Asset Discovery with Nmap & Nuclei

Introduction

External asset discovery is the foundation of any vulnerability‑management program. For Managed Service Providers (MSPs) the challenge is twofold: keep the list of client‑facing IPs up‑to‑date and feed that list into a reliable scanner without drowning in manual work. This guide shows how to combine two open‑source tools—Nmap for network enumeration and Nuclei for fast vulnerability templating—into a fully automated, continuous discovery pipeline. By the end you will have a repeatable process that runs on a schedule, stores results in a version‑controlled repository, and produces client‑ready reports.

Why Continuous Asset Discovery Matters

1. Dynamic environments – Cloud workloads, SaaS endpoints, and remote offices appear and disappear daily.
2. Regulatory pressure – Frameworks such as ISO 27001 Annex A.8.8 require an up‑to‑date asset inventory.
3. Risk reduction – Unknown assets are blind spots that attackers exploit.
4. Service level agreements – MSPs often guarantee a maximum time‑to‑detect for new exposures; a stale inventory breaks that promise.

A static spreadsheet quickly becomes obsolete. Automating the discovery loop closes the gap between what exists and what you scan.

Prerequisites

• A Linux or Windows host with Nmap 7.94+ and Nuclei 3.2+ installed.
• Access to a DNS resolver that can resolve client domains.
• A Git repository (private) to store scan artefacts.
• Basic scripting knowledge (bash or PowerShell).
• Optional: a CI/CD runner (GitHub Actions, GitLab CI, Jenkins) if you prefer pipeline‑based automation.

Step 1: Build a Target List with Nmap

1.1. Gather DNS and CIDR sources

Create a plain‑text file targets.txt containing:

• Public DNS names of the client’s web‑facing services.
• CIDR blocks for known data‑center ranges.
• Any third‑party SaaS endpoints that the client owns (e.g., *.cloudprovider.com).

1.2. Resolve DNS to IPs

#!/usr/bin/env bash
while read -r host; do
  dig +short "$host" | grep -E '^[0-9.]' >> resolved_ips.txt
done < targets.txt
sort -u resolved_ips.txt -o resolved_ips.txt

The resulting resolved_ips.txt is the definitive list for the next scan stage.

1.3. Run a fast Nmap ping sweep

nmap -sn -iL resolved_ips.txt -oG nmap_ping.gnmap
awk '/Up$/{print $2}' nmap_ping.gnmap > live_hosts.txt

live_hosts.txt now contains only the IPs that responded to ICMP/ARP, reducing noise for Nuclei.

Step 2: Feed Live Hosts into Nuclei

Nuclei works with a simple list of URLs or IPs. Convert the live hosts to a URL list:

awk '{print "http://"$1"/"}' live_hosts.txt > nuclei_targets.txt

Run the scan with a curated template set (e.g., exposures, cves, misconfigurations).

nuclei -l nuclei_targets.txt -t ~/nuclei-templates/ -severity high,critical -o nuclei_report.json

The JSON output can be parsed later for reporting.

Step 3: Automate the Whole Flow

3.1. Cron‑based approach (Linux)

Create /etc/cron.d/asset-discovery:

0 2 * * 1-5 root /usr/local/bin/asset-discovery.sh >> /var/log/asset-discovery.log 2>&1

asset-discovery.sh should encapsulate the steps from target list creation to Nuclei execution, then commit the artefacts to Git:

#!/usr/bin/env bash
set -euo pipefail
cd /opt/asset-discovery
git pull
./run-discovery.sh
git add *.json live_hosts.txt
git commit -m "$(date +'%Y-%m-%d') discovery run"
git push

3.2. CI/CD‑based approach (GitHub Actions)

name: Asset Discovery
on:
  schedule:
    - cron: '0 2 * * 1-5'
jobs:
  discover:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Install tools
        run: |
          sudo apt-get update && sudo apt-get install -y nmap golang
          go install -v github.com/projectdiscovery/nuclei/v2/cmd/nuclei@latest
      - name: Run discovery script
        run: ./run-discovery.sh
      - name: Commit results
        env:
          GIT_AUTHOR_NAME: github-actions
          GIT_AUTHOR_EMAIL: actions@github.com
        run: |
          git config user.name "$GIT_AUTHOR_NAME"
          git config user.email "$GIT_AUTHOR_EMAIL"
          git add *.json live_hosts.txt
          git commit -m "Automated discovery $(date +'%Y-%m-%d')"
          git push

Both methods guarantee a daily snapshot of the external surface.

Step 4: Store and Version Scan Results

Using Git gives you a full history of what IPs were live on any given day. Tagging each run (git tag -a v2026-10-17 -m "Discovery 2026‑10‑17") makes it easy to compare week‑over‑week changes with git diff.

Step 5: Reduce False Positives

Nuclei’s speed can produce noisy findings. Apply three simple filters:

1. Scope filtering – Only keep results that match the client’s approved domain list.
2. Severity gating – Drop info and low findings unless a client explicitly requests them.
3. Deduplication – Use jq to collapse identical CVE IDs across multiple hosts.

jq 'group_by(.info.name) | map({name: .[0].info.name, hosts: [.[] | .host]})' nuclei_report.json > deduped_report.json

Step 6: Generate a Client‑Ready Report

A lightweight markdown report can be built with a small Python script or a templating engine like Jinja2. Include:

• Executive summary (new assets discovered, high‑severity findings).
• Table of critical vulnerabilities (one markdown table allowed).
• Change log comparing this run to the previous one.

| Host | CVE / Issue | Severity | Evidence |
|------|------------|----------|----------|
| 203.0.113.45 | CVE‑2023‑XXXXX | Critical | /path/to/screenshot |

The final report.md can be attached to the ticketing system or emailed directly.

Cost and Resource Considerations

Running Nmap and Nuclei on a modest VM (2 vCPU, 4 GB RAM) costs under $20 / month on most cloud providers. The real cost is staff time; automation reduces the weekly effort from 8 hours to ≤30 minutes.

Best Practices Checklist

• Version‑control every scan artefact.
• Rotate DNS resolvers to avoid rate‑limiting.
• Limit Nmap intensity (--min-rate) for large CIDR blocks to stay within provider bandwidth caps.
• Secure the Git repo with least‑privilege access.
• Review template updates for Nuclei weekly; new templates catch emerging exposures.
• Document client‑specific scope in a scope.yaml file and reference it in the pipeline.

Conclusion

Continuous external asset discovery doesn’t require a heavyweight commercial platform. By chaining Nmap’s reliable host discovery with Nuclei’s fast vulnerability templating, MSPs can maintain an always‑fresh inventory, automatically surface new risks, and deliver consistent, repeatable reports to their clients. The workflow described here scales from a single‑client proof‑of‑concept to a multi‑tenant MSP operation with minimal additional overhead.

For a practical illustration of how a hosted platform can simplify the same process, see our Best Hosted Platforms for Nmap, Nuclei, ZAP & testssl.sh Scans. Ready to try it yourself? Start your free scan today and get a sample report in minutes.