Network vulnerability scanner with NMAP and automated CVE reporting

Network Vulnerability Scanner (used NMAP as engine) with Automated CVE Report Workflow Overview This n8n workflow provides comprehensive network vulnerability scanning with automated CVE enrichment and professional report generation. It performs Nmap scans, queries the National Vulnerability Database (NVD) for CVE information, generates detailed HTML/PDF reports, and distributes them via Telegram and email. Key Features - Automated Network Scanning: Full Nmap service and version detection scan - CVE Enrichment: Automatic vulnerability lookup using NVD API - CVSS Scoring: Vulnerability severity assessment with CVSS v3.1/v3.0 scores - Professional Reporting: HTML reports with detailed findings and recommendations - PDF Generation: Password-protected PDF reports using Prince XML - Multi-Channel Distribution: Telegram and email delivery - Multiple Triggers: Webhook API, web form, manual execution, scheduled scans - Rate Limiting: Respects NVD API rate limits - Comprehensive Data: Service detection, CPE matching, CVE details with references Use Cases - Regular security audits of network infrastructure - Compliance scanning for vulnerability management - Penetration testing reconnaissance phase - Asset inventory with vulnerability context - Continuous security monitoring - Vulnerability assessment reporting for management - DevSecOps integration for infrastructure testing --- Setup Instructions Prerequisites Before setting up this workflow, ensure you have: System Requirements - n8n instance (self-hosted) with command execution capability - Alpine Linux base image (or compatible Linux distribution) - Minimum 2 GB RAM (4 GB recommended for large scans) - 2 GB free disk space for dependencies - Network access to scan targets - Internet connectivity for NVD API Required Knowledge - Basic networking concepts (IP addresses, ports, protocols) - Understanding of CVE/CVSS vulnerability scoring - Nmap scanning basics External Services - Telegram Bot (optional, for Telegram notifications) - Email server / SMTP credentials (optional, for email reports) - NVD API access (public, no API key required but rate-limited) Step 1: Understanding the Workflow Components Core Dependencies Nmap: Network scanner - Purpose: Port scanning, service detection, version identification - Usage: Performs TCP SYN scan with service/version detection nmap-helper: JSON conversion tool - Repository: https://github.com/net-shaper/nmap-helper - Purpose: Converts Nmap XML output to JSON format Prince XML: HTML to PDF converter - Website: https://www.princexml.com - Version: 16.1 (Alpine 3.20) - Purpose: Generates professional PDF reports from HTML - Features: Password protection, print-optimized formatting NVD API: Vulnerability database - Endpoint: https://services.nvd.nist.gov/rest/json/cves/2.0 - Purpose: CVE information, CVSS scores, vulnerability descriptions - Rate Limit: Public API allows limited requests per minute - Documentation: https://nvd.nist.gov/developers Step 2: Telegram Bot Configuration (Optional) If you want to receive reports via Telegram: Create Telegram Bot 1. Open Telegram and search for @BotFather 2. Start a chat and send /newbot 3. Follow prompts: - Bot name: Network Scanner Bot (or your choice) - Username: networkscannerbot (must end with 'bot') 4. BotFather will provide: - Bot token: 123456789:ABCdefGHIjklMNOpqrsTUVwxyz (save this) - Bot URL: https://t.me/yourbotusername Get Your Chat ID 1. Start a chat with your new bot 2. Send any message to the bot 3. Visit: https://api.telegram.org/bot<YOURBOTTOKEN>/getUpdates 4. Find your chat ID in the response 5. Save this chat ID (e.g., 123456789) Alternative: Group Chat ID For sending to a group: 1. Add bot to your group 2. Send a message in the group 3. Check getUpdates URL 4. Group chat IDs are negative: -1001234567890 Add Credentials to n8n 1. Navigate to Credentials in n8n 2. Click Add Credential 3. Select Telegram API 4. Fill in: - Access Token: Your bot token from BotFather 5. Click Save 6.