scan-targets.txt

127.0.0.1
localhost
www.example.com
system.local

Method 2: Use network-discovery.sh to generate scan-targets.txt

You can use the network-discovery.sh script to perform host discovery and build your target list.

Provide your CIDR range in place of the <CIDR Range> parameter and optionally exclude your own IP address from scanning with the <IP to exclude>

sudo sh network-discovery.sh <CIDR Range> <IP to exclude>

sudo sh network-discovery.sh 10.0.0.0/24 10.0.0.3

---

Example Usage of lrl-scan.sh

Once scan-targets.txt is populated with your targets, you can start the scan with lrl-scan.sh.

sudo sh lrl-scan.sh

Scan Output

Upon scan completion the ALL-RESULTS folder will contain all scan outputs and the nmap-did-what/data/nmap_results.db file will store the scan results for the dashboard.

---

Example Usage of the Grafana Dashboard

To bring the dashboard up:

cd nmap-did-what/grafana-docker && sudo docker compose up -d

Or for older Docker versions:

cd nmap-did-what/grafana-docker && sudo docker-compose up -d

After bringing up the dashboard with docker compose or docker-compose you can access it within the browser at http://localhost:3000/

The default credentials for Grafana are admin / admin. For the first time starting the dashboard, you will be prompted to change your password.

---

Cleanup

lrl-scan.sh can be ran multiple times on the same database file. Each scan will be parsed into the existing database. To delete prior scan results and perform cleanup scan-scripts/cleanup.sh can be used.

sudo sh scan-scripts/cleanup.sh

This script will remove the ALL-RESULTS folder and the nmap-did-what/data/nmap_results.db file.

---

Need Help?

Discord: https://discord.gg/A6WqsyY

---

License

GNU General Public License