Scanners
Four scanners. One hosted workflow.
VulnScanners runs Nmap, Nuclei, OWASP ZAP, and testssl.sh on our infrastructure so you can pick the right tool for the target and get a PDF report per scan. The AI Pentest Agent takes it a step further with autonomous end-to-end penetration testing.
Nmap
NetworkPort and service inventory
TCP / UDP port scanning, service and version detection, OS fingerprinting, and the Nmap Scripting Engine — the foundation of any external assessment.
- TCP & UDP scanning
- Version detection
- NSE scripts
Learn more about hosted Nmap →
Nuclei
CVETemplate-based CVE detection
Thousands of community-contributed YAML templates covering CVEs, misconfigurations, default credentials, and exposures across HTTP, DNS, TCP, SSL, and more.
- CVE detection
- Multi-protocol
- Low false-positives
Learn more about hosted Nuclei →
OWASP ZAP
WebDynamic web app scanning
The open-source DAST tool — active and passive scan rules, traditional and AJAX spider, authentication support, and anti-CSRF token handling.
- Active + passive scan
- AJAX spider
- Auth support
Learn more about hosted OWASP ZAP →
testssl.sh
TLSTLS/SSL configuration audit
Checks every protocol version, cipher suite, certificate chain detail, and known TLS vulnerability — Heartbleed, ROBOT, LOGJAM, and 20+ more — against any host:port.
- Protocol detection
- Cipher analysis
- Attack checks
Learn more about hosted testssl.sh →
AI Pentest
AutonomousFull-stack autonomous penetration testing
The AI Pentest agent runs a complete end-to-end engagement against your target — recon, service enumeration, vulnerability identification, controlled exploitation, and a written report with CVSS scores, proof-of-concept evidence, and remediation guidance. It combines the outputs of Nmap, Nuclei, and ZAP where relevant, then goes beyond them with LLM-driven reasoning to chain findings, test hypotheses, and validate exploitation paths an automated scanner would miss.
Results are presented as a structured pentest report, not a raw finding dump — executive summary, scope, methodology, each issue with a business impact statement, reproduction steps, and a timestamped evidence log. Costs $200 per target (covers the LLM compute), uses a separate credit pool from standard scanner credits.
- Autonomous recon & exploitation
- LLM-driven chaining
- Full written report
- CVSS-scored findings
- Proof-of-concept evidence
Learn more about the AI Pentest Agent →
How they work together
Run them in order. Or let the AI handle it.
- Nmap — map the surface. Ports, services, versions.
- testssl.sh — audit TLS configuration on any exposed host:port.
- Nuclei — sweep the discovered services for known CVEs, misconfigurations, and exposures.
- OWASP ZAP — go deep on the web applications, including authenticated surfaces.
Or run the AI Pentest Agent for an autonomous end-to-end engagement that combines all four scanners with LLM-driven reasoning and delivers a full written pentest report.
Learn more about the AI Pentest Agent →More on this layering in our Nmap vs Nuclei vs ZAP guide.