# Scanner Integration
Source: https://simplevulnerabilitymanager-svm.mintlify.app/configuration/scanner-integration

Configure credentials and endpoints for vulnerability scanners including Acunetix, Nessus, OpenVAS, Qualys, and more

Simple Vulnerability Manager integrates with industry-leading vulnerability scanners, enabling one-click scan execution and automatic report import. This guide covers configuring scanner credentials, API endpoints, and authentication.

## Web Vulnerability Scanners

### Acunetix

SVM supports both Acunetix 10.5 (local) and Acunetix 11/12 (Enterprise API).

#### Acunetix 11/12 API Configuration

<Steps>
  <Step title="Obtain API Credentials">
    Log into your Acunetix installation and generate an API key from the user profile settings.
  </Step>

  <Step title="Configure API Settings">
    In SVM, navigate to **Configuration** → **Web Scanners** → **Acunetix**

    Enter the following details:

    * **API URL**: `https://[your-acunetix-server]:3443`
    * **API Key**: Your generated API key
  </Step>

  <Step title="Test Connection">
    Click **Test Connection** to verify SVM can communicate with your Acunetix server.
  </Step>
</Steps>

#### Scan Configuration Options

The Acunetix integration supports advanced scan configurations:

```json theme={null}
{
  "scan_speed": "moderate",
  "technologies": ["PHP"],
  "excluded_paths": ["manager", "phpmyadmin", "testphp"],
  "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_5)",
  "custom_headers": [
    "Accept: */*",
    "Connection: Keep-alive"
  ]
}
```

#### Built-in Scan Profiles

* **Full Scan**: `11111111-1111-1111-1111-111111111111`
* **High Risk Vulnerabilities**: `11111111-1111-1111-1111-111111111112`
* **XSS Vulnerabilities**: `11111111-1111-1111-1111-111111111116`
* **SQL Injection**: `11111111-1111-1111-1111-111111111113`
* **Weak Passwords**: `11111111-1111-1111-1111-111111111115`
* **Crawl Only**: `11111111-1111-1111-1111-111111111117`

#### Report Templates

Acunetix provides multiple report formats:

* **Developer**: `11111111-1111-1111-1111-111111111111`
* **Quick**: `11111111-1111-1111-1111-111111111112`
* **Executive Summary**: `11111111-1111-1111-1111-111111111113`
* **OWASP Top 10 2017**: `11111111-1111-1111-1111-111111111125`
* **PCI DSS 3.2**: `11111111-1111-1111-1111-111111111120`
* **Affected Items**: `11111111-1111-1111-1111-111111111115` (default in SVM)

<Note>
  SVM automatically exports reports in both HTML and PDF formats. The scan script includes a 20-second delay multiplied by the URL number to prevent overwhelming the Acunetix server.
</Note>

<Warning>
  Support for Acunetix 10.5 Remote was removed in version 1.1.792 and replaced with Acunetix 11 API integration. Update your configuration accordingly.
</Warning>

### Burp Suite

Configure Burp Suite Professional for web application testing:

<Steps>
  <Step title="Locate Burp Suite Executable">
    Navigate to **Configuration** → **Web Scanners** → **Burp Suite**
  </Step>

  <Step title="Select Executable">
    Browse and select your Burp Suite JAR or executable file. SVM supports custom executable paths (fixed in version 1.1.790).
  </Step>

  <Step title="Configure Java">
    Ensure Java Runtime Environment (JRE) is installed and accessible in your system PATH.
  </Step>
</Steps>

### Netsparker

Configure Netsparker for automated web application security scanning:

<Steps>
  <Step title="Configure Netsparker Path">
    Navigate to **Configuration** → **Web Scanners** → **Netsparker**
  </Step>

  <Step title="Set Executable Location">
    Browse to your Netsparker installation directory and select the executable.
  </Step>

  <Step title="Launch Scans">
    Web URLs must include the protocol (`http://` or `https://`) for proper scan execution (enforced since version 1.1.791).
  </Step>
</Steps>

### Arachni

Configure Arachni Web Application Scanner for remote scanning:

<Steps>
  <Step title="Set Remote Server Details">
    Navigate to **Configuration** → **Web Scanners** → **Arachni**

    Configure your Arachni server:

    * **Server Address**: IP or hostname
    * **Port**: Default Arachni port
    * **Credentials**: If authentication is enabled
  </Step>

  <Step title="Configure SSH Access">
    For remote Arachni installations, configure SSH credentials for report retrieval.
  </Step>
</Steps>

<Note>
  Web URLs must have the `http://` or `https://` protocol specified to launch Arachni scans successfully.
</Note>

## Service Vulnerability Scanners

### Nessus

Configure Tenable Nessus for network and service vulnerability scanning.

#### Connection Settings

<Steps>
  <Step title="Configure Nessus Server">
    Navigate to **Configuration** → **Service Scanners** → **Nessus**

    Enter connection details:

    * **Server**: Nessus server hostname or IP
    * **Port**: HTTPS port (default: `8834`)
    * **Username**: Nessus user account
    * **Password**: Account password
  </Step>

  <Step title="Verify Service Status">
    SVM automatically detects if the Nessus service is running. If not started, you'll receive instructions to start it via SSH.
  </Step>
</Steps>

#### Service Management

If Nessus service is not running, start it manually:

```bash theme={null}
# On the Nessus server
/etc/init.d/nessusd start
```

#### Policy Configuration

<Steps>
  <Step title="Retrieve Scan Policies">
    SVM automatically fetches available scan policies from your Nessus server using the API.
  </Step>

  <Step title="Select Policy">
    Choose the appropriate policy for your scan:

    * Basic Network Scan
    * Advanced Scan
    * PCI Quarterly External Scan
    * Custom policies you've created
  </Step>
</Steps>

#### Export Formats

Nessus scans are exported in multiple formats (added in version 1.1.792):

* **HTML**: Human-readable report format
* **XML/Nessus**: Machine-readable format for importing into SVM

<Note>
  The User-Agent was updated in version 1.1.794 to ensure compatibility with Nessus 7 and later versions.
</Note>

### OpenVAS

Configure OpenVAS (Open Vulnerability Assessment System) for comprehensive vulnerability scanning.

#### Connection Configuration

<Steps>
  <Step title="Configure OpenVAS Manager">
    Navigate to **Configuration** → **Service Scanners** → **OpenVAS**

    Configure connection parameters:

    * **Server**: OpenVAS Manager hostname/IP
    * **Port**: OMP port (default: `9390`)
    * **Username**: OpenVAS user account
    * **Password**: Account password
  </Step>

  <Step title="Test OMP Connection">
    SVM uses the OpenVAS Management Protocol (OMP) to communicate with the scanner.
  </Step>
</Steps>

#### Scan Configurations

<Steps>
  <Step title="Retrieve Scan Configs">
    SVM fetches available scan configurations using OMP commands:

    ```xml theme={null}
    <get_configs />
    ```
  </Step>

  <Step title="Select Configuration">
    Choose from available scan configurations:

    * Full and fast
    * Full and very deep
    * System Discovery
    * Custom configurations
  </Step>
</Steps>

#### Report Formats

<Steps>
  <Step title="Get Available Report Formats">
    SVM retrieves available report formats from OpenVAS for export.
  </Step>

  <Step title="Configure Export Format">
    Select your preferred report format for automatic export after scan completion.
  </Step>
</Steps>

#### Remote OpenVAS Configuration

For remote OpenVAS installations:

<Steps>
  <Step title="Configure SSH Access">
    Set up SSH credentials for remote server access:

    * **SSH Server**: Remote server IP/hostname
    * **SSH Username**: Linux user account
    * **SSH Password**: Account password
  </Step>

  <Step title="Install Remote Tools">
    Navigate to **Tools** → **Install** → **Remote** → **OpenVAS** to install required components on the remote server.
  </Step>

  <Step title="Ubuntu for Windows 10 Support">
    OpenVAS remote scripts support Ubuntu for Windows 10 (WSL) as of version 1.1.792.
  </Step>
</Steps>

<Note>
  OpenVAS configuration retrieval displays detailed error messages when authentication fails, helping troubleshoot connection issues (improved in version 1.1.791).
</Note>

#### Editing Scripts

<Steps>
  <Step title="Access Script Editor">
    Navigate to **Tools** → **Edit Script** → **OpenVAS**
  </Step>

  <Step title="Modify Local or Remote Scripts">
    Edit OpenVAS scanning scripts for both local and remote configurations (added in version 1.1.787).
  </Step>
</Steps>

#### Plugin Management

<Steps>
  <Step title="Update OpenVAS Plugins">
    Navigate to **Tools** → **Update Plugins** → **OpenVAS**
  </Step>

  <Step title="Synchronize Plugin Feed">
    SVM executes the plugin update command to ensure you have the latest vulnerability checks.
  </Step>
</Steps>

### Qualys

Configure Qualys Community or Enterprise for cloud-based vulnerability scanning.

#### API Configuration

<Steps>
  <Step title="Configure Qualys Credentials">
    Navigate to **Configuration** → **Service Scanners** → **Qualys**

    Enter your Qualys account details:

    * **Username**: Qualys account username
    * **Password**: Qualys account password
  </Step>

  <Step title="Configure Proxy (if needed)">
    If accessing Qualys through a proxy:

    * **Use Proxy**: Enable proxy usage
    * **Proxy IP**: Proxy server address
    * **Proxy Port**: Proxy port number
    * **Proxy User**: Proxy authentication username
    * **Proxy Password**: Proxy authentication password
  </Step>
</Steps>

#### API Endpoint

SVM connects to Qualys API at:

```
https://qualysapi.qualys.com/msp/report_template_list.php
```

#### Report Templates

<Steps>
  <Step title="Retrieve Templates">
    SVM automatically fetches available report templates from Qualys using the API.
  </Step>

  <Step title="Select Template">
    Choose from available templates based on your compliance requirements:

    * Technical Report
    * Executive Report
    * PCI Compliance Report
    * Custom templates
  </Step>
</Steps>

<Warning>
  Qualys External scanning cannot scan private IP addresses. You'll receive an informative message if attempting to scan private IPs (added in version 1.1.788).
</Warning>

<Note>
  Configuration retrieval issues are now properly displayed with descriptive error messages (fixed in version 1.1.791).
</Note>

## Network Scanning Tools

### Nmap

Configure Nmap for network discovery and port scanning.

#### Local Nmap Configuration

<Steps>
  <Step title="Verify Nmap Installation">
    Ensure Nmap is installed and accessible in your system PATH.
  </Step>

  <Step title="Configure Nmap Path">
    Navigate to **Configuration** → **Network Tools** → **Nmap**
  </Step>

  <Step title="Test Nmap">
    Run a test scan to verify Nmap is properly configured.
  </Step>
</Steps>

#### Remote Nmap Installation

<Steps>
  <Step title="Install Remote Nmap">
    Navigate to **Tools** → **Install** → **Remote** → **Nmap** (added in version 1.1.788)
  </Step>

  <Step title="Configure Remote Access">
    Set up SSH credentials for the remote server where scans will execute.
  </Step>

  <Step title="Edit Nmap Scripts">
    The local Nmap script was fixed in version 1.1.787 for improved reliability.
  </Step>
</Steps>

#### Scanning Web/Domains

<Steps>
  <Step title="Add Targets to Project">
    Add web URLs or domain names to your project's target list.
  </Step>

  <Step title="Launch Nmap Scan">
    Select **Tools** → **Nmap** → **Scan Web/Domains**
  </Step>

  <Step title="Domain Support">
    Nmap can scan domains without IP resolution (fixed in version 1.1.792).
  </Step>
</Steps>

<Note>
  Version 2.0.3 added the ability to launch Nmap scans against Web/Domains directly from the project interface.
</Note>

## Information Gathering Tools

### Recon-ng

Configure Recon-ng for reconnaissance and information gathering.

#### Configuration

<Steps>
  <Step title="Configure Recon-ng Path">
    Navigate to **Configuration** → **Information Tools** → **Recon-ng**
  </Step>

  <Step title="Set API Keys">
    Configure API keys for various reconnaissance services:

    * **SHODAN API Key**: For Shodan queries
    * **IPInfoDB API Key**: For IP geolocation
    * Other service API keys as needed
  </Step>

  <Step title="Configure Modules">
    Version 2.0.1 added support for:

    * certificate\_transparency
    * google\_site\_web
    * hackertarget
    * threatcrowd
  </Step>
</Steps>

#### Domain Scanning

<Steps>
  <Step title="Add Domains">
    Domains can be added without specifying the protocol (fixed in version 2.0.3).
  </Step>

  <Step title="Launch Recon-ng">
    Execute reconnaissance modules with a single click from the project interface.
  </Step>
</Steps>

<Note>
  The Recon-ng executable path was updated in version 2.0.0 for better compatibility. Configuration saving was fixed in version 2.0.1.
</Note>

### EyeWitness

Configure EyeWitness for web application screenshot capture.

#### Local Configuration

<Steps>
  <Step title="Configure EyeWitness Path">
    Navigate to **Configuration** → **Information Tools** → **EyeWitness**
  </Step>

  <Step title="Set Python Environment">
    Ensure Python and EyeWitness dependencies are installed.
  </Step>
</Steps>

#### Remote Configuration

<Steps>
  <Step title="Install Remote EyeWitness">
    Navigate to **Tools** → **Install** → **Remote** → **EyeWitness**
  </Step>

  <Step title="Configure Remote Server">
    Set SSH credentials for remote execution.
  </Step>

  <Step title="Retrieve Reports">
    SVM automatically retrieves EyeWitness reports from remote servers (fixed in version 1.1.792).
  </Step>
</Steps>

<Note>
  EyeWitness and Java remote installation options were added to the Tools menu in version 1.1.792.
</Note>

## Android Security Tools

### MobSF (Mobile Security Framework)

Configure MobSF for Android application security analysis.

<Steps>
  <Step title="Configure MobSF Server">
    Navigate to **Configuration** → **Android Tools** → **MobSF**

    Enter server details:

    * **Server URL**: MobSF web interface URL
    * **API Key**: MobSF API key
  </Step>

  <Step title="Test Connection">
    Verify SVM can communicate with your MobSF instance.
  </Step>
</Steps>

### APK Tools

Configure tools for APK analysis and manipulation.

#### Android Debug Bridge (ADB)

* Version 1.0.39 included (updated in version 2.1.0)
* No additional configuration required
* Automatically detected when Android device is connected

#### Apktool

<Steps>
  <Step title="Configure Apktool">
    SVM includes download links for Apktool 2.4.0 (updated in version 2.1.0)
  </Step>

  <Step title="Local and Remote Support">
    Apktool can execute locally or on remote servers via SSH.
  </Step>
</Steps>

#### Other Android Tools

* **Enjarify**: DEX to JAR conversion
* **JD-Gui**: Java decompiler (version 1.5.2 link updated in 2.1.0)
* **QARK**: Quick Android Review Kit (script updated in version 1.1.794)
* **AndroBugs Framework**: Static analysis
* **Uber APK Signer**: APK signing tool (version 1.0.0 link updated in 2.1.0)

<Note>
  All Android tool configurations were updated in version 2.1.0 with the latest download links and version information.
</Note>

## General Scanner Configuration Tips

### Certificate Handling

For scanners with self-signed certificates (OpenVAS, Nessus):

* SVM's integrated web browser can access pages with invalid certificates (fixed in version 1.1.789)
* No additional certificate configuration required

### Script Management

<Steps>
  <Step title="Update All Scripts">
    Navigate to **Tools** → **Update Scripts and Tools** to download the latest versions of all integration scripts.
  </Step>

  <Step title="Edit Scripts">
    All `.bat` and `.sh` scripts are open source and can be edited to customize scanner behavior.
  </Step>

  <Step title="Review Script Documentation">
    Each script includes comments explaining parameters and API endpoints used.
  </Step>
</Steps>

### SSH Configuration for Remote Scanners

For remote scanner execution:

<Steps>
  <Step title="Install PuTTY Tools">
    SVM uses PuTTY tools for SSH connectivity:

    * **PLink**: Version 0.70 (updated in version 1.1.793)
    * **PSCP**: Version 0.70 (updated in version 1.1.793)
  </Step>

  <Step title="Configure SSH Credentials">
    Enter SSH credentials in scanner configuration:

    * **Server**: Remote server hostname/IP
    * **Username**: SSH username
    * **Password**: SSH password
  </Step>

  <Step title="Test SSH Connection">
    Use the test connection feature to verify SSH access before running scans.
  </Step>
</Steps>

<Note>
  Remote scanner scripts were improved in version 1.1.794 to properly copy files to remote servers (OpenVAS and QARK scripts fixed).
</Note>

## Troubleshooting

### Common Configuration Issues

<Warning>
  **Target Format Requirements**: All web URLs must include the protocol (`http://` or `https://`) when launching scanner tools. This requirement was enforced in version 1.1.791 to prevent scanning errors.
</Warning>

### Connection Testing

Always test scanner connections after configuration:

1. Save your configuration
2. Click "Test Connection"
3. Review error messages for authentication or network issues
4. Verify firewall rules allow outbound connections
5. Check scanner service status on remote servers

### Error Messages

SVM provides detailed error messages for configuration issues:

* **Authentication failures**: Check username/password
* **Connection timeouts**: Verify server address and port
* **SSL/TLS errors**: Ensure proper certificate handling
* **API errors**: Verify API keys and permissions

<Note>
  Configuration error handling was significantly improved in version 2.0.3, providing more descriptive messages for troubleshooting.
</Note>


# Application Settings
Source: https://simplevulnerabilitymanager-svm.mintlify.app/configuration/settings

Configure Simple Vulnerability Manager preferences, interface language, and application behavior

Simple Vulnerability Manager (SVM) provides comprehensive configuration options to customize your vulnerability analysis workflow. This guide covers all application settings and preferences.

## Language Configuration

SVM supports three interface languages with full Unicode support (added in version 2.1.0).

### Supported Languages

* **English** - Full interface translation
* **Spanish (Español)** - Complete localization
* **Russian (Русский)** - Full translation support

<Steps>
  <Step title="Change Interface Language">
    Navigate to the main menu and select your preferred language from the language selector. The interface will immediately update to display all menus, dialogs, and messages in the selected language.
  </Step>

  <Step title="Verify Language Files">
    SVM uses language-specific INI files to store localized settings:

    * `svm_en.ini` - English configuration
    * `svm_es.ini` - Spanish configuration
    * `svm_rus.ini` - Russian configuration
  </Step>

  <Step title="Restart if Needed">
    Most language changes take effect immediately. If you experience any display issues, restart the application.
  </Step>
</Steps>

<Note>
  The Unicode support introduced in version 2.1.0 enables proper display of special characters across all languages, including Cyrillic and accented characters.
</Note>

## Standalone and Professional Versions

The SVM executable name is associated with its INI configuration file, allowing you to run both Standalone and Professional versions simultaneously.

### Version Configuration

You can maintain separate configurations by naming your executables differently:

* `svm.exe` → uses `svm.ini`
* `svm_pro.exe` → uses `svm_pro.ini`
* `svm_standalone.exe` → uses `svm_standalone.ini`

<Note>
  This feature was introduced in version 2.1.0, enabling consultants to maintain separate environments for different clients or projects.
</Note>

## Connection Settings (SVM Pro)

The Professional version includes server connection capabilities for multi-user collaboration.

### Server Configuration

<Steps>
  <Step title="Access Connection Settings">
    Navigate to **Options** → **Connection Configuration** (Configuración de Conexión)
  </Step>

  <Step title="Configure Server Details">
    Enter the following connection parameters:

    * **Server**: Hostname or IP address (e.g., `svm.myddns.me`)
    * **Port**: Server port number (default: `8444`)
    * **Token**: Authentication token for your organization
  </Step>

  <Step title="Test Connection">
    Click the test connection button to verify connectivity before saving.
  </Step>
</Steps>

### Demo Server Access

You can try SVM Pro features using the demo server:

```
Server: svm.myddns.me
Port: 8444
Token: svm_demo
```

<Note>
  Version 2.0.2 introduced encrypted and compressed data transmission between server and clients for enhanced security and performance.
</Note>

<Warning>
  Connection settings require proper network configuration. If using SVM with Wine on Linux/MacOS, ensure your network adapter is properly configured. Connection handling was improved for Wine compatibility in version 2.1.0.
</Warning>

## Update Settings

SVM includes automatic update detection and download capabilities.

### Version Checking

<Steps>
  <Step title="Automatic Version Detection">
    SVM automatically checks for new versions on startup (introduced in version 2.1.0).
  </Step>

  <Step title="Manual Update Check">
    Navigate to **Tools** → **Check for Updates** to manually verify if a newer version is available.
  </Step>

  <Step title="Download Updates">
    When a new version is detected, SVM will prompt you to visit the download page at [github.com/simplevulnerabilitymanager/svm/releases](https://github.com/simplevulnerabilitymanager/svm/releases)
  </Step>
</Steps>

### Script and Tool Updates

Update internal scripts and tools independently from the main application:

<Steps>
  <Step title="Access Update Tools Menu">
    Navigate to **Tools** → **Update Scripts and Tools**
  </Step>

  <Step title="Download Latest Scripts">
    The update function downloads the latest open-source scripts from the SVM repository.
  </Step>

  <Step title="Verify Update">
    Check the console output to confirm all scripts were successfully updated.
  </Step>
</Steps>

<Note>
  All Windows (.bat) and Linux (.sh) scripts are open source under GPL license and can be updated independently from the main application.
</Note>

## Text Field Capacity

Version 2.1.0 significantly expanded text field capacity for better documentation:

* **IP addresses**: Extended capacity for multiple IPs and ranges
* **Web URLs**: Support for lengthy URLs and query parameters
* **Notes**: Expanded comment fields for detailed observations
* **Request/Response**: Increased capacity for full HTTP traffic logs

## Bug Reports and Feature Requests

SVM includes an integrated feedback system for reporting issues and suggesting improvements.

### Using the BugIdeas Window

<Steps>
  <Step title="Access BugIdeas">
    Open the BugIdeas window from the **Help** menu to report errors or suggest new features.
  </Step>

  <Step title="Describe Your Issue or Idea">
    Enter a detailed description in the comment field. The vertical scrollbar (fixed in version 2.0.3) allows for lengthy descriptions.
  </Step>

  <Step title="Submit Feedback">
    Click Submit to send your feedback directly to the development team.
  </Step>
</Steps>

<Note>
  You can also email feedback to [contacto@simplevulnerabilitymanager.com](mailto:contacto@simplevulnerabilitymanager.com)
</Note>

## Database Management

### Backup Configuration

<Steps>
  <Step title="Access Backup Options">
    Navigate to **Database** → **Backup** to create a backup of your local vulnerability database.
  </Step>

  <Step title="Select Backup Location">
    Choose a secure location for your backup file. Backups include all projects, vulnerabilities, and configurations.
  </Step>

  <Step title="Verify Backup">
    The backup process creates a complete copy of your database. Verify the file was created successfully.
  </Step>
</Steps>

<Warning>
  The backup error in Wine (version 2.0.2 and earlier) has been fixed in version 2.0.3. Ensure you're using the latest version for reliable backups on Linux/MacOS.
</Warning>

## Window and Control Behavior

### Display Settings

* **Window Resizing**: Controls automatically adjust when resizing the main window
* **Zoom Functionality**: OWASP Mobile section supports zoom controls that properly restore to normal view
* **Multiple Instances**: Running multiple instances of svm.exe is supported, with proper cleanup on exit (fixed for Wine in version 2.0.3)

<Note>
  Control positioning issues when resizing windows were resolved in version 2.0.2, ensuring a consistent user experience.
</Note>

## Microsoft Office Integration

SVM requires Microsoft Office for report generation capabilities.

### Office Requirements

* **Microsoft Word**: Required for generating Word reports
* **Microsoft Excel**: Required for exporting project lists and vulnerability data

<Warning>
  If Microsoft Word or Excel is not installed, SVM will display clear error messages when attempting to generate reports or export data. Ensure Office is properly installed and activated.
</Warning>

### Word Template Handling

When double-clicking a template in configuration (version 2.0.0+):

* Opens the actual template file for editing in Word
* Previously opened a new document based on the template
* Changes are saved directly to the template

## Proxy Configuration

For users behind corporate firewalls or requiring proxy access:

### Qualys Proxy Settings

Configure proxy settings for Qualys scanner connections:

```
Proxy IP: [Your proxy server]
Proxy Port: [Proxy port number]
Proxy User: [Authentication username]
Proxy Password: [Authentication password]
```

The system supports:

* Basic proxy authentication
* NTLM authentication (--proxy-anyauth)
* Automatic proxy detection

## Configuration File Location

All settings are stored in INI files in the SVM installation directory. The active configuration file matches the executable name:

* Executable: `svm.exe` → Configuration: `svm.ini`
* Executable: `svm_pro.exe` → Configuration: `svm_pro.ini`

<Note>
  A clean configuration template is available as `svm_virgen.ini` for creating new configurations from scratch.
</Note>

## License Configuration

SVM is available in two licensing modes:

### Freeware License

* Personal use only
* Full feature access for individual security analysts
* No server/multi-user features

### Professional License

* Commercial use authorized
* Multi-user server capabilities
* Encrypted client-server communication
* Team collaboration features

<Warning>
  The freeware version should only be used for personal purposes. Commercial use requires purchasing a Professional license. Contact [contacto@simplevulnerabilitymanager.com](mailto:contacto@simplevulnerabilitymanager.com) for licensing information.
</Warning>


# Report Templates
Source: https://simplevulnerabilitymanager-svm.mintlify.app/configuration/templates

Customize Word report templates with styles, risk level colors, and formatting options for professional vulnerability reports

Simple Vulnerability Manager generates professional vulnerability reports using customizable Microsoft Word templates. This guide covers template configuration, style customization, and risk level color schemes.

## Template Overview

SVM uses Word templates (.docx or .dot files) to generate three types of reports:

* **Technical Report** (Informe Técnico) - Detailed technical findings for security teams
* **Executive Report** (Informe Ejecutivo) - High-level summary for management
* **Generic Report** (Informe Genérico) - Customizable general-purpose report

<Note>
  The report type is automatically appended to the filename when generating reports (added in version 1.1.791).
</Note>

## Template Configuration

### Selecting a Template

<Steps>
  <Step title="Access Template Configuration">
    Navigate to **Configuration** → **Reports** → **Template**
  </Step>

  <Step title="Browse for Template">
    Click the browse button to select your Word template file.
  </Step>

  <Step title="Edit Template">
    Double-click the template path to open it directly in Microsoft Word for editing (behavior changed in version 2.0.0).
  </Step>
</Steps>

<Warning>
  In version 2.0.0, the template opening behavior changed. Double-clicking now opens the actual template file for editing, not a new document based on the template. All changes are saved directly to the template.
</Warning>

### Template Requirements

Your Word template must include:

* Predefined paragraph styles for headings
* Table styles for vulnerability listings
* Placeholder variables for dynamic content
* Proper page layout and margins

## Style Extraction

SVM automatically extracts available styles from your template.

### Title Styles

<Steps>
  <Step title="Open Template">
    Load your template in the configuration dialog.
  </Step>

  <Step title="Extract Title Styles">
    SVM reads all available heading and title styles from the template (added in version 2.0.0).
  </Step>

  <Step title="Assign Title Style">
    Select which style to use for section titles:

    * Heading 1
    * Heading 2
    * Title\_SVM (recommended)
    * Custom styles
  </Step>
</Steps>

### Table Styles

<Steps>
  <Step title="Extract Table Styles">
    SVM automatically reads all table styles defined in your Word template.
  </Step>

  <Step title="Assign Risk Level Styles">
    Assign a different table style to each risk level:

    * **Critical**: Bold, red-themed table
    * **High**: Orange or dark red table
    * **Medium**: Yellow or amber table
    * **Low**: Blue or green table
    * **Informational**: Gray or light blue table
  </Step>
</Steps>

<Note>
  The ability to assign different table styles per risk level was introduced in version 2.0.0, enabling better visual distinction between vulnerability severities.
</Note>

## Risk Level Color Customization

### Configuring Risk Colors

SVM allows complete customization of risk level colors for both tables and statistical charts.

<Steps>
  <Step title="Access Color Configuration">
    Navigate to **Configuration** → **Reports** → **Risk Colors**
  </Step>

  <Step title="Select Risk Level">
    Choose the risk level to customize:

    * Critical
    * High
    * Medium
    * Low
    * Informational
  </Step>

  <Step title="Choose Color">
    Click the color selector to open the standard Windows color picker dialog (changed in version 2.0.2 for better compatibility).
  </Step>

  <Step title="Copy RGB Code">
    Use the "Copy RGB Code" button to copy color values for use in statistical charts (added in version 2.0.0).
  </Step>
</Steps>

### Color Application

Risk colors are applied to:

* **Vulnerability tables**: Background colors for risk level indicators
* **Statistical charts**: Pie charts and bar graphs showing vulnerability distribution
* **Summary sections**: Visual risk indicators in executive summaries

<Note>
  Color indicators showing your selected colors for statistical charts were added in version 2.0.0, making it easier to ensure consistent color schemes across your reports.
</Note>

### Recommended Color Schemes

#### Traditional Security Colors

```
Critical:    RGB(192, 0, 0)     - Dark Red
High:        RGB(255, 102, 0)   - Orange
Medium:      RGB(255, 192, 0)   - Amber/Yellow
Low:         RGB(0, 176, 80)    - Green
Info:        RGB(0, 112, 192)   - Blue
```

#### High Contrast Scheme

```
Critical:    RGB(139, 0, 0)     - Dark Red
High:        RGB(255, 69, 0)    - Red-Orange
Medium:      RGB(255, 215, 0)   - Gold
Low:         RGB(50, 205, 50)   - Lime Green
Info:        RGB(70, 130, 180)  - Steel Blue
```

#### Colorblind-Friendly Scheme

```
Critical:    RGB(213, 94, 0)    - Vermillion
High:        RGB(230, 159, 0)   - Orange
Medium:      RGB(240, 228, 66)  - Yellow
Low:         RGB(0, 158, 115)   - Bluish Green
Info:        RGB(86, 180, 233)  - Sky Blue
```

## Template Variables

SVM supports dynamic variables that are replaced when generating reports.

### Project Variables

* `[Proyecto]` - Project name (can be used in vulnerability details as of version 1.1.789)
* `[Cliente]` - Client name
* `[Fecha]` - Report generation date
* `[Titulo]` - Report title
* `[Subtitulo]` - Report subtitle

### Vulnerability Variables

* `[NombreVulnerabilidad]` - Vulnerability name
* `[Riesgo]` - Risk level (Critical, High, Medium, Low, Info)
* `[Descripcion]` - Vulnerability description
* `[Impacto]` - Impact assessment
* `[Solucion]` - Remediation steps
* `[IP]` - Affected IP address
* `[Web]` - Affected web URL
* `[Evidencia]` - Evidence screenshots and notes
* `[Request]` - HTTP request details
* `[Response]` - HTTP response details

<Note>
  The `[Subtitulo]` variable replacement was fixed in version 2.0.2 to properly display the subtitle value in generated reports.
</Note>

### Variable Usage in Templates

```
# Vulnerability Report for [Proyecto]
Client: [Cliente]
Date: [Fecha]

## [Titulo]
[Subtitulo]

### Vulnerability: [NombreVulnerabilidad]
Risk Level: [Riesgo]

Description:
[Descripcion]

Impact:
[Impacto]

Remediation:
[Solucion]
```

## Report Structure Configuration

### Report Types

<Steps>
  <Step title="Select Report Type">
    In the configuration dialog, choose the report type to configure:

    * Technical Report
    * Executive Report
    * Generic Report
  </Step>

  <Step title="Configure Sections">
    The configuration interface properly shows/hides textboxes when changing report types (fixed in version 1.1.788).
  </Step>

  <Step title="Save Configuration">
    Use **Ctrl+S** shortcut to quickly save report configuration (added in version 1.1.788).
  </Step>
</Steps>

### Statistical Charts

<Steps>
  <Step title="Enable Statistical Charts">
    Navigate to **Configuration** → **Reports** → **Statistical Charts**
  </Step>

  <Step title="Configure Chart Options">
    Select which statistical visualizations to include:

    * Vulnerability distribution by risk level
    * Vulnerabilities by category
    * Affected systems summary
  </Step>

  <Step title="Verify Color Settings">
    The configuration properly saves the statistical chart option (fixed in version 2.0.3).
  </Step>
</Steps>

<Warning>
  A bug in version 2.0.2 and earlier prevented the statistical charts configuration from being saved correctly. Ensure you're using version 2.0.3 or later for reliable chart configuration.
</Warning>

## Evidence Placement

### Evidence Position Configuration

Evidence placement was reorganized in version 2.0.0:

* **Old behavior**: Evidence placed above vulnerability description
* **New behavior**: Evidence placed below vulnerability description for better readability

This provides a more logical flow:

1. Vulnerability name and risk level
2. Description of the vulnerability
3. Impact assessment
4. Remediation steps
5. Evidence (screenshots, requests/responses)

## Template Compatibility

### Word Template Format

SVM supports the new Word template format introduced in version 2.0.3:

* **Template Name**: `Titulo_SVM`
* **Compatibility**: Better support for English and Spanish versions of Microsoft Word
* **Format**: .docx or .dot

<Note>
  The new template format ensures consistent rendering across different language versions of Microsoft Word, resolving formatting issues present in earlier versions.
</Note>

### Large Report Handling

For reports exceeding 200 pages:

<Steps>
  <Step title="Enable Large Report Mode">
    SVM automatically detects large reports during generation.
  </Step>

  <Step title="Avoid Word Busy Errors">
    Version 1.1.792 fixed the "This action cannot be completed because the other application is busy" error for large reports.
  </Step>

  <Step title="Monitor Generation">
    Large report generation may take several minutes. Do not interrupt the process.
  </Step>
</Steps>

<Warning>
  When generating very large reports (200+ pages), do not switch to other applications or use Word while SVM is generating the report. Version 1.1.792 improved handling, but Word can still become unresponsive if interrupted.
</Warning>

## Template Editing Best Practices

### Preserving Template Integrity

<Steps>
  <Step title="Create a Backup">
    Always create a backup of your template before making significant changes.
  </Step>

  <Step title="Test with Sample Data">
    Generate a test report with a few vulnerabilities to verify formatting before using with large projects.
  </Step>

  <Step title="Maintain Variable Syntax">
    Ensure variable placeholders maintain exact syntax (case-sensitive, brackets included).
  </Step>
</Steps>

### Style Management

<Steps>
  <Step title="Define Clear Style Names">
    Use descriptive style names that indicate their purpose (e.g., "VulnTable\_Critical", "VulnTable\_High").
  </Step>

  <Step title="Lock Style Definitions">
    In Word, lock style definitions to prevent accidental modifications during report generation.
  </Step>

  <Step title="Use Built-in Styles">
    Base custom styles on Word built-in styles for maximum compatibility.
  </Step>
</Steps>

### Table Formatting

Create separate table styles for each risk level:

```
Style Name: VulnTable_Critical
- Border: 2pt solid, RGB(192, 0, 0)
- Header Row: Dark red background, white text
- Alternate Rows: Light red shading

Style Name: VulnTable_High  
- Border: 2pt solid, RGB(255, 102, 0)
- Header Row: Orange background, white text
- Alternate Rows: Light orange shading

[Continue for Medium, Low, Info...]
```

## Temporary File Handling

### Word Temporary Files

<Steps>
  <Step title="Understand Temporary File Usage">
    SVM creates temporary Word files during report generation.
  </Step>

  <Step title="Avoid File Locks">
    Version 2.1.0 fixed issues where opening temporary Word files could hang the program in certain cases.
  </Step>

  <Step title="Automatic Cleanup">
    SVM automatically cleans up temporary files after report generation completes.
  </Step>
</Steps>

<Note>
  If SVM or Word crashes during report generation, manually delete temporary files from your system's temp directory.
</Note>

## Multi-Language Template Support

### Creating Multi-Language Templates

SVM supports three interface languages, and templates should be localized accordingly:

<Steps>
  <Step title="Create Language-Specific Templates">
    Maintain separate templates for each language:

    * `template_en.docx` - English
    * `template_es.docx` - Spanish
    * `template_ru.docx` - Russian
  </Step>

  <Step title="Localize Static Text">
    Translate all static text in the template (headers, labels, instructions).
  </Step>

  <Step title="Keep Variables Unchanged">
    Variable placeholders (`[Proyecto]`, `[Riesgo]`, etc.) remain the same across all language templates.
  </Step>
</Steps>

### Language-Specific Formatting

Consider language-specific formatting requirements:

* **Russian**: Requires proper Cyrillic font support (Unicode support added in version 2.1.0)
* **Spanish**: Include proper accented characters (á, é, í, ó, ú, ñ)
* **English**: Standard Latin character set

<Note>
  Full Unicode support introduced in version 2.1.0 ensures proper rendering of all characters across all supported languages.
</Note>

## Advanced Template Features

### Conditional Sections

While SVM doesn't natively support conditional sections, you can work around this:

<Steps>
  <Step title="Create Multiple Templates">
    Maintain different templates for different report scenarios (web-only, network-only, comprehensive).
  </Step>

  <Step title="Select Template Per Report">
    Choose the appropriate template when configuring each report generation.
  </Step>
</Steps>

### Custom Branding

<Steps>
  <Step title="Add Company Logo">
    Insert your company logo in the template header or footer.
  </Step>

  <Step title="Configure Color Scheme">
    Match risk level colors to your corporate color scheme while maintaining clear risk distinction.
  </Step>

  <Step title="Add Contact Information">
    Include company contact details, website, and social media in the template footer.
  </Step>
</Steps>

### Screenshot Integration

Evidence screenshots are automatically inserted into the template:

* Screenshots maintain aspect ratio
* Maximum width: Page width minus margins
* Automatic placement below vulnerability description
* Support for multiple screenshots per vulnerability

<Note>
  Version 2.1.2 added drag-and-drop support for adding images to evidence and project screenshots, making evidence collection more efficient.
</Note>

## Troubleshooting Templates

### Common Template Issues

<Warning>
  **Invalid Characters in Filenames**: Version 2.1.2 fixed an error when generating Word reports if the project name contained invalid filename characters. The system now automatically sanitizes filenames.
</Warning>

### Template Errors

If report generation fails:

1. **Verify Microsoft Word Installation**: Ensure Word is properly installed and activated
2. **Check Template Integrity**: Open the template manually in Word to verify it's not corrupted
3. **Validate Variable Syntax**: Ensure all variables use correct bracket syntax `[Variable]`
4. **Test with Simple Template**: Try generating a report with a minimal template to isolate the issue
5. **Review Error Messages**: Version 2.0.1 improved error messaging when Word/Excel is not installed

### Style Recognition Issues

If styles aren't appearing in SVM:

<Steps>
  <Step title="Reload Template">
    Close and reopen the configuration dialog to force a template reload.
  </Step>

  <Step title="Check Style Scope">
    Ensure styles are document-level, not character-level or paragraph-specific.
  </Step>

  <Step title="Verify Template Path">
    Confirm the template path in configuration points to the correct file.
  </Step>
</Steps>

## Report Generation Optimization

### Performance Tips

For faster report generation:

1. **Minimize Template Complexity**: Use simple formatting where possible
2. **Optimize Images**: Compress evidence screenshots before adding to SVM
3. **Limit Chart Complexity**: Statistical charts with many data points take longer to render
4. **Close Other Applications**: Free up system resources during large report generation

### Batch Report Generation

When generating multiple reports:

<Steps>
  <Step title="Configure Template Once">
    Set up your template configuration and save it before starting batch operations.
  </Step>

  <Step title="Generate Sequentially">
    Generate reports one at a time to avoid resource conflicts with Microsoft Word.
  </Step>

  <Step title="Monitor Progress">
    Watch the SVM status bar for progress updates during generation.
  </Step>
</Steps>

<Note>
  SVM's report configuration is persistent across sessions, so you only need to configure templates and styles once per report type.
</Note>


# Project Management
Source: https://simplevulnerabilitymanager-svm.mintlify.app/features/project-management

Create and manage security assessment projects for vulnerability tracking

# Project Management

Simple Vulnerability Manager enables you to create and manage dedicated projects for each client's security assessment. Projects serve as containers for organizing vulnerabilities, evidence, screenshots, and custom comments related to specific web applications and IP addresses.

## Overview

Projects are the foundation of SVM's workflow. Each project represents a security assessment for a specific client or system, allowing you to:

* Organize vulnerabilities by web applications and IP addresses
* Add personalized comments and evidence for each finding
* Attach screenshots as individual proof for detected vulnerabilities
* Generate comprehensive reports from project data
* Track assessment progress and findings over time

<Note>
  You must create or select a project before using most SVM features. The application requires an active project context for vulnerability management and scanning operations.
</Note>

## Creating a New Project

<Steps>
  <Step title="Access Project Creation">
    From the main screen, navigate to the project management section. This is your starting point for all security assessments.
  </Step>

  <Step title="Enter Project Details">
    Provide the following information for your new project:

    * **Project Name**: A descriptive name for the security assessment
    * **Client Information**: Details about the client or organization
    * **Assessment Scope**: Web URLs and IP addresses to be tested
    * **Notes**: Additional context or special instructions

    <Warning>
      Project names cannot contain characters that are invalid for filenames (e.g., `<`, `>`, `:`, `"`, `/`, `\`, `|`, `?`, `*`). The system will prevent report generation if invalid characters are used.
    </Warning>
  </Step>

  <Step title="Configure Web Addresses">
    Add web applications to your project:

    * Enter the full URL including protocol (`http://` or `https://`)
    * Multiple web addresses can be added to a single project
    * Web addresses are used for launching web scanner tools

    <Note>
      Web addresses must include the protocol (`http://` or `https://`) to properly launch scanning tools like Acunetix, Burp Suite, Netsparker, and Arachni.
    </Note>
  </Step>

  <Step title="Add IP Addresses">
    Configure the IP addresses or domains for service scanning:

    * Individual IP addresses (e.g., `192.168.1.100`)
    * IP ranges (e.g., `192.168.1.1-192.168.1.100`)
    * Domain names (e.g., `example.com`)
    * Multiple entries can be added per project

    <Warning>
      When using Qualys External scanning, note that private IP addresses cannot be scanned from external Qualys instances.
    </Warning>
  </Step>

  <Step title="Save the Project">
    Save your project to make it active and begin the vulnerability assessment process.
  </Step>
</Steps>

## Managing Project Assets

### Adding Web Applications

Web applications are the targets for web vulnerability scanners:

<Tabs>
  <Tab title="Single URL">
    Add individual web applications by entering the complete URL:

    ```
    https://www.example.com
    http://app.example.com:8080
    ```
  </Tab>

  <Tab title="Multiple URLs">
    Add multiple web applications to test different parts of your client's infrastructure:

    * Main website
    * Admin panels
    * API endpoints
    * Staging environments
  </Tab>

  <Tab title="Subdomain Support">
    Use tools like Recon-ng for domain reconnaissance:

    * Domains can be entered without protocol for Recon-ng
    * Automatically discovers subdomains and related infrastructure
    * Integrates with API services (SHODAN, IPInfoDB, etc.)
  </Tab>
</Tabs>

### Managing IP Addresses

<Accordion title="IP Address Formats">
  SVM supports multiple IP address formats:

  * **Single IP**: `192.168.1.100`
  * **IP Range**: `192.168.1.1-192.168.1.100`
  * **Domain Names**: `example.com` (will be resolved to IP)
  * **CIDR Notation**: Compatible with Nmap scanning

  <Note>
    The DNS resolver feature can automatically convert domain names to IP addresses for service scanning.
  </Note>
</Accordion>

<Accordion title="Nmap Integration">
  Launch Nmap scans directly against project web addresses and domains:

  * Scan web/domain targets from your project
  * Execute with a single click from the tools menu
  * Results can be imported into the project for documentation

  Since version 2.0.3, you can launch Nmap scans against web/domain entries in your project.
</Accordion>

## Adding Evidence and Screenshots

### Drag and Drop Support

Starting from version 2.1.2, SVM supports drag-and-drop functionality for adding visual evidence:

<Steps>
  <Step title="Prepare Your Screenshots">
    Capture screenshots of vulnerabilities during your security assessment:

    * Browser screenshots showing XSS or injection flaws
    * Tool output demonstrating service vulnerabilities
    * Proof-of-concept images
  </Step>

  <Step title="Drag and Drop">
    Simply drag image files from your file explorer and drop them into:

    * **Evidence Fields**: For individual vulnerability proof
    * **Project Screenshots**: For general project documentation
  </Step>

  <Step title="Add Comments">
    Provide context for each piece of evidence:

    * Explain what the screenshot demonstrates
    * Describe the impact of the finding
    * Reference the specific test case or scenario
  </Step>
</Steps>

### Evidence Best Practices

<Note>
  Personalized comments and screenshots serve as individual evidence for each vulnerability detected on web addresses and IP addresses. Quality evidence strengthens your security assessment reports.
</Note>

Recommended evidence to capture:

1. **Request/Response Data**: HTTP requests showing the vulnerability
2. **Visual Proof**: Screenshots of successful exploitation
3. **Tool Output**: Scanner results confirming the finding
4. **Impact Demonstration**: Evidence of potential damage or data exposure

## Project Fields and Customization

### Extended Text Capacity

Since version 2.1.0, SVM expanded the text capacity for several project fields:

* **IP Addresses**: Store extensive IP ranges and network segments
* **Web Addresses**: Document multiple applications and endpoints
* **Notes**: Add comprehensive assessment notes and context
* **Request Data**: Capture full HTTP requests
* **Response Data**: Store complete HTTP responses

<Accordion title="Unicode Support">
  Full Unicode support (added in version 2.1.0) enables:

  * Multi-language project documentation
  * International client names and addresses
  * Special characters in comments and notes
  * Non-ASCII characters in evidence descriptions

  This makes SVM suitable for international security assessments and multi-regional deployments.
</Accordion>

## Project Workflow

### Complete Assessment Workflow

<Steps>
  <Step title="Project Setup">
    Create the project and configure all target assets (web addresses and IP addresses).
  </Step>

  <Step title="Automated Scanning">
    Launch integrated scanning tools:

    * **Web Scanners**: Acunetix, Burp Suite, Netsparker, Arachni
    * **Service Scanners**: Qualys, Nessus, OpenVAS, Nmap
    * **Mobile Tools**: MobSF, QARK, AndroBugs Framework
    * **Reconnaissance**: Recon-ng, EyeWitness
  </Step>

  <Step title="Import Vulnerabilities">
    Import scan results and add vulnerabilities from the database to your project.
  </Step>

  <Step title="Add Evidence">
    For each vulnerability:

    * Attach relevant screenshots
    * Add personalized comments explaining the context
    * Include request/response data
    * Document the specific impact for this client
  </Step>

  <Step title="Generate Reports">
    Create professional Word reports using customizable templates. See the [Report Generation](/features/report-generation) guide for details.
  </Step>
</Steps>

## SVM Pro Features

<Accordion title="Server Synchronization">
  SVM Pro includes advanced project management features:

  * **Centralized Storage**: Projects stored on SVM server
  * **Team Collaboration**: Multiple analysts can work on the same project
  * **Import from Web**: Download projects directly from the SVM web interface
  * **Encrypted Transfer**: Compressed and encrypted data transfer (version 2.0.2+)
  * **Remote Access**: Access projects from any SVM Pro client

  <Note>
    You can test SVM Pro features using the demo server:

    * Server: `svm.myddns.me`
    * Port: `8444`
    * Token: `svm_demo`
  </Note>
</Accordion>

<Accordion title="Standalone vs. Professional">
  Starting from version 2.1.0, you can run both versions simultaneously:

  * The executable name (`svm.exe`) is associated with the configuration file (`svm.ini`)
  * This allows running both Standalone and Professional versions at the same time
  * Each instance maintains separate project databases and configurations
</Accordion>

## Troubleshooting

<Accordion title="Project Access Issues">
  **Problem**: Cannot access vulnerability management features

  **Solution**: Ensure you have created or selected a project. Most SVM features require an active project context. This requirement was enforced starting in version 1.1.792.
</Accordion>

<Accordion title="IP Range Format Errors">
  **Problem**: Errors when using IP ranges in search or scanning

  **Solution**: Ensure IP ranges use the correct format `192.168.1.1-192.168.1.100`. The hyphen character handling was fixed in version 1.1.792.
</Accordion>

<Accordion title="Connection Issues (Wine/Linux/MacOS)">
  **Problem**: Lost connection to SVM Pro server on Wine

  **Solution**: Updated connection handling was implemented in version 2.1.0 to improve stability on Wine (Linux/MacOS). Ensure you're using the latest version.
</Accordion>

## Related Documentation

* [Vulnerability Database](/features/vulnerability-database) - Learn about available vulnerability categories
* [Report Generation](/features/report-generation) - Create professional reports from your projects


# Report Generation
Source: https://simplevulnerabilitymanager-svm.mintlify.app/features/report-generation

Generate professional Word reports with customizable templates

# Report Generation

Simple Vulnerability Manager enables you to generate professional, comprehensive security assessment reports in Microsoft Word format. The report generation system uses customizable templates and supports multiple report types with advanced formatting options.

## Overview

SVM's reporting engine transforms your project data into polished Word documents:

* **Template-Based**: Uses customizable Word templates (`.dotx` format)
* **Multiple Report Types**: Technical, Executive, and Generic reports
* **Automated Formatting**: Applies styles, tables, and formatting automatically
* **Variable Substitution**: Dynamic content based on project data
* **Statistical Graphics**: Optional charts and graphs showing vulnerability distribution
* **Risk-Based Styling**: Different table styles for each risk level

<Note>
  Report generation requires Microsoft Word to be installed on your system. Since version 2.0.2, SVM provides better error handling when Office is not available.
</Note>

## Report Template

### Template\_SVM.dotx

The default Word template (`Template_SVM.dotx`) serves as the foundation for all generated reports. This template includes:

* Pre-defined heading styles
* Table formatting styles
* Document structure and layout
* Header and footer configurations
* Custom variables for dynamic content

<Warning>
  Starting from version 2.0.3, SVM uses a new template title style called "Titulo\_SVM" for better compatibility with both English and Spanish versions of Microsoft Word.
</Warning>

### Customizing the Template

<Steps>
  <Step title="Open Template for Editing">
    Navigate to Configuration > Reports and double-click the template file.

    <Note>
      Since version 2.0.0, double-clicking the template opens the actual template file for editing, not a new document based on the template.
    </Note>
  </Step>

  <Step title="Modify Styles and Formatting">
    Customize the template to match your organization's branding:

    * **Heading Styles**: Configure Title, Heading 1, Heading 2, etc.
    * **Table Styles**: Create custom table formats for vulnerability listings
    * **Colors and Fonts**: Match your corporate identity
    * **Logo and Headers**: Add company branding elements
    * **Page Layout**: Margins, orientation, and page size
  </Step>

  <Step title="Configure Style Extraction">
    SVM automatically extracts styles from your template:

    * Opens and reads the template file
    * Extracts all heading style formats (Titulo\_SVM, Heading 1, Heading 2, etc.)
    * Extracts all table style formats
    * Displays available styles in configuration interface

    <Note>
      Style extraction was introduced in version 2.0.0, allowing you to see exactly which styles are available in your template.
    </Note>
  </Step>

  <Step title="Save Template">
    Save your customized template as a `.dotx` file and configure SVM to use it in the Reports settings.
  </Step>
</Steps>

### Template Variables

The template supports dynamic variables that are replaced with actual project data during report generation:

<Accordion title="Available Variables">
  Common template variables include:

  * `[Proyecto]` - Project name (can be used in vulnerability details since version 1.1.789)
  * `[Cliente]` - Client name
  * `[Fecha]` - Assessment date
  * `[Subtitulo]` - Subtitle (replacement fixed in version 2.0.2)
  * `[Web]` - Web addresses from project
  * `[IP]` - IP addresses from project
  * `[Analista]` - Analyst name
  * `[Empresa]` - Company name

  Variables are case-sensitive and must be enclosed in square brackets.
</Accordion>

<Accordion title="Using Variables in Templates">
  Place variables anywhere in your template:

  ```
  Security Assessment Report

  Project: [Proyecto]
  Client: [Cliente]
  Date: [Fecha]

  This security assessment was performed on the following assets:
  Web Applications: [Web]
  IP Addresses: [IP]
  ```

  During report generation, these variables will be replaced with actual data from your project.
</Accordion>

## Report Types

SVM supports three types of security assessment reports:

<Tabs>
  <Tab title="Technical Report">
    **Informe Técnico (Technical Report)**

    Comprehensive technical documentation for IT and security teams:

    * Detailed vulnerability descriptions
    * Technical exploitation details
    * Full request/response data
    * Step-by-step remediation instructions
    * Evidence screenshots with technical annotations
    * CVSS scores and technical metrics
    * Proof-of-concept demonstrations

    Best for: Security engineers, system administrators, developers
  </Tab>

  <Tab title="Executive Report">
    **Informe Ejecutivo (Executive Report)**

    High-level summary for management and executives:

    * Executive summary of findings
    * Risk assessment and business impact
    * Statistical charts and graphs
    * Prioritized recommendations
    * Compliance implications
    * Reduced technical jargon
    * Focus on business risk

    Best for: C-level executives, management, board members
  </Tab>

  <Tab title="Generic Report">
    **Informe Genérico (Generic Report)**

    Balanced report suitable for mixed audiences:

    * Moderate technical detail
    * Clear vulnerability descriptions
    * Business and technical impact
    * Practical remediation guidance
    * Supporting evidence
    * Accessible to both technical and non-technical readers

    Best for: Mixed audiences, general documentation
  </Tab>
</Tabs>

<Note>
  Since version 1.1.791, the report filename includes the report type ("Informe Técnico", "Informe Ejecutivo", or "Informe Genérico") for easier identification.
</Note>

## Configuring Report Settings

### Risk-Based Table Formatting

One of SVM's most powerful features is the ability to apply different table styles based on vulnerability risk level:

<Steps>
  <Step title="Access Report Configuration">
    Navigate to Configuration > Reports (Opciones/Configuración)
  </Step>

  <Step title="Select Template">
    Choose your Word template (`.dotx` file). SVM will automatically extract available styles.
  </Step>

  <Step title="Assign Risk Colors">
    Configure custom colors for each risk level:

    * Critical (default: Dark Red)
    * High (default: Red)
    * Medium (default: Orange)
    * Low (default: Yellow)
    * Informational (default: Blue)

    <Note>
      Since version 2.0.0, you can select custom RGB colors for each risk level using a standard Windows color picker. Color indicators display your selected colors in the configuration interface.
    </Note>
  </Step>

  <Step title="Assign Table Styles">
    Map Word table styles to risk levels:

    * Each risk level can have a different table style
    * Styles are extracted from your Word template
    * Allows visual differentiation in reports
    * Creates professional, color-coded vulnerability tables

    <Note>
      Table style assignment per risk level was introduced in version 2.0.0, enabling sophisticated report formatting.
    </Note>
  </Step>

  <Step title="Configure Heading Styles">
    Select which heading styles to use for different report sections from the styles available in your template.
  </Step>

  <Step title="Save Configuration">
    Save your report settings. Use **Ctrl+S** shortcut (added in version 1.1.788) for quick saves.
  </Step>
</Steps>

### Statistical Graphics

<Accordion title="Enabling Charts and Graphs">
  Configure statistical graphics to visualize vulnerability distribution:

  * **Vulnerability Count by Risk**: Bar or pie charts showing risk distribution
  * **Vulnerability Types**: Charts categorizing by vulnerability class
  * **Custom Colors**: Graphics use your configured risk level colors
  * **Color Indicators**: Preview your selected colors in configuration

  <Note>
    Color indicators for statistical graphics were added in version 2.0.0 to preview how charts will appear in reports.
  </Note>
</Accordion>

## Generating Reports

### Report Generation Workflow

<Steps>
  <Step title="Complete Project Assessment">
    Ensure your project includes:

    * All detected vulnerabilities
    * Evidence screenshots for each finding
    * Personalized comments and context
    * Request/response data where applicable
    * Project metadata (client, dates, scope)
  </Step>

  <Step title="Select Report Type">
    Choose the appropriate report type based on your audience:

    * Technical for security teams
    * Executive for management
    * Generic for mixed audiences
  </Step>

  <Step title="Configure Report Options">
    Set report-specific options:

    * Include/exclude statistical graphics
    * Select which vulnerability categories to include
    * Configure evidence placement
    * Choose detail level
  </Step>

  <Step title="Generate Report">
    Click Generate Report to create the Word document.

    <Note>
      For very large reports (>200 pages), report generation may take some time. A fix in version 1.1.792 addresses timeout issues with large reports.
    </Note>
  </Step>

  <Step title="Review and Customize">
    The generated Word document can be further customized:

    * Manual edits to content
    * Additional formatting adjustments
    * Adding custom sections
    * Final quality review
  </Step>
</Steps>

### Report Structure

Generated reports follow this typical structure:

1. **Cover Page**: Project name, client, date
2. **Executive Summary**: High-level findings and recommendations
3. **Scope and Methodology**: Assessment details and approach
4. **Statistical Overview**: Charts and graphs (if enabled)
5. **Vulnerability Findings**: Detailed vulnerability listings by risk level
   * Description
   * Impact assessment
   * Evidence (screenshots, request/response)
   * Remediation steps
   * Custom comments
6. **Conclusion and Recommendations**: Summary and prioritized actions
7. **Appendices**: Supporting documentation

<Note>
  Since version 2.0.0, vulnerability evidence is placed below the vulnerability description instead of above, providing better report flow.
</Note>

## Advanced Features

### Evidence Placement

<Accordion title="Screenshot and Evidence Handling">
  Evidence is automatically formatted in reports:

  * Screenshots are inserted as images
  * Maintains aspect ratio and reasonable sizing
  * Caption with evidence description
  * Request/response data in formatted code blocks
  * Custom comments integrated into vulnerability description

  <Note>
    Evidence placement was improved in version 2.0.0, moving it below vulnerability descriptions for better readability.
  </Note>
</Accordion>

### Multi-language Reports

<Accordion title="Language Support">
  Generate reports in multiple languages:

  * **Spanish**: Original language, full support
  * **English**: Complete translation of report elements
  * **Russian**: Added in version 2.1.0

  Template variables and vulnerability descriptions are rendered in the selected language.

  <Note>
    Full Unicode support (version 2.1.0) ensures proper rendering of all characters in multi-language reports.
  </Note>
</Accordion>

### Temporary File Handling

<Warning>
  When Word generates temporary files during report creation, SVM properly manages these files. A fix in version 2.1.0 resolved cases where the application could hang when Word created temporary files.
</Warning>

## Troubleshooting

<Accordion title="Microsoft Word Not Installed">
  **Problem**: Error when generating reports

  **Solution**: SVM requires Microsoft Word to be installed. Since version 2.0.2, the application provides clear error messages when Office is not available. Install Microsoft Office or ensure Word is properly installed.
</Accordion>

<Accordion title="Template Variable Not Replaced">
  **Problem**: Variables like \[Subtitulo] appear in the report instead of actual values

  **Solution**: Ensure variable names are spelled correctly and use the exact case. The \[Subtitulo] replacement bug was fixed in version 2.0.2.
</Accordion>

<Accordion title="Invalid Filename Error">
  **Problem**: Report generation fails with filename error

  **Solution**: Project names cannot contain invalid filename characters (`<`, `>`, `:`, `"`, `/`, `\`, `|`, `?`, `*`). This validation was added in version 2.1.2. Rename your project to use only valid characters.
</Accordion>

<Accordion title="Large Report Timeout">
  **Problem**: Application freezes or shows "other application is busy" message for large reports

  **Solution**: For reports larger than 200 pages, generation may take several minutes. A fix in version 1.1.792 improved handling of large reports. Ensure Word is not blocked and wait for completion.
</Accordion>

<Accordion title="Table Styles Not Applied">
  **Problem**: Risk-based table styles don't appear in generated reports

  **Solution**:

  * Ensure your Word template contains the table styles you've configured
  * Re-extract styles by opening the template in Configuration
  * Verify table style assignments match available styles in template
  * Check template compatibility (Titulo\_SVM style should be present for version 2.0.3+)
</Accordion>

<Accordion title="Excel Export Issues">
  **Problem**: Cannot export vulnerability data to Excel

  **Solution**: Excel export requires Microsoft Excel to be installed. The application was updated in version 2.0.2 to better handle cases where Excel is not available. Ensure Microsoft Excel is properly installed.
</Accordion>

## Report Quality Best Practices

<Accordion title="Effective Report Writing">
  To create high-quality security assessment reports:

  1. **Complete Evidence**: Include comprehensive screenshots and proof for each finding
  2. **Clear Comments**: Write clear, project-specific comments explaining impact
  3. **Consistent Naming**: Use consistent vulnerability names across projects
  4. **Risk Accuracy**: Assign appropriate risk levels based on actual impact
  5. **Context Matters**: Explain why each vulnerability matters to this specific client
  6. **Remediation Focus**: Provide actionable, specific remediation steps
  7. **Professional Formatting**: Use your customized template consistently
  8. **Quality Review**: Always review generated reports before delivery
</Accordion>

<Accordion title="Template Maintenance">
  Keep your report templates effective:

  * Regularly update branding and styling
  * Test template with sample data before using in production
  * Maintain backup copies of working templates
  * Document custom variables and their usage
  * Ensure compatibility with Word versions used by clients
  * Use Titulo\_SVM style for maximum compatibility
</Accordion>

## Export and Sharing

### Report Formats

Generated reports are created as Word documents (`.docx` format):

* Can be converted to PDF for distribution
* Editable for final customization
* Compatible with Microsoft Word 2007 and later
* Can be shared via email or document management systems

### Backup and Archiving

<Note>
  SVM supports database backup functionality for archiving projects and reports. On Windows, Linux, and MacOS (via Wine), you can create backups of your local database containing all projects, vulnerabilities, and evidence.
</Note>

## Related Documentation

* [Project Management](/features/project-management) - Learn how to structure projects for reporting
* [Vulnerability Database](/features/vulnerability-database) - Understand vulnerability categorization and details


# Vulnerability Database
Source: https://simplevulnerabilitymanager-svm.mintlify.app/features/vulnerability-database

Comprehensive database of recognized vulnerabilities organized by scanner type

# Vulnerability Database

Simple Vulnerability Manager includes an extensive database containing the most recognized vulnerabilities that computer systems can suffer. The database is organized into four primary categories based on assessment methodology: Web Scanners, Service Scanners, Static Scanners, and Mobile.

## Database Overview

The vulnerability database provides a comprehensive knowledge base for security assessments:

* **Extensive Coverage**: Most recognized vulnerabilities across multiple platforms
* **Categorized Organization**: Grouped by scanner type for easy navigation
* **Detailed Information**: Each vulnerability includes description, impact, and remediation
* **Regular Updates**: Knowledge base receives updates with new vulnerabilities
* **Multi-language Support**: Available in English, Spanish, and Russian

<Note>
  The vulnerability database was significantly expanded in version 1.1.791 with many new translated vulnerabilities added to the knowledge base.
</Note>

## Vulnerability Categories

### Web Scanners

Web scanner vulnerabilities target web applications and include common issues found by tools like Acunetix, Burp Suite, Netsparker, and Arachni.

<Accordion title="Common Web Vulnerabilities">
  Web scanner vulnerabilities typically include:

  * **Injection Flaws**: SQL injection, command injection, LDAP injection
  * **Cross-Site Scripting (XSS)**: Reflected, stored, and DOM-based XSS
  * **Authentication Issues**: Weak credentials, broken authentication mechanisms
  * **Session Management**: Session fixation, weak session IDs
  * **Access Control**: Broken authorization, privilege escalation
  * **Security Misconfigurations**: Default credentials, unnecessary features enabled
  * **Sensitive Data Exposure**: Unencrypted data, weak cryptography
  * **CSRF**: Cross-Site Request Forgery vulnerabilities
  * **Component Vulnerabilities**: Outdated libraries, known vulnerable components

  Each vulnerability entry includes:

  * Brief description explaining what creates the problem
  * Impact assessment on the system
  * Step-by-step remediation instructions
</Accordion>

<Accordion title="Integrated Web Scanning Tools">
  SVM integrates with industry-leading web vulnerability scanners:

  <Tabs>
    <Tab title="Acunetix">
      **Acunetix Support**

      * **Version 10.5**: Local scanning support
      * **Version 11**: Enterprise API scanning (added in version 1.1.792)
      * **Quick Launch**: Execute scans with a single click
      * **Target Management**: Automatic target creation from project web addresses

      <Note>
        Acunetix 11 requires Enterprise license and uses API-based scanning. Legacy Acunetix 10.5 remote support was removed in version 1.1.792.
      </Note>
    </Tab>

    <Tab title="Burp Suite">
      **Burp Suite Integration**

      * Launch Burp Suite directly from project web addresses
      * Configurable executable path
      * Professional and Community Edition support
      * Manual testing workflow integration
    </Tab>

    <Tab title="Netsparker">
      **Netsparker Integration**

      * Automatic scanning of project web targets
      * Single-click execution from SVM interface
      * Results can be imported back into projects
    </Tab>

    <Tab title="Arachni">
      **Arachni Web Application Scanner**

      * Open-source web application security scanner
      * Integrated execution from SVM
      * Scan project web addresses automatically
    </Tab>
  </Tabs>
</Accordion>

### Service Scanners

Service scanner vulnerabilities cover network services, operating systems, and infrastructure issues detected by tools like Qualys, Nessus, OpenVAS, and Nmap.

<Accordion title="Service Vulnerability Types">
  Service scanner vulnerabilities include:

  * **Network Services**: Vulnerable protocols and services (SMB, FTP, SSH, etc.)
  * **Operating System Flaws**: OS-level vulnerabilities and missing patches
  * **Configuration Issues**: Weak configurations, unnecessary services
  * **Missing Updates**: Unpatched systems and outdated software
  * **SSL/TLS Issues**: Weak ciphers, certificate problems, protocol vulnerabilities
  * **Default Credentials**: Factory default passwords still in use
  * **Information Disclosure**: Banner grabbing, version exposure
  * **Denial of Service**: DoS vulnerabilities in network services
</Accordion>

<Accordion title="Integrated Service Scanning Tools">
  <Tabs>
    <Tab title="Qualys">
      **Qualys Integration**

      * **Community Edition**: Free tier support
      * **Enterprise Edition**: Full enterprise features
      * **Configuration Import**: Automatically import scan configurations from Qualys
      * **Private IP Limitation**: External Qualys cannot scan private IP addresses

      <Warning>
        Qualys External scanning does not support private IP addresses (e.g., 192.168.x.x, 10.x.x.x). Use internal scanners or Qualys Private Cloud for internal network assessments.
      </Warning>
    </Tab>

    <Tab title="Nessus">
      **Nessus Support**

      * Compatible with Nessus Professional and Nessus Manager
      * Export reports in XML and HTML formats (version 1.1.792+)
      * Plugin updates directly from SVM (version 1.1.787+)
      * Integration with Nessus 7+ (User-Agent updated in version 1.1.794)

      <Note>
        SVM can update Nessus plugins and retrieve scan configurations directly from the Nessus server interface.
      </Note>
    </Tab>

    <Tab title="OpenVAS">
      **OpenVAS Integration**

      * Open-source vulnerability assessment
      * Local and remote scanning support
      * Plugin management and updates (version 1.1.787+)
      * Script editing capabilities for custom scans
      * Ubuntu for Windows 10 support (version 1.1.792+)
      * Report format configuration import

      <Note>
        OpenVAS remote scripts were updated in version 1.1.792 to support Ubuntu for Windows 10 (WSL).
      </Note>
    </Tab>

    <Tab title="Nmap">
      **Nmap Network Scanner**

      * Port scanning and service detection
      * Scan web/domain addresses from projects (version 2.0.3+)
      * Local and remote execution
      * Remote installation support (version 1.1.788+)
      * Integration with project IP addresses and domains
    </Tab>
  </Tabs>
</Accordion>

### Static Scanners

Static analysis vulnerabilities focus on source code issues and application security flaws found through static code analysis.

<Accordion title="Static Analysis with Fortify">
  **Fortify Integration**

  SVM includes support for Fortify static analysis results:

  * Import Fortify scan results
  * Vulnerability renaming capabilities (fixed in version 2.1.1)
  * Source code security issues
  * Code quality and security best practices

  Static analysis vulnerabilities typically include:

  * Buffer overflows and memory issues
  * Injection vulnerabilities in code
  * Cryptographic weaknesses
  * Poor error handling
  * Insecure configurations in code
</Accordion>

### Mobile Vulnerabilities

Mobile scanner vulnerabilities specifically target Android and iOS applications, focusing on mobile-specific security issues.

<Accordion title="Mobile Security Issues">
  Mobile vulnerabilities include:

  * **Insecure Data Storage**: Sensitive data stored without encryption
  * **Weak Cryptography**: Poor encryption implementations
  * **Insecure Communication**: Unencrypted network traffic
  * **Improper Platform Usage**: Misuse of mobile OS features
  * **Code Quality**: Reverse engineering vulnerabilities
  * **Authentication/Authorization**: Mobile-specific auth issues
  * **Client Code Quality**: Hardcoded secrets, debug code
</Accordion>

<Accordion title="Android Security Tools">
  SVM integrates with comprehensive Android security testing tools:

  <Tabs>
    <Tab title="Analysis Tools">
      **Mobile Application Analysis**

      * **ApkTools** (v2.4.0): APK decompilation and recompilation
      * **Enjarify**: Convert APK to JAR for analysis
      * **JD-Gui** (v1.5.2): Java decompiler for source code review

      <Note>
        Tool versions were updated in version 2.1.0 to the latest stable releases.
      </Note>
    </Tab>

    <Tab title="Security Scanners">
      **Automated Mobile Security Testing**

      * **MobSF**: Mobile Security Framework for comprehensive testing
      * **QARK**: Quick Android Review Kit (LinkedIn's security tool)
      * **AndroBugs Framework**: Android vulnerability scanner

      <Note>
        QARK parameters were updated in version 1.1.793 (removed `--install 0 --exploit 0` flags).
      </Note>
    </Tab>

    <Tab title="Utilities">
      **Supporting Tools**

      * **Android Debug Bridge (adb)** v1.0.39: Device communication
      * **Uber APK Signer** v1.0.0: APK signing for testing

      These tools support the mobile testing workflow including APK manipulation, signing, and device interaction.
    </Tab>
  </Tabs>
</Accordion>

## Using the Vulnerability Database

### Adding Vulnerabilities to Projects

<Steps>
  <Step title="Select Vulnerability Category">
    Choose the appropriate scanner category based on your assessment:

    * Web Scanners for web application testing
    * Service Scanners for network and infrastructure
    * Static Scanners for code analysis results
    * Mobile for Android/iOS application testing
  </Step>

  <Step title="Browse Available Vulnerabilities">
    Review the list of available vulnerabilities in each category.

    Each entry displays:

    * Vulnerability name and identifier
    * Risk level (Critical, High, Medium, Low, Informational)
    * Brief description
  </Step>

  <Step title="Add to Project">
    Select vulnerabilities detected during your assessment and add them to the active project.
  </Step>

  <Step title="Customize Details">
    For each added vulnerability:

    * Add project-specific context and comments
    * Attach screenshots as evidence
    * Include request/response data
    * Document specific impact for the client
  </Step>

  <Step title="Rename if Needed">
    Customize vulnerability names to match your reporting standards using the toolbar rename function (available for all categories).
  </Step>
</Steps>

### Vulnerability Information Structure

Each vulnerability in the database contains three key sections:

<Tabs>
  <Tab title="Description">
    **What Creates the Problem**

    A brief technical description explaining:

    * The nature of the vulnerability
    * How it occurs in systems
    * Technical conditions that create the flaw
    * Common causes and configurations
  </Tab>

  <Tab title="Impact">
    **System Impact Assessment**

    Explains the potential consequences:

    * Confidentiality impact
    * Integrity impact
    * Availability impact
    * Business risk and potential damage
    * Exploitation scenarios
  </Tab>

  <Tab title="Remediation">
    **Steps to Solve It**

    Detailed remediation guidance:

    * Step-by-step fix instructions
    * Configuration changes needed
    * Patch information
    * Best practices for prevention
    * Verification steps
  </Tab>
</Tabs>

## Risk Classification

Vulnerabilities are classified by risk level with customizable color coding:

* **Critical**: Immediate attention required, active exploitation possible
* **High**: Significant risk, should be addressed urgently
* **Medium**: Moderate risk, address in normal remediation cycle
* **Low**: Minor issues, address when convenient
* **Informational**: No direct security impact, awareness only

<Note>
  Risk colors can be customized in the configuration settings. Since version 2.0.0, you can assign custom colors to each risk level and apply different Word table styles per risk category.
</Note>

## Reconnaissance and Information Gathering Tools

SVM includes tools for information gathering that help identify potential vulnerabilities:

<Accordion title="Recon-ng">
  **Recon-ng Integration**

  Web reconnaissance framework for information gathering:

  * Domain enumeration and subdomain discovery
  * Certificate transparency checks (added in version 2.0.1)
  * Google site web searches
  * HackerTarget integration
  * ThreatCrowd intelligence
  * SHODAN API integration
  * IPInfoDB lookups

  <Note>
    Domains can be entered without specifying the protocol when using Recon-ng. API keys for services like SHODAN and IPInfoDB can be configured in the settings.
  </Note>
</Accordion>

<Accordion title="EyeWitness">
  **EyeWitness Screenshot Tool**

  * Automated web application screenshots
  * HTTP/HTTPS service identification
  * Remote installation support
  * Report retrieval and integration

  EyeWitness helps document the visual state of web applications during assessments.
</Accordion>

## Database Management

### Knowledge Base Updates

<Accordion title="Updating Vulnerabilities">
  The vulnerability database receives periodic updates:

  * New vulnerabilities added as they are discovered
  * Existing entries refined with better remediation guidance
  * Multi-language translations (English, Spanish, Russian)
  * Version 1.1.791 included a major knowledge base update

  <Note>
    Starting from version 2.1.0, SVM includes an update feature in Tools menu to update all scripts and internal tools, keeping your security tool integration current.
  </Note>
</Accordion>

<Accordion title="Custom Vulnerabilities">
  You can customize the vulnerability database:

  * Rename vulnerabilities to match your organization's taxonomy
  * Add custom comments and descriptions
  * Create project-specific vulnerability variants
  * Maintain consistency across multiple assessments
</Accordion>

## Exporting and Reporting

### Export Capabilities

<Accordion title="Excel Export">
  Export vulnerability data to Excel for analysis:

  * Complete project vulnerability lists
  * Filtered by risk level (including Critical vulnerabilities - fixed in version 2.1.0)
  * Search results from the vulnerability browser
  * Comprehensive data export for external processing

  <Warning>
    Excel export requires Microsoft Excel to be installed on your system. Proper error handling was added in version 2.0.2.
  </Warning>
</Accordion>

## Language Support

The vulnerability database supports multiple languages:

* **English**: Full vulnerability descriptions and remediation
* **Spanish**: Complete translation (original language)
* **Russian**: Added in version 2.1.0

<Note>
  Full Unicode support (version 2.1.0) ensures proper display of all characters across all supported languages.
</Note>

## Related Documentation

* [Project Management](/features/project-management) - Learn how to organize vulnerabilities in projects
* [Report Generation](/features/report-generation) - Create professional reports from vulnerability data


# Frequently Asked Questions
Source: https://simplevulnerabilitymanager-svm.mintlify.app/help/faq

Common questions and answers about Simple Vulnerability Manager

## General Questions

<Accordion title="What is Simple Vulnerability Manager (SVM)?">
  Simple Vulnerability Manager is a comprehensive tool for vulnerability analysts that enables complete system weakness analysis and report generation. It includes a database of recognized vulnerabilities organized into Web Scanners, Service Scanners, Static Scanners, and Mobile categories.

  Each vulnerability includes:

  * Brief description of the issue
  * System impact assessment
  * Step-by-step resolution instructions
</Accordion>

<Accordion title="What are the main features of SVM?">
  * **Project Management**: Create and manage client projects with personalized comments and screenshots
  * **Vulnerability Database**: Comprehensive database of Web, Service, Static, and Mobile vulnerabilities
  * **Report Generation**: Generate technical and executive reports in Word format
  * **Tool Integration**: One-click execution of external scanning tools
  * **Evidence Management**: Add screenshots and detailed evidence for each vulnerability
  * **Multi-language Support**: Available in Spanish, English, and Russian (v2.1.0+)
</Accordion>

<Accordion title="What scanning tools does SVM integrate with?">
  **Web Scanners:**

  * Acunetix (v10.5 and v11/v12)
  * Burpsuite
  * Netsparker
  * Arachni Web Application

  **Service Scanners:**

  * Qualys Community and Enterprise
  * Nessus
  * OpenVAS
  * Nmap

  **Android Tools:**

  * ApkTools
  * Enjarify
  * JD-Gui
  * MobSF
  * QARK
  * AndroBugs Framework
  * Uber Apk Signer

  **Information Tools:**

  * Recon-ng
  * EyeWitness
</Accordion>

<Accordion title="What is the difference between SVM Free and SVM Pro?">
  **SVM Free:**

  * Freeware license for personal use
  * Local database storage
  * All core scanning and reporting features
  * Open source scripts (.bat and .sh files)

  **SVM Pro:**

  * Professional license required for company use
  * Client-server architecture with remote database
  * Multi-user support with synchronized data
  * Encrypted and compressed data transmission (v2.0.2+)
  * Contact: [contacto@simplevulnerabilitymanager.com](mailto:contacto@simplevulnerabilitymanager.com)

  Demo available: Server: `svm.myddns.me` | Port: `8444` | Token: `svm_demo`
</Accordion>

<Accordion title="How do I install SVM?">
  Installation is straightforward:

  1. Download the installer from [GitHub Releases](https://github.com/simplevulnerabilitymanager/svm/releases)
  2. Run the installer and follow the instructions
  3. No additional configuration required
  4. Start using SVM immediately

  The application includes all necessary dependencies except for external scanning tools and Microsoft Office (required for report generation).
</Accordion>

## Platform Compatibility

<Accordion title="Can I run SVM on Linux or MacOS?">
  Yes! SVM runs on Linux and MacOS using Wine.

  **MacOS Installation (v1.1.792+):**

  * Wine Stable 2.0.3 or later
  * XQuartz 2.7.11 (required by Wine 2.0.3)

  **Linux Compatibility:**

  * Debian 9 and later (improved detection in v2.0.3)
  * Ubuntu (including Ubuntu for Windows 10)
  * Other distributions supporting Wine

  Several Wine-specific bugs were fixed in version 2.1.0 and later for improved cross-platform stability.
</Accordion>

<Accordion title="Does SVM support Unicode characters?">
  Yes, full Unicode support was added in version 2.1.0. This enables:

  * International characters in project names
  * Unicode in vulnerability descriptions
  * Proper handling of non-ASCII characters in reports
  * Support for multiple languages (Spanish, English, Russian)
</Accordion>

## Reports and Documentation

<Accordion title="What report formats does SVM support?">
  SVM generates reports in Microsoft Word format using customizable templates:

  **Report Types:**

  * Technical Report (Informe Técnico)
  * Executive Report (Informe Ejecutivo)
  * Generic Report (Informe Genérico)

  **Report Features:**

  * Customizable risk colors and table styles
  * Statistical charts with custom colors
  * Variable substitution (e.g., \[Proyecto], \[Subtitulo])
  * Evidence and screenshots included
  * Risk-based vulnerability tables

  <Note>Microsoft Word is required for report generation.</Note>
</Accordion>

<Accordion title="Can I customize report templates?">
  Yes, reports are fully customizable (v2.0.0+):

  1. **Template Editing**: Double-click the template in configuration to edit it directly in Word
  2. **Custom Styles**: Assign different table styles from your template to each risk level
  3. **Color Customization**: Set custom colors for risk levels and statistical charts
  4. **Variables**: Use variables like `[Proyecto]` and `[Subtitulo]` in templates
  5. **Title Styles**: Select title styles extracted from your template

  The template uses the style name `Titulo_SVM` for better compatibility with English and Spanish Word versions (v2.0.3+).
</Accordion>

<Accordion title="How do I export project data to Excel?">
  SVM can export vulnerability data to Excel:

  1. Use the Search feature (Buscador) to filter vulnerabilities
  2. Click the Export to Excel option
  3. Excel file includes all filtered results including Critical vulnerabilities (fixed in v2.1.0)

  <Note>Microsoft Excel is required for export functionality.</Note>
</Accordion>

## Remote Scanning

<Accordion title="How do I configure remote scanning?">
  SVM supports remote scanning via SSH for most Linux-based tools:

  **Configuration Requirements:**

  * Linux server with scanning tools installed
  * SSH access credentials
  * PuTTY tools (plink.exe, pscp.exe) included with SVM

  **Supported Remote Scans:**

  * OpenVAS (Remote SSH)
  * Nessus
  * Arachni
  * Recon-ng
  * EyeWitness
  * Enjarify
  * QARK
  * ApkTools

  Scripts are automatically copied to the remote server and executed via SSH.
</Accordion>

<Accordion title="Can I scan private IP addresses with Qualys External?">
  No. Qualys External scanners cannot scan private IP addresses (RFC 1918 ranges):

  * 10.0.0.0/8
  * 172.16.0.0/12
  * 192.168.0.0/16

  For internal network scanning, you must:

  * Use Qualys Internal Appliances instead
  * Configure an internal scanner in your Qualys account

  An informative message was added in v1.1.788 to alert users about this limitation.
</Accordion>

## Updates and Maintenance

<Accordion title="How do I update SVM?">
  **Application Updates:**

  * SVM automatically checks for new versions (v2.0.0+)
  * Update notifications direct you to the download page
  * Manual download from [GitHub Releases](https://github.com/simplevulnerabilitymanager/svm/releases)

  **Script Updates (v2.1.0+):**

  * Go to Tools → Update All Scripts
  * Updates all internal scripts and tools
  * Scripts are open source on GitHub

  **External Tool Updates:**

  * Use Tools → Install/Update Tools (Local/Remote)
  * Downloads latest versions of integrated tools
</Accordion>

<Accordion title="How do I update scanning tool plugins?">
  **OpenVAS:**

  * Menu: Tools → OpenVAS Plugins
  * Updates vulnerability definitions

  **Nessus:**

  * Menu: Tools → Nessus Update Plugins (v1.1.787+)
  * Updates vulnerability definitions

  Plugin updates ensure you have the latest vulnerability signatures for accurate scanning.
</Accordion>

## Database and Backup

<Accordion title="How do I backup my SVM database?">
  For local database installations:

  1. Go to Database → Backup
  2. Select backup location
  3. SVM creates a backup file

  <Note>A Wine-specific backup error was fixed in v2.0.3, ensuring proper backup functionality on Linux/MacOS.</Note>
</Accordion>

<Accordion title="Can I run multiple instances of SVM?">
  Yes, but with considerations:

  **Multiple Instances (v2.1.0+):**

  * Executable name (`svm.exe`) is associated with configuration file (`svm.ini`)
  * This allows running Standalone and Professional versions simultaneously
  * Each instance must have its own configuration file

  **Wine Compatibility:**

  * Fixed error when exiting second instance (v2.0.3)
  * Properly handles multiple instances on Linux/MacOS

  <Warning>Ensure each instance uses a different database to avoid conflicts.</Warning>
</Accordion>

## Troubleshooting Resources

<Accordion title="Where can I find more help?">
  **Official Resources:**

  * [GitHub Wiki](https://github.com/simplevulnerabilitymanager/svm/wiki) - Comprehensive FAQ and guides
  * [GitHub Issues](https://github.com/simplevulnerabilitymanager/svm/issues) - Report bugs and request features
  * [Troubleshooting Guide](/help/troubleshooting) - Common issues and solutions

  **Community:**

  * Twitter: [@SimpleVulnManag](https://twitter.com/SimpleVulnManag)
  * Facebook: [@SimpleVulnerabilityManager](https://www.facebook.com/simplevulnerabilitymanager)
  * YouTube: [SVM Channel](https://www.youtube.com/channel/UCDXH-m2SqQsnb91UUsQxlrQ)

  **Support:**

  * Email: [contacto@simplevulnerabilitymanager.com](mailto:contacto@simplevulnerabilitymanager.com)
  * Website: [SimpleVulnerabilityManager.com](https://simplevulnerabilitymanager.com/)
</Accordion>

<Accordion title="How do I report bugs or suggest features?">
  SVM includes a built-in bug/idea reporter (v2.0.0+):

  1. Go to Menu → BugIdeas
  2. Select whether reporting a bug or suggesting a feature
  3. Provide detailed description
  4. Submit to development team

  You can also:

  * Report on [GitHub Issues](https://github.com/simplevulnerabilitymanager/svm/issues)
  * Email: [contacto@simplevulnerabilitymanager.com](mailto:contacto@simplevulnerabilitymanager.com)
</Accordion>

## Advanced Features

<Accordion title="Can I use SVM behind a proxy?">
  Yes, SVM supports proxy configuration for tool downloads and updates:

  **Proxy Settings:**

  * Configure in Settings → Configuration
  * Supports authentication (username/password)
  * Used for downloading tools and updates
  * Applies to: Qualys, tool installations, script updates

  Example: `--proxy 192.168.1.1:8080 --proxy-user username:password`
</Accordion>

<Accordion title="Does SVM support certificate-based authentication?">
  Yes, for certain tools:

  **SSL/TLS Certificates:**

  * Invalid certificates accepted for OpenVAS and Nessus (v1.1.789)
  * Certificate installation script included: `cert_install.bat`
  * Enables access to tools with self-signed certificates

  This is particularly useful for internal security tools that use self-signed certificates.
</Accordion>

<Accordion title="Can I customize scan configurations?">
  Yes, for most scanning tools:

  **OpenVAS:**

  * Edit scan configs via: Tools → OpenVAS → Edit Script
  * Local and remote configurations supported
  * Custom scan profiles available

  **Nessus:**

  * Select from available policies
  * Configure via Nessus web interface
  * SVM retrieves available policies automatically

  **Acunetix v11/v12:**

  * Six built-in profiles available
  * Full Scan, High Risk, XSS, SQLi, Weak Passwords, Crawl Only
  * Custom headers, cookies, and authentication supported
</Accordion>


# Troubleshooting Guide
Source: https://simplevulnerabilitymanager-svm.mintlify.app/help/troubleshooting

Common issues and solutions for Simple Vulnerability Manager

## Installation Issues

<Accordion title="Missing dependencies after installation">
  **Problem:** Application fails to start or features don't work.

  **Solution:**
  Most dependencies are included with SVM, but you may need:

  1. **Microsoft Office** (Word and Excel)
     * Required for report generation and Excel exports
     * Error handling improved in v2.0.2 to provide clear messages
     * Alternative: Use other reporting methods if Office unavailable

  2. **External scanning tools**
     * Use Tools → Install/Update Tools to download required tools
     * Each tool has specific installation requirements
     * Check tool documentation for prerequisites

  3. **Wine dependencies (Linux/MacOS)**
     * MacOS: Install XQuartz 2.7.11 or later
     * Linux: Install required Wine packages for your distribution
</Accordion>

<Accordion title="Installer fails on Debian 9 or other Linux distributions">
  **Problem:** Installation or tool detection fails on Linux.

  **Solution (v2.0.3+):**
  Environment detection was improved for Debian 9 and other distributions.

  1. Update to SVM v2.0.3 or later
  2. Ensure Wine is properly installed
  3. For Debian/Ubuntu: `sudo apt-get install wine wine32 wine64`
  4. Install required dependencies: `xmlstarlet`, `omp`, `netstat`

  Check the install scripts for distribution-specific requirements.
</Accordion>

## Wine Compatibility Issues

<Accordion title="Connection errors with SVM Pro server on Wine (Linux/MacOS)">
  **Problem:** "Lost connection to server" or connection failures when using SVM Pro.

  **Symptoms:**

  * Cannot connect to remote SVM server
  * Intermittent disconnections
  * Data sync failures

  **Solution (Fixed in v2.1.0):**
  These critical Wine compatibility issues were resolved:

  1. Update to SVM v2.1.0 or later
  2. Verify network connectivity to server
  3. Check firewall settings allow outbound connections
  4. Test with demo server: `svm.myddns.me:8444` (token: `svm_demo`)

  <Note>Version 2.1.0 includes major improvements for Wine connection handling.</Note>
</Accordion>

<Accordion title="SVM hangs when opening Word documents on Wine">
  **Problem:** Application freezes when generating reports or opening Word files.

  **Solution (Fixed in v2.1.0):**
  An issue with temporary Word files was resolved in v2.1.0:

  1. Update to SVM v2.1.0 or later
  2. Ensure Microsoft Word is properly configured in Wine
  3. Check available disk space in temp directory
  4. Close unnecessary Word processes before generating reports

  Alternative: Generate reports on Windows if Wine issues persist.
</Accordion>

<Accordion title="Backup fails with error on Wine">
  **Problem:** Database backup throws an error on Linux/MacOS.

  **Solution (Fixed in v2.0.3):**

  1. Update to SVM v2.0.3 or later
  2. Ensure write permissions in backup directory
  3. Check available disk space
  4. Use absolute paths for backup location

  Command:

  ```bash theme={null}
  chmod 755 /path/to/backup/directory
  ```
</Accordion>

<Accordion title="Multiple instance exit error on Wine">
  **Problem:** Error when closing second SVM instance on Linux/MacOS.

  **Solution (Fixed in v2.0.3):**

  1. Update to SVM v2.0.3 or later
  2. Each instance should use separate configuration files
  3. Ensure proper cleanup of temporary files
  4. Close instances in order (first opened, first closed recommended)
</Accordion>

<Accordion title="Report generation fails only on Wine">
  **Problem:** Creating vulnerability name reports fails specifically on Wine.

  **Solution (Fixed in v2.0.3):**

  1. Update to SVM v2.0.3 or later
  2. Ensure Word template uses the new `Titulo_SVM` style name
  3. Verify template compatibility with Word version
  4. Check Wine's Microsoft Office integration

  <Note>Version 2.0.3 introduced a new Word template specifically for Wine compatibility.</Note>
</Accordion>

## Scanning Tool Issues

### Nessus

<Accordion title="Nessus service not started">
  **Problem:** Error message "Nessus Service no iniciado" when attempting scan.

  **Error Detection:**
  Script checks if Nessus service is running at `https://server:port/`

  **Solution:**

  1. SSH to the Nessus server
  2. Start the service:
     ```bash theme={null}
     /etc/init.d/nessusd start
     ```
  3. Verify service is running:
     ```bash theme={null}
     ps aux | grep nessusd
     ```
  4. Check the service is listening on the configured port (usually 8834)
</Accordion>

<Accordion title="Nessus login fails or returns null token">
  **Problem:** Authentication fails with `---Error---` or null token.

  **Solution:**

  1. Verify username and password in SVM configuration
  2. Check Nessus web interface is accessible
  3. Ensure user account is not locked
  4. Verify Nessus API is enabled
  5. Check for SSL certificate issues (Nessus uses self-signed certs)

  <Note>SVM automatically handles invalid certificates for Nessus (v1.1.789+).</Note>
</Accordion>

<Accordion title="Nessus scan fails to export to XML">
  **Problem:** Export fails or XML file is corrupted.

  **Solution (Fixed in v1.1.793+):**

  1. Update to SVM v1.1.793 or later
  2. Verify Nessus scan completed successfully
  3. Check disk space on server and local machine
  4. Review export format settings in configuration

  Version 1.1.793 fixed XML export functionality for Nessus.
</Accordion>

<Accordion title="Nessus browser compatibility issues">
  **Problem:** Cannot access Nessus web interface from SVM browser.

  **Solution (Fixed in v1.1.794):**
  User-Agent was modified for Nessus 7 compatibility:

  1. Update to SVM v1.1.794 or later
  2. Clear browser cache in SVM
  3. Verify Nessus version compatibility
  4. Use external browser if issues persist
</Accordion>

### OpenVAS

<Accordion title="OpenVAS script missing required programs">
  **Problem:** Error "Falta el programa xmlstarlet" or "Falta el programa openvas-client(omp)".

  **Solution:**
  Install required dependencies on the Linux server:

  **Debian/Ubuntu:**

  ```bash theme={null}
  sudo apt-get install xmlstarlet openvas-client
  ```

  **RedHat/CentOS:**

  ```bash theme={null}
  sudo yum install xmlstarlet openvas-client
  ```

  Verify installation:

  ```bash theme={null}
  which xmlstarlet
  which omp
  ```
</Accordion>

<Accordion title="OpenVAS authentication errors">
  **Problem:** `---Error. Revise username/password o levante el servicio`

  **Solution:**

  1. Verify OpenVAS credentials in SVM configuration
  2. Start OpenVAS services:
     ```bash theme={null}
     service openvas-scanner restart
     service openvas-manager restart
     service greenbone-security-assistant restart
     ```
  3. Check services are running:
     ```bash theme={null}
     ps aux | grep openvas
     ```
  4. Verify port 9390 is listening:
     ```bash theme={null}
     netstat -tlnp | grep 9390
     ```
</Accordion>

<Accordion title="OpenVAS scan errors (Error-1, Error-2, Error-3, Error-4)">
  **Problem:** Generic error codes during OpenVAS scanning.

  **Solutions by Error Code:**

  **Error-1:** Failed to find target

  * Target ID is invalid or was deleted
  * Re-create the target in OpenVAS
  * Check target configuration

  **Error-2:** Task creation failed

  * Invalid scan configuration ID
  * Permission issues with OpenVAS user
  * Check available scan configs

  **Error-3:** Cannot retrieve task ID

  * XML parsing error
  * xmlstarlet not working correctly
  * Check OpenVAS API response

  **Error-4:** Cannot start task

  * Scanner is busy or offline
  * Check scanner status in Greenbone UI
  * Verify scanner has available slots
</Accordion>

<Accordion title="OpenVAS initializing or reloading">
  **Problem:** Scan stuck waiting for OpenVAS to finish initializing.

  **Expected Behavior:**
  Script waits while displaying:

  * `openvassd: Initializing`
  * `openvassd: Reloaded`

  **Solution:**
  This is normal during:

  * First OpenVAS startup
  * After plugin updates
  * After configuration changes

  Wait for initialization to complete (can take 5-60 minutes depending on system).

  To check status:

  ```bash theme={null}
  ps ax | grep "openvassd: Initializing"
  ps ax | grep "openvassd: Reloaded"
  ```
</Accordion>

<Accordion title="OpenVAS remote script file copy errors">
  **Problem:** Scripts fail to copy to remote server (Error-1 or Error-2).

  **Solution (Fixed in v1.1.794+):**

  1. Update to SVM v1.1.794 or later (file copy improved)
  2. Verify SSH credentials
  3. Check /tmp directory permissions on remote server:
     ```bash theme={null}
     ls -ld /tmp
     chmod 1777 /tmp
     ```
  4. Ensure pscp.exe and plink.exe are in SVM directory
  5. Test manual SSH connection:
     ```bash theme={null}
     ssh username@server
     ```
</Accordion>

<Accordion title="OpenVAS on Ubuntu for Windows 10">
  **Problem:** Script fails on Ubuntu for Windows 10 (WSL).

  **Solution (Fixed in v1.1.792+):**
  OpenVAS remote script was modified to support Ubuntu for Windows 10:

  1. Update to SVM v1.1.792 or later
  2. Install OpenVAS in WSL environment
  3. Script auto-detects WSL and adjusts commands
  4. Use `ss` instead of `netstat` if available

  Reference: [OpenVAS on Ubuntu for Windows 10](https://goo.gl/GxAvW3)
</Accordion>

### Qualys

<Accordion title="Qualys authentication failures">
  **Problem:** "Mal Usuario/Contraseña" error.

  **Solution:**

  1. Verify Qualys API credentials in SVM configuration
  2. Check account is not locked
  3. Ensure API access is enabled for account
  4. Verify subscription is active
  5. Test credentials via Qualys web interface
</Accordion>

<Accordion title="Qualys planned maintenance">
  **Problem:** "Qualys Planned Maintenance" message.

  **Solution:**
  This indicates Qualys is undergoing scheduled maintenance:

  1. Check [Qualys Status Page](https://status.qualys.com/)
  2. Wait for maintenance window to complete
  3. Retry scan after maintenance
  4. Schedule scans to avoid known maintenance windows
</Accordion>

<Accordion title="Qualys API rate limiting">
  **Problem:** "This API cannot be run again for another" or "This limit has already been reached".

  **Solution:**
  Qualys enforces API rate limits:

  1. **Wait Period:** Wait for the time specified in the error
  2. **Daily Limits:** Check your subscription's daily scan limits
  3. **Concurrent Scans:** Reduce number of simultaneous scans
  4. **Subscription:** Upgrade subscription for higher limits

  <Warning>Free/Community editions have strict rate limits.</Warning>
</Accordion>

<Accordion title="Qualys cannot scan private IP addresses">
  **Problem:** Cannot scan internal network ranges with External scanner.

  **Solution (v1.1.788+):**
  An informative message was added in v1.1.788:

  1. Use Qualys Internal Appliances instead of External
  2. Configure internal scanner in your Qualys account
  3. Ensure appliance has network access to target IPs
  4. Private IP ranges (RFC 1918):
     * 10.0.0.0/8
     * 172.16.0.0/12
     * 192.168.0.0/16

  External scanners can only scan public IP addresses.
</Accordion>

<Accordion title="Qualys IP not in asset list">
  **Problem:** Message "La ip no esta en Qualys. Agregando..."

  **Expected Behavior:**
  This is normal when scanning a new IP address:

  1. SVM detects IP is not in Qualys asset inventory
  2. Automatically adds IP to asset list
  3. Waits briefly for propagation
  4. Retries scan launch

  **If this fails repeatedly:**

  * Manually add IP via Qualys web interface
  * Verify account permissions allow asset addition
  * Check IP format is valid
</Accordion>

<Accordion title="Qualys configuration retrieval fails">
  **Problem:** Error when fetching scan configurations or report templates.

  **Solution (v1.1.791+):**
  Error description was improved in v1.1.791:

  1. Check error message for specific failure reason

  2. Common causes:
     * Authentication failure (check credentials)
     * Permission issues (verify account role)
     * Network connectivity
     * API endpoint unavailable

  3. Test connectivity:
     ```bash theme={null}
     curl -u username:password https://qualysapi.qualys.com/api/2.0/fo/scan/
     ```
</Accordion>

### Acunetix

<Accordion title="Acunetix target creation fails">
  **Problem:** "Error: Generando Target" message.

  **Solution:**

  1. Verify Acunetix API URL and API Key in configuration
  2. Check Acunetix service is running
  3. Ensure API access is enabled
  4. Verify URL format includes protocol (http\:// or https\://)
  5. Check for SSL certificate issues

  Test API connection:

  ```bash theme={null}
  curl -k -H "X-Auth: YOUR_API_KEY" https://acunetix-server:3443/api/v1/targets
  ```
</Accordion>

<Accordion title="Acunetix scan fails to start">
  **Problem:** "Error: Iniciando Scan" message.

  **Solution:**

  1. Verify target was created successfully
  2. Check scanner has available capacity
  3. Ensure target URL is accessible from scanner
  4. Review Acunetix logs for detailed error
  5. Verify scan profile ID is valid

  Available scan profiles:

  * Full Scan: `11111111-1111-1111-1111-111111111111`
  * High Risk: `11111111-1111-1111-1111-111111111112`
  * XSS: `11111111-1111-1111-1111-111111111116`
  * SQL Injection: `11111111-1111-1111-1111-111111111113`
</Accordion>

<Accordion title="Acunetix scan stops unexpectedly">
  **Problem:** Scan status shows "failed", "aborting", or null.

  **Solutions by Status:**

  **failed:**

  * Check target is accessible
  * Review Acunetix scanner logs
  * Verify sufficient disk space
  * Check for conflicting scans

  **aborting:**

  * User manually stopped scan
  * System resource limits reached
  * Scanner encountered critical error

  **null (stopped):**

  * Connection to Acunetix lost
  * API authentication expired
  * Service restarted during scan
</Accordion>

<Accordion title="Acunetix v10.5 remote scanning removed">
  **Problem:** Cannot find Acunetix 10.5 remote scanning option.

  **Solution (Changed in v1.1.792):**
  Acunetix 10.5 remote scanning was removed and replaced with v11 API:

  1. Upgrade to Acunetix 11 or later
  2. Use Acunetix 11 API scanning instead
  3. For local Acunetix 10.5: Use local scanning option
  4. Windows credentials configuration was also removed

  <Note>Acunetix 11+ uses API-based scanning which is more reliable and feature-rich.</Note>
</Accordion>

<Accordion title="Acunetix target creation error (Fixed in v2.0.1)">
  **Problem:** Error when creating target in Acunetix.

  **Solution:**
  Update to SVM v2.0.1 or later. This version fixed a specific issue with Acunetix target creation.

  If still experiencing issues:

  1. Verify URL includes protocol (http\:// or https\://)
  2. Check for special characters in URL
  3. Ensure target domain is resolvable
  4. Review Acunetix API documentation for URL format
</Accordion>

## Report Generation Issues

<Accordion title="Word or Excel not installed error">
  **Problem:** Error when generating reports or exporting data.

  **Solution (Improved in v2.0.2+):**
  Error messages were improved to clearly indicate Office requirements:

  1. Install Microsoft Office (Word and Excel)
  2. Ensure Office is properly activated
  3. For Wine: Install Office in Wine environment
  4. Check Office version compatibility (2010 or later recommended)

  <Warning>SVM requires Microsoft Office for report generation. Open source alternatives are not supported.</Warning>
</Accordion>

<Accordion title="Report variable not replaced ([Subtitulo] shows in report)">
  **Problem:** Variables like \[Subtitulo] or \[Proyecto] appear in generated report.

  **Solution (Fixed in v2.0.2+):**

  1. Update to SVM v2.0.2 or later

  2. Verify variable names match exactly in template

  3. Supported variables:
     * `[Proyecto]` - Project name
     * `[Subtitulo]` - Subtitle
     * Other custom variables defined in template

  4. Variables can now be used in vulnerability details (v1.1.789+)
</Accordion>

<Accordion title="Invalid character in project name prevents report generation">
  **Problem:** Report generation fails with file name error.

  **Solution (Fixed in v2.1.2):**
  SVM now handles invalid file name characters automatically:

  1. Update to SVM v2.1.2 or later
  2. Avoid these characters in project names: `\ / : * ? " < > |`
  3. Invalid characters are automatically replaced in report filenames
  4. Project name in database remains unchanged

  Example: Project `Test/Project?` creates report file `Test_Project_.docx`
</Accordion>

<Accordion title="Evidence images appear above vulnerability description">
  **Problem:** Evidence screenshots are positioned incorrectly in report.

  **Solution (Fixed in v2.0.0+):**
  Report layout was improved in v2.0.0:

  1. Update to SVM v2.0.0 or later
  2. Evidence now appears below vulnerability description
  3. Use updated Word template
  4. Check template styles if using custom template
</Accordion>

<Accordion title="Very large reports show 'other application is busy' error">
  **Problem:** Error message when generating reports over 200 pages.

  **Solution (Fixed in v1.1.792+):**
  A timeout issue with large reports was resolved:

  1. Update to SVM v1.1.792 or later

  2. For extremely large reports:
     * Increase Word's available memory
     * Close other Office applications
     * Generate reports in sections
     * Combine manually if needed

  3. Consider splitting very large projects into multiple reports
</Accordion>

<Accordion title="Window resizing issues with reports">
  **Problem:** Controls don't restore to original position after resizing.

  **Solution (Fixed in v2.0.2):**

  1. Update to SVM v2.0.2 or later
  2. Reset window to default size
  3. Restart SVM if controls remain misaligned
  4. Check display scaling settings (150%+ can cause issues)
</Accordion>

## Database and Configuration

<Accordion title="Configuration not saving properly">
  **Problem:** Settings revert after closing SVM.

  **Solution (Fixed in v2.0.1 and v2.0.3+):**
  Multiple configuration bugs were fixed:

  **v2.0.1:** Recon-ng and EyeWitness configuration
  **v2.0.3:** General configuration saving

  1. Update to SVM v2.0.3 or later
  2. Verify write permissions on svm.ini file
  3. Check svm.ini is not read-only
  4. Use CTRL+S shortcut to save (v1.1.788+)

  Location: Same directory as svm.exe
</Accordion>

<Accordion title="Cannot upload vulnerabilities">
  **Problem:** Upload button disabled or not working.

  **Solution (Fixed in v2.1.4):**

  1. Update to SVM v2.1.4 - this specifically fixes the upload button
  2. Ensure project is selected before uploading
  3. Check network connectivity for SVM Pro
  4. Verify file format is correct
  5. Review file size limits
</Accordion>

<Accordion title="Critical vulnerabilities not exported to Excel">
  **Problem:** Critical risk vulnerabilities missing from Excel export.

  **Solution (Fixed in v2.1.0):**

  1. Update to SVM v2.1.0 or later
  2. Ensure filter includes all risk levels
  3. Check vulnerability classification is correct
  4. Verify Excel export settings in configuration
</Accordion>

<Accordion title="IP range search fails with dash character">
  **Problem:** Searching IP range like "192.168.1.1-192.168.1.100" fails.

  **Solution (Fixed in v1.1.792+):**

  1. Update to SVM v1.1.792 or later
  2. IP range searches now properly parse dash character
  3. Supported formats:
     * Single IP: `192.168.1.1`
     * Range: `192.168.1.1-192.168.1.100`
     * CIDR: Check if supported in your version
</Accordion>

## Tool Management Issues

<Accordion title="Cannot rename vulnerability from toolbar">
  **Problem:** Rename button doesn't work in ServicesScan or Fortify.

  **Solution (Fixed in v2.1.1):**

  1. Update to SVM v2.1.1 or later
  2. Select vulnerability before clicking rename
  3. Ensure project is not read-only
  4. Check permissions for database modifications
</Accordion>

<Accordion title="Drag and drop for images not working">
  **Problem:** Cannot drag images into evidence or screenshots.

  **Solution (Added in v2.1.2):**
  Drag and drop was added in v2.1.2:

  1. Update to SVM v2.1.2 or later
  2. Drag image files directly from Explorer
  3. Supported formats: PNG, JPG, BMP, GIF
  4. Alternatively, use Browse button for compatibility
</Accordion>

<Accordion title="Text field character limits">
  **Problem:** Cannot enter enough text in IP, Web, Notes, Request, or Response fields.

  **Solution (Expanded in v2.1.0):**
  Field capacity was significantly increased:

  1. Update to SVM v2.1.0 or later
  2. All text fields now support more content
  3. Full Unicode support for international characters
  4. Large evidence notes are now possible
</Accordion>

<Accordion title="OWASP Mobile controls don't restore after zoom">
  **Problem:** Controls remain enlarged after using Zoom+ feature.

  **Solution (Fixed in v2.0.3):**

  1. Update to SVM v2.0.3 or later
  2. Use Zoom- to restore controls
  3. Restart SVM if controls don't restore
  4. Check display DPI settings
</Accordion>

## Network and Connection Issues

<Accordion title="Cannot access project or vulnerability management without project">
  **Problem:** Menu options disabled or error when accessing features.

  **Solution (Enforced in v1.1.792+):**
  This is expected behavior to prevent errors:

  1. Create a new project or select existing project first
  2. Project selection is now required for:
     * Vulnerability management
     * Scanning operations
     * Report generation
     * Evidence management

  This prevents data consistency issues.
</Accordion>

<Accordion title="Web URLs without protocol fail to launch tools">
  **Problem:** Error when launching web scanners.

  **Solution (Enforced in v1.1.791+):**
  Web URLs must include protocol:

  **Correct formats:**

  * `http://example.com`
  * `https://example.com`

  **Incorrect formats:**

  * `example.com`
  * `www.example.com`

  Add http\:// or https\:// prefix to all web addresses before scanning.
</Accordion>

<Accordion title="Invalid certificates prevent access to tools">
  **Problem:** Cannot access OpenVAS or Nessus web interface.

  **Solution (Fixed in v1.1.789+):**

  1. Update to SVM v1.1.789 or later
  2. Invalid certificates are now automatically accepted
  3. For custom certificates: Use `cert_install.bat`
  4. Check firewall allows access to tool ports

  <Note>Self-signed certificates are common for security tools and are now handled automatically.</Note>
</Accordion>

<Accordion title="Nmap cannot resolve domain in IP field">
  **Problem:** Nmap scan fails when domain name used instead of IP.

  **Solution (Fixed in v1.1.792+):**

  1. Update to SVM v1.1.792 or later
  2. Nmap now accepts both IPs and domain names
  3. Ensure domain is resolvable:
     ```bash theme={null}
     nslookup example.com
     ```
  4. Use IP address if DNS resolution fails
</Accordion>

## Tool-Specific Issues

<Accordion title="Recon-ng API credentials not working">
  **Problem:** Reconnaissance fails or API errors.

  **Solution (Fixed in v2.0.3+):**

  1. Update to SVM v2.0.3 or later

  2. Configure API keys in Settings:
     * SHODAN API key
     * IPInfoDB key
     * Other service credentials

  3. New modules added (v2.0.1):
     * certificate\_transparency
     * google\_site\_web
     * hackertarget
     * threatcrowd

  4. Domains can be specified without protocol (v2.0.3+)

  <Note>API keys must be obtained from respective services.</Note>
</Accordion>

<Accordion title="Recon-ng executable path error">
  **Problem:** Cannot find Recon-ng executable.

  **Solution (Fixed in v2.0.0+):**

  1. Update to SVM v2.0.0 or later
  2. Configure correct Recon-ng installation path in Settings
  3. Verify Recon-ng is installed on remote server (for remote execution)
  4. Check path includes python executable if needed
</Accordion>

<Accordion title="QARK scan fails or parameters not working">
  **Problem:** QARK analysis errors or outdated parameters.

  **Solutions:**

  **Script file copy issue (Fixed in v1.1.794):**

  1. Update to SVM v1.1.794 or later
  2. Verify remote server connectivity

  **Parameter issue (Fixed in v1.1.794):**
  Removed deprecated parameters: `--install 0 --exploit 0`

  1. Update to SVM v1.1.794 or later
  2. Use current QARK command-line options
  3. Check QARK documentation for supported parameters
</Accordion>

<Accordion title="EyeWitness installation missing from menu">
  **Problem:** Cannot find EyeWitness installation option.

  **Solution (Fixed in v1.1.792+):**

  1. Update to SVM v1.1.792 or later
  2. Find option: Tools → Install → Remote → EyeWitness
  3. Java installation also added to same menu
  4. Requires SSH access to remote server
</Accordion>

<Accordion title="Burpsuite executable selection not working">
  **Problem:** Cannot configure Burpsuite executable path.

  **Solution (Fixed in v1.1.791):**

  1. Update to SVM v1.1.791 or later
  2. Go to Settings → Configuration → Tools
  3. Browse and select Burpsuite .jar or .exe file
  4. Verify Java is installed if using .jar file
</Accordion>

<Accordion title="Android tools outdated versions">
  **Problem:** Using old versions of Android tools.

  **Solution:**
  Use Tools → Install/Update Tools to get latest versions:

  **Updated in v2.1.0:**

  * Apktool → v2.4.0
  * Uber Apk Signer → v1.0.0
  * JD-Gui → v1.5.2

  **Updated in v2.0.0:**

  * Android Debug Bridge (adb) → v1.0.39

  **Installation:**

  1. Go to Tools → Install/Update Tools (Local or Remote)
  2. Select tool to update
  3. Tool is downloaded and installed automatically
  4. Verify tool version after installation
</Accordion>

## Getting Additional Help

<Accordion title="Where to find detailed error logs">
  For debugging complex issues:

  1. **Windows Event Viewer** (Windows only)

  2. **Wine Debug Output** (Linux/MacOS):
     ```bash theme={null}
     WINEDEBUG=+all wine svm.exe 2>&1 | tee svm_debug.log
     ```

  3. **Tool-specific logs**:
     * Nessus: `/opt/nessus/var/nessus/logs/`
     * OpenVAS: `/var/log/openvas/`
     * Qualys: Check web interface audit logs

  4. **Temporary files** (may contain error details):
     * Windows: `%TEMP%\`
     * Linux/MacOS: `/tmp/`
     * Look for files with scan timestamps
</Accordion>

<Accordion title="Reporting issues to SVM development team">
  When reporting bugs:

  1. **Include Version Information:**
     * SVM version (check Help → About)
     * Operating system and version
     * Wine version (if applicable)
     * Tool versions involved

  2. **Provide Error Details:**
     * Exact error message
     * Steps to reproduce
     * Screenshots if relevant
     * Log files if available

  3. **Submit Via:**
     * Built-in BugIdeas feature (Menu → BugIdeas)
     * [GitHub Issues](https://github.com/simplevulnerabilitymanager/svm/issues)
     * Email: [contacto@simplevulnerabilitymanager.com](mailto:contacto@simplevulnerabilitymanager.com)

  4. **Check First:**
     * Review [changelog](https://github.com/simplevulnerabilitymanager/svm/blob/master/changelog.txt) for known issues
     * Search existing GitHub issues
     * Check [Wiki FAQ](https://github.com/simplevulnerabilitymanager/svm/wiki)
</Accordion>

## Need More Help?

If your issue isn't covered here:

* Check the [FAQ page](/help/faq) for general questions
* Visit the [GitHub Wiki](https://github.com/simplevulnerabilitymanager/svm/wiki) for comprehensive guides
* Contact support: [contacto@simplevulnerabilitymanager.com](mailto:contacto@simplevulnerabilitymanager.com)
* Follow [@SimpleVulnManag](https://twitter.com/SimpleVulnManag) for updates and tips


# Installation Guide
Source: https://simplevulnerabilitymanager-svm.mintlify.app/installation

Step-by-step instructions to install Simple Vulnerability Manager and its integrated security tools

# Installation Guide

Simple Vulnerability Manager can be installed on Windows and Linux systems. The installation process is straightforward and requires minimal configuration.

## System Requirements

<Info>
  SVM integrates with multiple security tools. While the core application has minimal requirements, integrated tools may have additional dependencies.
</Info>

### Supported Platforms

* **Windows**: Windows 10 or later
* **Linux**: Kali Linux, Debian, Ubuntu (including WSL)

### Core Dependencies

<Tabs>
  <Tab title="Windows">
    * .NET Framework (included with Windows)
    * Administrative privileges for installation
    * Network connectivity for downloading security tools
  </Tab>

  <Tab title="Linux">
    * Python 3.x
    * Git
    * Root/sudo privileges
    * Required packages: `git`, `wget`, `python3`, `python3-pip`, `build-essential`
  </Tab>
</Tabs>

## Installing SVM Core

<Steps>
  <Step title="Download the Installer">
    Download the latest SVM installer from the official GitHub releases page:

    ```bash theme={null}
    https://github.com/simplevulnerabilitymanager/svm/releases
    ```

    **Current Version**: v2.1.3
  </Step>

  <Step title="Run the Installer">
    <Tabs>
      <Tab title="Windows">
        1. Double-click the downloaded `.exe` installer
        2. Follow the installation wizard
        3. Accept the license agreement
        4. Choose the installation directory
        5. Complete the installation
      </Tab>

      <Tab title="Linux">
        1. Extract the downloaded archive
        2. Navigate to the installation directory
        3. Run the setup script with sudo privileges

        ```bash theme={null}
        sudo ./install_upgrade_tools_remoto.sh
        ```
      </Tab>
    </Tabs>
  </Step>

  <Step title="Launch SVM">
    After installation, launch SVM:

    * **Windows**: Use the Start Menu shortcut or run `svm.exe`
    * **Linux**: Execute from the installation directory

    No additional configuration is required to start using the core features.
  </Step>
</Steps>

## Installing Integrated Security Tools

SVM integrates with various security tools. You can install them individually based on your needs.

### Linux Tool Installation Script

SVM provides an automated installation script for Linux systems that handles dependencies and tool setup.

<Warning>
  The installation script requires root privileges and will install system packages. Review the script before execution in production environments.
</Warning>

#### Script Usage

```bash theme={null}
sudo ./install_upgrade_tools_remoto.sh [TOOL_NAME]
```

#### Available Tools

<AccordionGroup>
  <Accordion title="Web Scanners">
    **Arachni**

    ```bash theme={null}
    sudo ./install_upgrade_tools_remoto.sh Arachni
    ```

    Installs Arachni web application scanner with all dependencies including:

    * Ruby gems: watir, selenium-webdriver, arachni-reactor
    * Database libraries: SQLite, PostgreSQL, MySQL
    * Network libraries: curl, libcurl
  </Accordion>

  <Accordion title="Service Scanners">
    **OpenVAS**

    ```bash theme={null}
    sudo ./install_upgrade_tools_remoto.sh OpenVAS
    ```

    Installs OpenVAS vulnerability scanner including:

    * OpenVAS manager and scanner components
    * Greenbone Security Assistant (web interface)
    * Additional tools: nmap, nikto, hydra, nessus plugins
    * Default credentials: username `admin`, password `OpenVAS`

    <Note>
      After installation, OpenVAS will be configured to accept remote connections. The web interface listens on your local IP address.
    </Note>

    **OpenVAS Plugin Updates**

    ```bash theme={null}
    sudo ./install_upgrade_tools_remoto.sh OpenVASPlugins
    ```

    **Nmap**

    ```bash theme={null}
    sudo ./install_upgrade_tools_remoto.sh Nmap
    ```

    **Nessus Plugin Updates**

    ```bash theme={null}
    sudo ./install_upgrade_tools_remoto.sh NessusPlugins
    ```
  </Accordion>

  <Accordion title="Mobile Security Tools">
    **MobSF (Mobile Security Framework)**

    ```bash theme={null}
    sudo ./install_upgrade_tools_remoto.sh MobSF
    ```

    **QARK (Quick Android Review Kit)**

    ```bash theme={null}
    sudo ./install_upgrade_tools_remoto.sh Qark
    ```

    **ApkTool**

    ```bash theme={null}
    sudo ./install_upgrade_tools_remoto.sh ApkTools
    ```

    **Enjarify**

    ```bash theme={null}
    sudo ./install_upgrade_tools_remoto.sh Enjarify
    ```

    **AndroBugs Framework**

    ```bash theme={null}
    sudo ./install_upgrade_tools_remoto.sh AndroBugs_Framework
    ```

    **Drozer**

    ```bash theme={null}
    sudo ./install_upgrade_tools_remoto.sh Drozer
    ```

    **Android SDK**

    ```bash theme={null}
    sudo ./install_upgrade_tools_remoto.sh AndroidSDK
    ```
  </Accordion>

  <Accordion title="Information Gathering Tools">
    **Recon-ng**

    ```bash theme={null}
    sudo ./install_upgrade_tools_remoto.sh Recon-ng
    ```

    **EyeWitness**

    ```bash theme={null}
    sudo ./install_upgrade_tools_remoto.sh EyeWitness
    ```
  </Accordion>

  <Accordion title="Base Dependencies">
    **Java**

    ```bash theme={null}
    sudo ./install_upgrade_tools_remoto.sh Java
    ```

    Installs OpenJDK 9 (or OpenJDK 8 as fallback)
  </Accordion>
</AccordionGroup>

#### Install All Tools

```bash theme={null}
sudo ./install_upgrade_tools_remoto.sh Todas
```

<Warning>
  Installing all tools will take significant time and disk space. Only install tools you need for your security assessments.
</Warning>

## Windows Subsystem for Linux (WSL) Setup

For Windows 10 users running SVM tools via WSL:

<Steps>
  <Step title="Install WSL">
    Install Ubuntu 18.04 or Kali Linux from the Microsoft Store
  </Step>

  <Step title="Configure SSH Server">
    ```bash theme={null}
    sudo apt-get install openssh-server
    cd /etc/ssh/
    sudo /usr/bin/ssh-keygen -A
    sudo service ssh --full-restart
    ```
  </Step>

  <Step title="Update SSH Configuration">
    Edit `/etc/ssh/sshd_config` and add:

    ```bash theme={null}
    sudo nano /etc/ssh/sshd_config
    ```

    Add the following line:

    ```
    ListenAddress 0.0.0.0
    ```

    Restart the SSH service:

    ```bash theme={null}
    sudo service ssh --full-restart
    sudo update-rc.d ssh enable
    ```
  </Step>

  <Step title="Configure Sudo Access (Optional)">
    To avoid password prompts during scans:

    ```bash theme={null}
    sudo visudo
    ```

    Add (replace `username` with your WSL username):

    ```
    username ALL=(ALL) NOPASSWD: ALL
    ```
  </Step>
</Steps>

## Post-Installation Verification

<Steps>
  <Step title="Launch SVM">
    Start the SVM application and verify the main interface loads correctly.
  </Step>

  <Step title="Check Tool Integration">
    Verify installed tools are recognized:

    * Navigate to the tools section in SVM
    * Check that installed scanners appear in the available tools list
  </Step>

  <Step title="Test Database Access">
    * Access the vulnerability database
    * Browse categories: Web Scanners, Service Scanners, Mobile
    * Verify vulnerability descriptions load correctly
  </Step>
</Steps>

## Updating SVM

### Core Application Updates

Check for updates regularly:

1. Visit the [GitHub Releases](https://github.com/simplevulnerabilitymanager/svm/releases) page
2. Download the latest version
3. Run the installer to upgrade

### Security Tool Updates

**Linux Script Updates**

```bash theme={null}
# Update all scripts
sudo ./update_all_scripts.bat

# Update specific tool plugins
sudo ./install_upgrade_tools_remoto.sh OpenVASPlugins
sudo ./install_upgrade_tools_remoto.sh NessusPlugins
```

**Nmap Script Database**

```bash theme={null}
sudo nmap --script-updatedb
```

## Troubleshooting

<AccordionGroup>
  <Accordion title="Installation script requires root privileges">
    **Error**: "You must run this setup script with root privileges."

    **Solution**: Run the script with sudo:

    ```bash theme={null}
    sudo ./install_upgrade_tools_remoto.sh [TOOL_NAME]
    ```
  </Accordion>

  <Accordion title="OpenVAS service not starting">
    **Solution**: Restart OpenVAS services manually:

    ```bash theme={null}
    sudo service openvas-scanner restart
    sudo service openvas-manager restart
    sudo service greenbone-security-assistant restart
    ```

    Or use the Kali shortcut:

    ```bash theme={null}
    sudo openvas-start
    ```
  </Accordion>

  <Accordion title="Tool not detected by SVM">
    **Solution**:

    1. Verify the tool is installed correctly
    2. Check the installation path matches SVM configuration
    3. Restart SVM to refresh tool detection
  </Accordion>

  <Accordion title="Network connectivity issues with WSL">
    **Solution**:

    * Ensure SSH server is running in WSL
    * Verify firewall rules allow connections
    * Check that ListenAddress is set to 0.0.0.0 in sshd\_config
  </Accordion>
</AccordionGroup>

## Next Steps

Now that SVM is installed, proceed to the [Quick Start Guide](/quickstart) to run your first vulnerability scan.

<Card title="Quick Start Guide" icon="rocket" href="/quickstart">
  Learn how to create your first project and run a vulnerability scan
</Card>


# Simple Vulnerability Manager
Source: https://simplevulnerabilitymanager-svm.mintlify.app/introduction

The perfect tool for vulnerability analysts to perform comprehensive security assessments and generate professional reports

# Simple Vulnerability Manager

**Simple Vulnerability Manager (SVM)** is the perfect tool for any vulnerability analyst. With just a couple of clicks, you can perform comprehensive security assessments and generate detailed reports that help understand and resolve system vulnerabilities.

<img alt="Hero Light" />

## Key Features

<CardGroup>
  <Card title="Comprehensive Vulnerability Database" icon="database">
    Access a curated database of the most recognized vulnerabilities organized by Web Scanners, Service Scanners, Static Scanners, and Mobile security tools.
  </Card>

  <Card title="Project Management" icon="folder-tree">
    Create and manage client projects with personalized comments and screenshots that serve as evidence for each detected vulnerability.
  </Card>

  <Card title="Automated Scanning" icon="bolt">
    Execute automated scans with a single click by integrating with industry-leading security tools like OpenVAS, Nessus, Nmap, Burp Suite, and more.
  </Card>

  <Card title="Professional Reporting" icon="file-chart-line">
    Generate comprehensive reports that specify vulnerability details, system impact, and remediation steps in multiple formats.
  </Card>
</CardGroup>

## What Makes SVM Special?

### Vulnerability Intelligence

Each vulnerability in the database includes:

* **Description**: What creates the security problem
* **Impact Analysis**: How it affects the system
* **Remediation Steps**: Clear instructions to resolve the issue
* **Evidence Storage**: Attach screenshots and custom notes

### Multi-Platform Support

SVM integrates seamlessly with security tools across multiple categories:

**Web Application Security**

* Acunetix
* Burp Suite
* Netsparker
* Arachni Web Application Scanner

**Infrastructure Security**

* OpenVAS
* Nessus
* Qualys (Community & Enterprise)
* Nmap

**Mobile Security**

* MobSF (Mobile Security Framework)
* QARK
* AndroBugs Framework
* APK analysis tools (ApkTool, Enjarify, JD-Gui)

**Reconnaissance**

* Recon-ng
* EyeWitness

## Quick Links

<CardGroup>
  <Card title="Installation Guide" icon="download" href="/installation">
    Get SVM up and running in minutes with our step-by-step installation guide.
  </Card>

  <Card title="Quick Start" icon="rocket" href="/quickstart">
    Run your first vulnerability scan and generate a professional report.
  </Card>

  <Card title="GitHub Repository" icon="github" href="https://github.com/simplevulnerabilitymanager/svm">
    Access the source code, scripts, and contribute to the project.
  </Card>

  <Card title="Official Website" icon="globe" href="https://simplevulnerabilitymanager.com/">
    Visit the official SVM website for more resources and enterprise licensing.
  </Card>
</CardGroup>

## Version Information

<Info>
  **Current Version**: v2.1.3

  SVM is actively maintained with regular updates to vulnerability signatures and tool integrations.
</Info>

## License

<Note>
  **Open Source Scripts**: All Windows (.bat) and Linux (.sh) scripts are open source under GPL license.

  **SVM Executable**: The `svm.exe` application is freeware for personal use. Enterprise deployments require a **Pro** license. Contact [contacto@simplevulnerabilitymanager.com](mailto:contacto@simplevulnerabilitymanager.com) for licensing information.
</Note>

## Community & Support

Join the SVM community:

* **Twitter**: [@SimpleVulnManag](https://twitter.com/SimpleVulnManag)
* **Facebook**: [@SimpleVulnerabilityManager](https://www.facebook.com/simplevulnerabilitymanager)
* **Instagram**: [@SimpleVulnerabilityManager](https://www.instagram.com/simplevulnerabilitymanager/)
* **YouTube**: [Official Channel](https://www.youtube.com/channel/UCDXH-m2SqQsnb91UUsQxlrQ?view_as=subscriber)
* **FAQ & Wiki**: [GitHub Wiki](https://github.com/simplevulnerabilitymanager/svm/wiki)

***

Created by **Ulises Cuñe** - [www.ulises2k.com.ar](https://www.ulises2k.com.ar)

Presented at:

* Ekoparty Security Conference (2016)
* Andsec Security Conference (2017)
* Spotify Secure Podcast - Episode 012 (2018)


# Quick Start Guide
Source: https://simplevulnerabilitymanager-svm.mintlify.app/quickstart

Get started with SVM by running your first vulnerability scan and generating a professional security report

# Quick Start Guide

This guide will walk you through creating your first project, running a vulnerability scan, and generating a comprehensive security report using Simple Vulnerability Manager.

<Info>
  **Prerequisites**: Make sure you have [installed SVM](/installation) and at least one scanning tool (OpenVAS, Nmap, or Nessus recommended).
</Info>

## Your First Security Assessment

<Steps>
  <Step title="Launch SVM">
    Start the Simple Vulnerability Manager application.

    **Windows**: Launch from Start Menu or run `svm.exe`

    **Linux**: Execute from installation directory

    You'll see the main SVM interface with access to:

    * Project management
    * Vulnerability database
    * Scanning tools
    * Reporting features
  </Step>

  <Step title="Create a New Project">
    Projects in SVM organize your security assessments per client or target.

    1. Click **"New Project"** or navigate to the Projects section
    2. Enter project details:
       * **Project Name**: e.g., "Acme Corp Security Assessment"
       * **Client Name**: Organization being assessed
       * **Description**: Brief overview of the assessment scope
       * **Target IP/Domain**: The system you're testing
    3. Click **"Create"** to initialize the project

    <Note>
      All scan results, screenshots, and notes will be associated with this project for organized reporting.
    </Note>
  </Step>

  <Step title="Configure Your Target">
    Specify what you want to scan:

    **Target Types**:

    * **Single IP**: `192.168.1.100`
    * **Multiple IPs**: `192.168.1.100,192.168.1.101`
    * **IP Range**: `192.168.1.1-192.168.1.254`
    * **Domain**: `example.com`
    * **URL**: `https://example.com`

    Add the target to your project and select the assessment type:

    * Web Application Security
    * Infrastructure/Service Scanning
    * Mobile Application Security
  </Step>

  <Step title="Select a Scanning Tool">
    Choose the appropriate scanner for your assessment:

    ### For Infrastructure Scanning

    <Tabs>
      <Tab title="OpenVAS">
        **Best for**: Comprehensive vulnerability assessment

        1. Select **"OpenVAS Scan"** from the tools menu
        2. Configure scan parameters:
           * **Server**: OpenVAS server IP (default: `127.0.0.1`)
           * **Port**: OpenVAS port (default: `9390`)
           * **Username**: `admin`
           * **Password**: `OpenVAS` (default, change if modified)
           * **Scan Config**: Choose from:
             * Full and fast
             * Full and deep
             * System Discovery
           * **Report Format**: HTML, PDF, or XML
        3. Click **"Start Scan"**

        <Info>
          OpenVAS scans can take 30 minutes to several hours depending on the target size and scan configuration.
        </Info>
      </Tab>

      <Tab title="Nmap">
        **Best for**: Network discovery and port scanning

        1. Select **"Nmap Scan"** from the tools menu
        2. The scan automatically includes:
           * Service version detection (`-sV`)
           * OS detection (`-O`)
           * Default scripts (`-sC`)
           * Comprehensive port coverage (TCP 1-65535, common UDP)
        3. Click **"Start Scan"**

        **Example Scan Command**:

        ```bash theme={null}
        nmap -Pn -O --system-dns -vv -sS -sC -sV \
          -pT:1-65535,U:7,9,13,17,19,21,37,53,67-69,98,111,121,123,135,137-138,161 \
          -oA "NmapReport" 192.168.1.100
        ```
      </Tab>

      <Tab title="Nessus">
        **Best for**: Enterprise vulnerability management

        1. Select **"Nessus Scan"** from the tools menu
        2. Configure Nessus connection:
           * Nessus server URL
           * API credentials
           * Scan policy
        3. Click **"Start Scan"**
      </Tab>
    </Tabs>

    ### For Web Application Scanning

    <CardGroup>
      <Card title="Burp Suite" icon="spider-web">
        Manual and automated web app testing with proxy capabilities
      </Card>

      <Card title="Arachni" icon="bug">
        Automated web application security scanner
      </Card>

      <Card title="Acunetix" icon="shield-check">
        Commercial web vulnerability scanner
      </Card>

      <Card title="Netsparker" icon="radar">
        Automated web application security scanner
      </Card>
    </CardGroup>

    ### For Mobile Security

    <CardGroup>
      <Card title="MobSF" icon="mobile">
        Static and dynamic analysis for Android/iOS apps
      </Card>

      <Card title="QARK" icon="android">
        Quick Android Review Kit for APK analysis
      </Card>
    </CardGroup>
  </Step>

  <Step title="Monitor Scan Progress">
    SVM displays real-time scan progress:

    * **Scanning Status**: Active, Queued, or Completed
    * **Progress Indicator**: Percentage complete (for supported tools)
    * **Time Elapsed**: Duration of current scan
    * **Vulnerabilities Found**: Live count during scan

    <Warning>
      Do not close SVM while a scan is in progress. You can minimize it and continue working.
    </Warning>

    **Typical Scan Durations**:

    * **Nmap**: 5-30 minutes
    * **OpenVAS (Full & Fast)**: 30-90 minutes
    * **OpenVAS (Full & Deep)**: 2-6 hours
    * **Web scanners**: 15 minutes to 2 hours
  </Step>

  <Step title="Review Scan Results">
    Once the scan completes, SVM automatically processes the results:

    1. **View Summary**: See vulnerability count by severity
       * Critical
       * High
       * Medium
       * Low
       * Informational
    2. **Browse Vulnerabilities**: Click on any finding to see:
       * Detailed description
       * Affected systems/services
       * CVSS score
       * CVE references
       * Exploit availability
    3. **Add Evidence**: For each vulnerability:
       * Add custom notes and observations
       * Upload screenshots
       * Mark false positives
       * Assign remediation priority
  </Step>

  <Step title="Enhance with Vulnerability Database">
    SVM's built-in database provides comprehensive vulnerability information:

    1. Navigate to **Vulnerability Database**
    2. Browse categories:
       * **Web Scanners**: XSS, SQLi, CSRF, authentication issues
       * **Service Scanners**: Misconfigurations, missing patches, weak protocols
       * **Static Scanners**: Code quality and security issues
       * **Mobile**: Android/iOS specific vulnerabilities
    3. For detected vulnerabilities, add from database:
       * Click **"Add to Project"**
       * Review the pre-filled information:
         * What creates the problem
         * System impact
         * Remediation steps
       * Customize for your specific finding

    <Info>
      The vulnerability database is continuously updated with the latest security research and remediation guidance.
    </Info>
  </Step>

  <Step title="Generate Professional Report">
    Create a comprehensive security assessment report:

    1. Select **"Generate Report"** from the project menu
    2. Choose report format:
       * **HTML**: Interactive web-based report
       * **PDF**: Professional document for distribution
       * **Word**: Customizable template (uses Template\_SVM.dotx)
       * **XML**: For integration with other tools
    3. Configure report options:
       * Include executive summary
       * Add technical details
       * Attach screenshots and evidence
       * Filter by severity level
       * Include remediation timeline
    4. Click **"Generate"**

    **Example OpenVAS Report Process**:

    ```bash theme={null}
    # Report is automatically generated after scan completion
    # Saved to: [Project Documentation]/OpenvasReport - [Timestamp].html
    ```

    **Example Nmap Report Process**:

    ```bash theme={null}
    # XML output is transformed to HTML using XSLT
    # Saved to: [Project Documentation]/NmapReport - [Timestamp].html
    ```
  </Step>

  <Step title="Review and Deliver">
    Your report is now ready:

    1. **Preview**: SVM automatically opens the report for review
    2. **Validate**: Ensure all findings are accurate and properly documented
    3. **Export**: Save to your preferred location
    4. **Share**: Deliver to your client or security team

    <Note>
      Reports include:

      * Executive summary with risk overview
      * Detailed findings with evidence
      * Remediation recommendations
      * Technical appendices
      * Scan metadata and methodology
    </Note>
  </Step>
</Steps>

## Example Workflow: OpenVAS Infrastructure Scan

Here's a complete example of scanning a server with OpenVAS:

```bash theme={null}
# The scan process (handled automatically by SVM)
# 1. Create target in OpenVAS
omp --host=127.0.0.1 --port=9390 --username=admin --password=OpenVAS \
  --xml="<create_target><name>WebServer-2024</name><hosts>192.168.1.100</hosts></create_target>"

# 2. Create scan task
omp --xml="<create_task><name>WebServer-2024</name><config id='[scan-config-id]'></config></create_task>"

# 3. Start scan
omp --xml="<start_task task_id='[task-id]'></start_task>"

# 4. Monitor progress
# SVM polls every 60 seconds until status = "Done"

# 5. Generate report
omp --xml="<get_reports report_id='[report-id]' format_id='[html-format]'/>"

# 6. Decode and save
# Report saved to: /tmp/OpenvasReport - [Timestamp].html
```

<Info>
  SVM automates this entire process. The commands above show what happens behind the scenes.
</Info>

## Example Workflow: Nmap Network Discovery

```bash theme={null}
# Quick network scan with service detection
nmap -Pn -O --system-dns -vv -sS -sC -sV \
  -oA "NetworkDiscovery" \
  -pT:1-65535,U:53,161,500 \
  192.168.1.0/24

# Output files:
# - NetworkDiscovery.xml (machine readable)
# - NetworkDiscovery.html (transformed by SVM)
# - NetworkDiscovery.nmap (human readable text)
```

## Best Practices

<CardGroup>
  <Card title="Authorization" icon="file-contract">
    **Always obtain written permission** before scanning any system you don't own. Unauthorized scanning may be illegal.
  </Card>

  <Card title="Scope Definition" icon="bullseye-arrow">
    Clearly define the assessment scope in your project. Document:

    * Target systems
    * Allowed testing methods
    * Excluded systems
    * Testing timeframes
  </Card>

  <Card title="Evidence Collection" icon="camera">
    Take screenshots and detailed notes for every finding. This evidence:

    * Validates vulnerabilities
    * Helps in remediation
    * Protects against disputes
  </Card>

  <Card title="Safe Scanning" icon="shield-check">
    Be cautious with aggressive scans:

    * Start with passive reconnaissance
    * Use "Full and Fast" before "Full and Deep"
    * Schedule intensive scans during maintenance windows
    * Monitor target systems for issues
  </Card>
</CardGroup>

## Next Steps

<CardGroup>
  <Card title="Advanced Features" icon="gears">
    Explore SVM's advanced capabilities:

    * Custom vulnerability templates
    * Multi-target scanning
    * Scan scheduling
    * Template customization
  </Card>

  <Card title="Tool Integration" icon="plug">
    Learn how to integrate additional tools:

    * Custom scanner scripts
    * API integrations
    * Remote scanning setup
  </Card>

  <Card title="FAQ & Wiki" icon="book" href="https://github.com/simplevulnerabilitymanager/svm/wiki">
    Browse common questions and solutions in the community wiki
  </Card>

  <Card title="Join the Community" icon="users" href="https://twitter.com/SimpleVulnManag">
    Connect with other SVM users and stay updated on new features
  </Card>
</CardGroup>

## Troubleshooting Common Issues

<AccordionGroup>
  <Accordion title="Scan fails to start">
    **Possible causes**:

    * Tool not properly installed or configured
    * Incorrect credentials (OpenVAS, Nessus)
    * Target not reachable
    * Firewall blocking scanner

    **Solutions**:

    1. Verify tool installation: Check the tool appears in SVM's available scanners
    2. Test connectivity: Ping the target and ensure ports are accessible
    3. Check credentials: Verify OpenVAS/Nessus login works manually
    4. Review firewall rules: Ensure scanning traffic is permitted
  </Accordion>

  <Accordion title="OpenVAS Internal Error">
    **Error**: Scan status shows "Internal Error"

    **Solutions**:

    ```bash theme={null}
    # Restart OpenVAS services
    sudo service openvas-scanner restart
    sudo service openvas-manager restart
    sudo service greenbone-security-assistant restart

    # Verify OpenVAS is running
    sudo systemctl status openvas-scanner
    sudo systemctl status openvas-manager
    ```
  </Accordion>

  <Accordion title="Report not generating">
    **Possible causes**:

    * Scan did not complete successfully
    * Report format not supported by scanner
    * Insufficient disk space

    **Solutions**:

    1. Verify scan reached "Done" status
    2. Check SVM logs for error messages
    3. Ensure output directory is writable
    4. Try alternative report format
  </Accordion>

  <Accordion title="No vulnerabilities found">
    **This might be normal**, but verify:

    * Target is responding to probes
    * Scan configuration is appropriate (not too conservative)
    * Firewall isn't blocking scan traffic
    * Target is actually vulnerable (test with known-vulnerable systems)

    Run a basic connectivity test:

    ```bash theme={null}
    nmap -Pn -p 80,443,22,21,3306 [target-ip]
    ```
  </Accordion>
</AccordionGroup>

## Support

Need help? Here are your resources:

* **FAQ**: [GitHub Wiki](https://github.com/simplevulnerabilitymanager/svm/wiki)
* **Community**: [@SimpleVulnManag on Twitter](https://twitter.com/SimpleVulnManag)
* **Issues**: [GitHub Issues](https://github.com/simplevulnerabilitymanager/svm/issues)
* **Enterprise Support**: [contacto@simplevulnerabilitymanager.com](mailto:contacto@simplevulnerabilitymanager.com)

***

You're now ready to perform comprehensive security assessments with Simple Vulnerability Manager. Happy scanning!


# Information Gathering Tools
Source: https://simplevulnerabilitymanager-svm.mintlify.app/scanners/information-tools

Reconnaissance and OSINT tools for intelligence gathering and asset discovery

SVM integrates powerful reconnaissance and Open Source Intelligence (OSINT) tools for comprehensive information gathering during the pre-assessment phase. These tools discover subdomains, map infrastructure, gather public information, and capture web application screenshots.

## Available Tools

<CardGroup>
  <Card title="Recon-ng" icon="database" href="https://github.com/lanmaster53/recon-ng">
    Modular reconnaissance framework with a database backend for managing intelligence gathering workflows.
  </Card>

  <Card title="EyeWitness" icon="camera" href="https://github.com/ChrisTruncer/EyeWitness">
    Web application screenshot tool with server header detection and default credential identification.
  </Card>
</CardGroup>

## Tool Capabilities

### Recon-ng

Recon-ng is a full-featured reconnaissance framework with module-based architecture:

#### Core Features

* **Workspace Management**: Organize reconnaissance data by project
* **Database Backend**: SQLite database stores all gathered intelligence
* **Module System**: 70+ modules for various OSINT sources
* **API Integration**: Support for 15+ third-party APIs
* **Report Generation**: HTML reports with complete findings
* **Query System**: SQL-based queries for data analysis

#### Integrated Modules

SVM's Recon-ng integration includes the following reconnaissance modules:

**Domain-to-Host Enumeration**

* `netcraft` - Subdomain discovery via Netcraft
* `bing_domain_api` - Microsoft Bing API subdomain search
* `bing_domain_web` - Bing web scraping for subdomains
* `builtwith` - Technology stack and subdomain discovery
* `brute_hosts` - DNS brute-force subdomain enumeration
* `ssl_san` - SSL certificate Subject Alternative Name parsing
* `vpnhunter` - VPN endpoint discovery
* `certificate_transparency` - CT log subdomain discovery
* `google_site_web` - Google search subdomain enumeration
* `hackertarget` - HackerTarget API subdomain lookup
* `mx_spf_ip` - MX and SPF record parsing for IP discovery
* `shodan_hostname` - Shodan hostname search
* `threatcrowd` - ThreatCrowd database subdomain lookup

**Network Block to Host**

* `reverse_resolve` - Reverse DNS resolution of IP ranges
* `shodan_net` - Shodan network block scanning

**Host Enrichment**

* `reverse_resolve` - PTR record resolution
* `resolve` - Forward DNS resolution
* `bing_ip` - Bing IP-based search
* `freegeoip` - IP geolocation
* `ipinfodb` - IP information database lookup
* `ssltools` - SSL certificate analysis

#### API Configuration

Recon-ng supports multiple API keys for enhanced data gathering:

* **Google API** - Google Custom Search
* **Bing API** - Microsoft Bing Search
* **Shodan API** - Shodan device search
* **GitHub API** - GitHub code search
* **BuiltWith API** - Technology profiling
* **FullContact API** - Contact information
* **VirusTotal API** - Threat intelligence
* **Censys API** - Internet-wide scanning data

<Info>
  **API Keys**: Configure API keys in the script file before execution. Most modules work without API keys but provide limited results. API keys significantly enhance data coverage.
</Info>

#### Execution Workflow

1. **Workspace Creation**: Creates isolated workspace per project
2. **Domain Addition**: Adds target domains to database
3. **Module Execution**: Runs 15+ reconnaissance modules sequentially
4. **Data Correlation**: Cross-references findings across modules
5. **Report Generation**: Produces HTML report and text exports
6. **Data Export**: Exports networks, IPs, and subdomains separately

#### Output Files

* **HTML Report**: Complete reconnaissance report with all findings
* **Networks List**: Identified network blocks (CIDR notation)
* **IP Addresses**: Unique IP addresses discovered
* **Subdomains**: Complete subdomain list with IP resolution

<Info>
  **Remote Execution**: Recon-ng runs on remote Linux servers via SSH. This enables long-running reconnaissance without tying up local resources. Execution can take 30+ minutes depending on target size.
</Info>

**Script Reference**: [recon\_ng\_remote.bat](/scripts/recon-ng)

### EyeWitness

EyeWitness captures screenshots and analyzes web applications:

#### Core Features

* **Web Screenshots**: Automated screenshot capture of web applications
* **Server Headers**: HTTP header analysis and fingerprinting
* **Default Credentials**: Detection of default login pages
* **Certificate Analysis**: SSL/TLS certificate inspection
* **Active Scanning**: Probes for common vulnerabilities
* **Multi-Threading**: Parallel processing of multiple targets
* **Report Generation**: HTML report with inline screenshots

#### Detection Capabilities

* Default web server pages (Apache, IIS, Nginx)
* Default application installations (WordPress, Joomla, etc.)
* Login portals and authentication pages
* Administrative interfaces
* Potential security issues (HTTP on HTTPS ports, etc.)
* Server version information
* Response timing anomalies

#### Configuration Options

* **Protocol Prepending**: Automatically prepends HTTPS
* **Timeout Settings**: Configurable per-request timeout (default: 20s)
* **Threading**: Concurrent requests (default: 10 threads)
* **User-Agent**: Custom user-agent string
* **Active Scanning**: Optional active vulnerability probing
* **DNS Resolution**: Resolve hostnames before screenshot capture

#### Input Formats

EyeWitness accepts target lists in the following formats:

```
http://example.com
https://example.com:8443
example.com
192.168.1.1
```

#### Execution Workflow

1. **Target Upload**: Uploads target list to remote server
2. **Script Generation**: Creates execution script with parameters
3. **Screenshot Capture**: Captures web application screenshots
4. **Analysis**: Analyzes headers and identifies technologies
5. **Report Compilation**: Generates HTML report with findings
6. **Archive Creation**: Packages screenshots and reports
7. **Download**: Retrieves tar.gz archive to local system

#### Output Structure

```
EyeWitnessReport_<timestamp>/
├── report.html          # Main report with screenshots
├── screens/             # Screenshot images
├── source/              # HTML source code
└── logs/                # Execution logs
```

<Info>
  **Server Requirements**: EyeWitness requires Python and dependencies installed on remote Linux server. Install with: `cd EyeWitness/setup && ./setup.sh`
</Info>

**Script Reference**: [EyeWitness\_remote.bat](/scripts/eyewitness)

## Information Gathering Workflow

### Reconnaissance Phase

```mermaid theme={null}
graph TD
    A[Target Domains] --> B[Recon-ng]
    B --> C[Subdomain Discovery]
    B --> D[IP Enumeration]
    B --> E[Network Mapping]
    C --> F[Subdomain List]
    D --> G[IP List]
    E --> H[Network Blocks]
    F --> I[EyeWitness]
    G --> I
    I --> J[Screenshots & Analysis]
```

### Integration Points

1. **Domain Input**: Start with primary target domains
2. **Recon-ng Discovery**: Enumerate all subdomains and IPs
3. **Data Export**: Extract unique web targets
4. **EyeWitness Capture**: Screenshot all discovered web applications
5. **Analysis**: Review reports for interesting targets
6. **Project Import**: Import findings into SVM project

## Use Cases

<AccordionGroup>
  <Accordion title="External Assessment Preparation">
    Before external penetration testing:

    1. Run Recon-ng with target domains
    2. Export discovered subdomains and IPs
    3. Run EyeWitness on discovered targets
    4. Identify interesting applications and technologies
    5. Plan testing scope based on findings
  </Accordion>

  <Accordion title="Attack Surface Mapping">
    For comprehensive asset discovery:

    1. Configure all Recon-ng API keys
    2. Execute full reconnaissance against target organization
    3. Review network blocks and IP ranges
    4. Screenshot all HTTP/HTTPS services
    5. Document exposed services and applications
  </Accordion>

  <Accordion title="Subdomain Takeover Hunting">
    To identify subdomain takeover opportunities:

    1. Use Recon-ng certificate transparency module
    2. Enumerate all subdomains via multiple sources
    3. Check DNS resolution for each subdomain
    4. Use EyeWitness to identify error pages
    5. Investigate unresolved or error-state subdomains
  </Accordion>

  <Accordion title="Technology Profiling">
    For technology stack identification:

    1. Recon-ng BuiltWith module for technology detection
    2. EyeWitness for server header analysis
    3. Screenshot analysis for framework identification
    4. Correlate versions across multiple sources
  </Accordion>
</AccordionGroup>

## Best Practices

<AccordionGroup>
  <Accordion title="API Key Management">
    * Register for API keys from all supported services
    * Store API keys securely (not in version control)
    * Configure API keys in script before execution
    * Monitor API rate limits and usage quotas
    * Rotate API keys periodically for security
  </Accordion>

  <Accordion title="Data Accuracy">
    * Use multiple reconnaissance modules for verification
    * Cross-reference findings across different sources
    * Validate discovered subdomains with DNS resolution
    * Confirm IP ownership before testing
    * Document sources for all intelligence gathered
  </Accordion>

  <Accordion title="Execution Timing">
    * Run reconnaissance during initial project phases
    * Schedule long-running scans during off-hours
    * Monitor remote execution via SSH if needed
    * Allow sufficient time for complete enumeration (30-60 min)
    * Re-run reconnaissance periodically for new assets
  </Accordion>

  <Accordion title="Legal Considerations">
    * Only target authorized domains and networks
    * Respect robots.txt and API terms of service
    * Avoid aggressive scanning that may trigger alerts
    * Document authorization for all reconnaissance activities
    * Use passive techniques when active scanning is not authorized
  </Accordion>

  <Accordion title="Report Analysis">
    * Review EyeWitness report for default credentials
    * Identify high-value targets (admin panels, APIs)
    * Note outdated software versions for exploitation
    * Document unusual or interesting findings
    * Import all findings into SVM project for tracking
  </Accordion>
</AccordionGroup>

## Remote Server Setup

Both tools require Linux servers for execution:

### Recon-ng Setup

```bash theme={null}
# Clone repository
git clone https://github.com/lanmaster53/recon-ng.git

# Install dependencies
cd recon-ng
pip install -r REQUIREMENTS

# Verify installation
./recon-ng --version
```

### EyeWitness Setup

```bash theme={null}
# Clone repository
git clone https://github.com/ChrisTruncer/EyeWitness.git

# Run setup script
cd EyeWitness/setup
./setup.sh

# Verify installation
cd ../Python
./EyeWitness.py --help
```

### SVM Remote Access Requirements

* SSH access (port 22)
* Username and password authentication
* plink.exe and pscp.exe (included with SVM)
* Network connectivity to remote server
* Tools installed in known paths

## Output Organization

### Recon-ng Reports

```
<Project>/Documentation/
├── recon-ngReport - <timestamp>.html          # Main report
├── recon-ngReport-Networks - <timestamp>.txt  # Network blocks
├── recon-ngReport-IP - <timestamp>.txt        # IP addresses
└── recon-ngReport-Subdomains - <timestamp>.txt # Subdomain list
```

### EyeWitness Reports

```
<Project>/Documentation/
└── EyeWitnessReport_<timestamp>.tar.gz        # Complete archive
    ├── report.html
    ├── screens/*.png
    ├── source/*.html
    └── logs/*.log
```

## Integration with Other Tools

Information gathering tools feed into other SVM scanners:

### Recon-ng → Web Scanners

Export subdomain list to scan with Acunetix, Burpsuite, Netsparker, or Arachni

### Recon-ng → Service Scanners

Export IP addresses to scan with Qualys, Nessus, OpenVAS, or Nmap

### EyeWitness → Manual Testing

Identify interesting targets for manual security assessment

### Combined Workflow

```
Recon-ng Discovery → Target List → EyeWitness Screenshots → 
Manual Review → Prioritized Targets → Automated Scanning
```

## Next Steps

<CardGroup>
  <Card title="Web Scanners" icon="globe" href="/scanners/web-scanners">
    Scan discovered web applications
  </Card>

  <Card title="Service Scanners" icon="network-wired" href="/scanners/service-scanners">
    Scan discovered IP addresses and services
  </Card>
</CardGroup>


# Mobile Security Tools
Source: https://simplevulnerabilitymanager-svm.mintlify.app/scanners/mobile-tools

Android application security analysis and reverse engineering tools

SVM integrates comprehensive Android security testing tools for static analysis, reverse engineering, and vulnerability detection in mobile applications. These tools enable complete APK analysis from decompilation to security scanning.

## Available Tools

<CardGroup>
  <Card title="ApkTool" icon="screwdriver-wrench" href="https://ibotpeaches.github.io/Apktool/">
    Reverse engineering tool for Android APK files supporting decode, rebuild, and resource extraction.
  </Card>

  <Card title="Enjarify" icon="file-zipper" href="https://github.com/google/enjarify">
    Google's tool for translating Dalvik bytecode to Java bytecode for analysis with Java tools.
  </Card>

  <Card title="JD-GUI" icon="eye" href="http://jd.benow.ca/">
    Java decompiler with graphical interface for viewing decompiled Java source code from JAR files.
  </Card>

  <Card title="MobSF" icon="shield-check" href="https://github.com/MobSF/Mobile-Security-Framework-MobSF">
    Mobile Security Framework - automated security analysis platform for Android and iOS applications.
  </Card>

  <Card title="QARK" icon="magnifying-glass" href="https://github.com/linkedin/qark">
    Quick Android Review Kit by LinkedIn for finding security vulnerabilities in Android applications.
  </Card>

  <Card title="AndroBugs" icon="bug" href="https://github.com/AndroBugs/AndroBugs_Framework">
    Efficient Android vulnerability scanner finding security vulnerabilities in Android applications.
  </Card>
</CardGroup>

## Tool Capabilities

### ApkTool

ApkTool provides comprehensive APK reverse engineering capabilities:

* **APK Decoding**: Extracts resources to nearly original form
* **Resource Parsing**: Decodes binary XML files to readable text
* **Smali Disassembly**: Converts DEX to Smali intermediate language
* **APK Rebuilding**: Recompiles modified resources back to APK
* **Asset Extraction**: Full access to images, layouts, and manifests

SVM supports both local and remote ApkTool operations:

* Local decoding for quick analysis
* Remote execution via SSH for isolated environments
* Automatic timestamp-based output organization

<Info>
  **Version**: SVM is compatible with ApkTool 2.3.3 and later. The tool requires Java Runtime Environment (JRE) to be installed.
</Info>

**Script Reference**: [apktool scripts](/scripts/apktool)

### Enjarify

Enjarify translates Android applications to Java format for enhanced analysis:

* **Dalvik to Java Conversion**: Translates DEX bytecode to Java bytecode
* **Better Accuracy**: More robust than dex2jar for complex applications
* **JAR Output**: Generates standard JAR files compatible with Java tools
* **Error Handling**: Handles malformed DEX files gracefully

Workflow:

1. Accept APK file as input
2. Extract and convert DEX files to Java bytecode
3. Generate JAR file for use with JD-GUI or other Java analysis tools

<Info>
  **Integration**: Enjarify output JAR files can be directly opened with JD-GUI for source code analysis. Use Enjarify first, then JD-GUI for the complete workflow.
</Info>

**Script Reference**: See [apktool scripts](/scripts/apktool) for Enjarify integration

### JD-GUI

JD-GUI provides visual Java decompilation:

* **Graphical Interface**: User-friendly GUI for browsing decompiled source
* **Syntax Highlighting**: Color-coded Java source code display
* **Class Navigation**: Tree-view of packages and classes
* **Search Functionality**: Find classes, methods, and strings
* **Export Capability**: Save decompiled sources to disk

JD-GUI is the final step in the reverse engineering chain:

```
APK → Enjarify → JAR → JD-GUI → Source Code
```

<Info>
  **Usage**: JD-GUI launches interactively. Pass the JAR file generated by Enjarify to view the decompiled Android application source code.
</Info>

**Script Reference**: See [apktool scripts](/scripts/apktool) for JD-GUI integration

### MobSF

Mobile Security Framework performs comprehensive automated security analysis:

* **Static Analysis**: Code analysis without running the application
* **Malware Detection**: Identifies malicious behavior patterns
* **Manifest Analysis**: Reviews Android manifest for security issues
* **Code Review**: Detects insecure code patterns and APIs
* **Binary Analysis**: Examines native libraries and ELF binaries
* **PDF Reports**: Generates detailed security assessment reports

Security checks include:

* Insecure data storage
* Weak cryptography implementation
* Improper SSL/TLS validation
* Hardcoded secrets and credentials
* Vulnerable third-party libraries
* Excessive permissions
* Debuggable applications

Integration features:

* RESTful API communication
* CSRF token handling
* Automatic report generation
* Support for both local and remote MobSF servers

<Info>
  **Server Setup**: MobSF must be running as a service. Start with: `python /path/to/Mobile-Security-Framework-MobSF/manage.py runserver 0.0.0.0:8000`
</Info>

**Script Reference**: [mobsf.bat](/scripts/mobsf)

### QARK

Quick Android Review Kit by LinkedIn identifies security vulnerabilities:

* **Automated Security Testing**: Scans for common Android vulnerabilities
* **Exploit Generation**: Creates proof-of-concept exploits for findings
* **Manifest Analysis**: Reviews permissions and component exports
* **Source Code Analysis**: Detects insecure coding practices
* **Report Generation**: Comprehensive HTML reports with remediation advice

QARK identifies:

* Exported components (Activities, Services, Broadcast Receivers)
* SQL injection vulnerabilities
* Path traversal issues
* WebView vulnerabilities
* Insecure file permissions
* Tapjacking vulnerabilities

Execution model:

* Remote execution via SSH (interactive)
* Manual completion monitoring
* Compressed report archive (tar.gz)
* Includes logs and exploit code

<Info>
  **Interactive Mode**: QARK requires manual interaction during analysis. The script prompts you to confirm completion before retrieving results.
</Info>

**Script Reference**: [qark.bat](/scripts/qark)

### AndroBugs Framework

AndroBugs performs efficient vulnerability scanning:

* **Fast Scanning**: Quick security assessment compared to MobSF
* **Vulnerability Detection**: Identifies OWASP Mobile Top 10 issues
* **Text Reports**: Detailed findings in plain text format
* **Remote Execution**: SSH-based scanning on Linux servers
* **Severity Ratings**: Critical, High, Medium, Low classifications

Security categories:

* SSL/TLS implementation issues
* Cryptographic vulnerabilities
* Database security problems
* WebView configuration issues
* Component exposure risks
* Intent handling vulnerabilities

<Info>
  **Python Dependency**: AndroBugs requires Python 2.7. Execute via remote Linux server with proper Python environment configured.
</Info>

**Script Reference**: [androbugs\_framework.bat](/scripts/androbugs)

## Mobile Analysis Workflow

SVM supports a comprehensive mobile security testing workflow:

### Basic Reverse Engineering

```mermaid theme={null}
graph LR
    A[APK File] --> B[ApkTool Decode]
    A --> C[Enjarify Convert]
    B --> D[Smali Analysis]
    C --> E[JD-GUI View]
    E --> F[Source Code Review]
    D --> F
```

### Security Scanning

```mermaid theme={null}
graph LR
    A[APK File] --> B[MobSF Scan]
    A --> C[QARK Scan]
    A --> D[AndroBugs Scan]
    B --> E[Consolidated Report]
    C --> E
    D --> E
```

## Tool Comparison

| Feature            | ApkTool         | Enjarify | JD-GUI      | MobSF         | QARK          | AndroBugs     |
| ------------------ | --------------- | -------- | ----------- | ------------- | ------------- | ------------- |
| **Purpose**        | Reverse Eng.    | DEX→JAR  | Decompiler  | Security Scan | Security Scan | Security Scan |
| **Input**          | APK             | APK      | JAR         | APK           | APK           | APK           |
| **Output**         | Smali/Resources | JAR      | Source View | PDF Report    | HTML+Exploits | Text Report   |
| **Speed**          | Fast            | Fast     | Instant     | Slow          | Medium        | Fast          |
| **Automation**     | Full            | Full     | Manual      | Full          | Interactive   | Full          |
| **Remote Support** | Yes             | Yes      | No          | Yes           | Yes           | Yes           |

## Analysis Strategies

<AccordionGroup>
  <Accordion title="Quick Assessment">
    For rapid security assessment:

    1. Run AndroBugs Framework (fastest)
    2. Review text report for critical/high findings
    3. Run MobSF for detailed analysis of flagged issues
  </Accordion>

  <Accordion title="Deep Code Analysis">
    For comprehensive code review:

    1. ApkTool decode for manifest and resource analysis
    2. Enjarify conversion to JAR format
    3. JD-GUI for source code navigation
    4. Manual code review of security-sensitive areas
  </Accordion>

  <Accordion title="Complete Security Audit">
    For full security assessment:

    1. MobSF for automated vulnerability detection
    2. QARK for exploit generation and verification
    3. AndroBugs for additional vulnerability coverage
    4. ApkTool + Enjarify + JD-GUI for manual review
    5. Consolidate findings in SVM project
  </Accordion>

  <Accordion title="Malware Analysis">
    For suspicious applications:

    1. MobSF static analysis for malware indicators
    2. ApkTool decode to examine permissions and components
    3. JD-GUI source review for malicious code patterns
    4. Manual analysis of native libraries and encrypted assets
  </Accordion>
</AccordionGroup>

## Remote Execution

Most mobile tools support remote execution for resource-intensive operations:

### Benefits

* Offload processing to dedicated analysis servers
* Maintain consistent analysis environments
* Enable distributed analysis across teams
* Isolate potentially malicious applications

### Requirements

* SSH access to remote Linux server
* Tools installed on remote server
* plink.exe and pscp.exe for Windows-to-Linux communication
* Network connectivity between SVM and remote server

### Supported Remote Operations

* ApkTool decode (remote)
* Enjarify conversion (remote)
* MobSF scanning (remote server)
* QARK analysis (remote server)
* AndroBugs scanning (remote server)

## APK Signing and Installation

SVM includes additional mobile tools for APK manipulation:

### Uber APK Signer

Sign modified APK files for installation on devices.

**Script Reference**: See [apktool scripts](/scripts/apktool) for APK signing

### APK Installation

Install signed APKs on connected devices or emulators:

* Local installation via ADB
* Remote installation to device over network

**Script Reference**: See [apktool scripts](/scripts/apktool) for APK installation

### Certificate Installation

Install custom CA certificates for MITM proxy testing.

**Script Reference**: See [apktool scripts](/scripts/apktool) for certificate installation

## Best Practices

<AccordionGroup>
  <Accordion title="Tool Selection">
    * Use MobSF for comprehensive automated scanning
    * Use AndroBugs for quick vulnerability checks
    * Use QARK when proof-of-concept exploits are needed
    * Use ApkTool+Enjarify+JD-GUI for manual code review
  </Accordion>

  <Accordion title="Analysis Environment">
    * Perform analysis in isolated VM or sandbox
    * Use dedicated servers for remote analysis
    * Maintain separate environments for trusted/untrusted APKs
    * Regularly update all analysis tools
  </Accordion>

  <Accordion title="Report Management">
    * All reports are timestamped automatically
    * Store APK files alongside analysis reports
    * Document manual findings in SVM project
    * Archive complete analysis artifacts
  </Accordion>

  <Accordion title="Efficiency">
    * Run multiple scanners in parallel when possible
    * Use remote execution for resource-intensive operations
    * Batch similar APKs for sequential analysis
    * Prioritize tools based on time constraints
  </Accordion>
</AccordionGroup>

## Next Steps

<CardGroup>
  <Card title="Information Tools" icon="magnifying-glass-chart" href="/scanners/information-tools">
    Reconnaissance and OSINT gathering tools
  </Card>

  <Card title="Android Commands" icon="terminal" href="/scripts/apktool">
    ADB and device management commands
  </Card>
</CardGroup>


# Service Scanners
Source: https://simplevulnerabilitymanager-svm.mintlify.app/scanners/service-scanners

Network and service vulnerability scanning tools for infrastructure assessment

SVM integrates with enterprise-grade and open-source vulnerability scanners to perform comprehensive network and service-level security assessments. These tools identify vulnerabilities in network services, operating systems, and infrastructure components.

## Available Tools

<CardGroup>
  <Card title="Qualys" icon="cloud" href="https://www.qualys.com/community-edition/">
    Cloud-based vulnerability management platform supporting both Community and Enterprise editions with automated scanning and reporting.
  </Card>

  <Card title="Nessus" icon="shield-halved" href="https://www.tenable.com/products/nessus/nessus-professional">
    Industry-standard vulnerability scanner from Tenable with comprehensive vulnerability coverage and policy-based scanning.
  </Card>

  <Card title="OpenVAS" icon="lock-open" href="http://www.openvas.org/">
    Open-source vulnerability assessment system providing full-featured network vulnerability scanning.
  </Card>

  <Card title="Nmap" icon="radar" href="https://nmap.org/">
    Network discovery and security auditing tool for port scanning, service detection, and OS fingerprinting.
  </Card>
</CardGroup>

## Tool Capabilities

### Qualys

Qualys provides cloud-based vulnerability management with enterprise-grade features:

* **API-Based Integration**: Full REST API support for scan launch, monitoring, and reporting
* **Scan Appliances**: Support for both external scanning and internal appliances
* **Asset Management**: Automatic asset addition and tracking
* **Policy-Based Scanning**: Custom scan policies per project
* **Automated Reporting**: Multiple report formats and templates
* **Proxy Support**: HTTP proxy configuration for restricted environments

The integration handles:

* Automatic asset registration for new IP addresses
* Real-time scan status monitoring
* Export of both scan results and vulnerability reports
* Rate limiting and API throttling management

<Info>
  **Editions Supported**: Both Qualys Community Edition (free) and Enterprise Edition are supported. Community Edition has API usage limits that SVM automatically manages.
</Info>

**Script Reference**: [qualys\_scan.bat](/scripts/qualys)

### Nessus

Nessus integration provides professional-grade vulnerability assessment:

* **RESTful API**: Complete API-based scan management and reporting
* **Policy Management**: Support for custom scan policies and templates
* **Authentication**: Secure token-based authentication
* **Report Formats**: HTML and XML (.nessus) export formats
* **Scan History**: Historical scan tracking and comparison
* **Service Detection**: Automatic detection of running Nessus service

Scan workflow includes:

1. Policy and template UUID retrieval
2. Scan configuration and launch
3. Real-time status monitoring with timeout handling
4. Dual report generation (HTML + XML)
5. Automatic cleanup and session logout

<Info>
  **Requirements**: Nessus Professional or Nessus Manager required. Ensure the Nessus service is running before launching scans: `/etc/init.d/nessusd start`
</Info>

**Script Reference**: [nessus\_scan.bat](/scripts/nessus)

### OpenVAS

OpenVAS (Open Vulnerability Assessment System) offers open-source vulnerability scanning:

* **OMP Protocol**: OpenVAS Management Protocol (OMP) integration
* **Report Formats**: Multiple output formats (PDF, XML, HTML, TXT, CSV)
* **Task Management**: Complete scan task lifecycle management
* **Target Configuration**: Flexible target and credential management
* **Remote Execution**: SSH-based remote scanning support
* **Format Discovery**: Automatic report format ID enumeration

SVM supports both local and remote OpenVAS instances with full configuration management.

<Info>
  **Setup**: OpenVAS requires initial setup and feed synchronization. The integration uses `omp_cracked.exe` for Windows-based OMP communication.
</Info>

**Script Reference**: [openvas\_scan.bat](/scripts/openvas)

### Nmap

Nmap provides network discovery and port scanning capabilities:

* **Comprehensive Port Scanning**: TCP ports 1-65535 and common UDP ports
* **Service Detection**: Version detection (-sV) for running services
* **OS Fingerprinting**: Operating system detection (-O)
* **Script Scanning**: NSE (Nmap Scripting Engine) default scripts (-sC)
* **Multiple Targets**: Support for scanning multiple IP addresses
* **Report Transformation**: XML to HTML conversion with custom XSL stylesheets

Default scan includes:

* SYN scan (-sS) for stealthy scanning
* 65535 TCP ports and 200+ common UDP ports
* Service version detection
* Default NSE scripts for vulnerability checks
* HTML report generation

<Info>
  **Performance**: Full port scans can take significant time. Consider using custom port ranges for faster results when targeting specific services.
</Info>

**Script Reference**: [nmap\_scan.bat](/scripts/nmap)

## Comparison Matrix

| Feature                     | Qualys          | Nessus     | OpenVAS     | Nmap        |
| --------------------------- | --------------- | ---------- | ----------- | ----------- |
| **Vulnerability Database**  | 100,000+        | 140,000+   | 50,000+     | Limited     |
| **Authentication Scanning** | Yes             | Yes        | Yes         | No          |
| **Web App Scanning**        | Limited         | Limited    | Limited     | No          |
| **Compliance Checks**       | Yes             | Yes        | Yes         | No          |
| **Cloud-Based**             | Yes             | No         | No          | No          |
| **License**                 | Commercial/Free | Commercial | Open Source | Open Source |
| **API Integration**         | RESTful         | RESTful    | OMP         | CLI         |

## API Integration Details

### Qualys API

The Qualys integration uses the following API endpoints:

* `/api/2.0/fo/session/` - Authentication
* `/api/2.0/fo/scan/` - Scan management
* `/msp/asset_ip.php` - Asset management

Authentication uses HTTP basic auth with session cookies for subsequent requests.

### Nessus API

Nessus integration leverages the following REST endpoints:

* `POST /session` - Authentication (token-based)
* `GET /policies` - Policy enumeration
* `POST /scans` - Scan creation
* `POST /scans/{id}/launch` - Scan execution
* `GET /scans/{id}` - Status monitoring
* `POST /scans/{id}/export` - Report generation

### OpenVAS OMP

OpenVAS uses XML-based OMP commands:

* `<get_report_formats />` - Format enumeration
* `<create_task />` - Scan task creation
* `<start_task />` - Task execution
* `<get_report />` - Report retrieval

## Remote Scanning

All service scanners support remote execution:

* **Qualys**: Native cloud-based scanning with appliance selection
* **Nessus**: Remote Nessus server targeting via API
* **OpenVAS**: SSH-based remote scanning with plink/pscp
* **Nmap**: Remote execution via SSH for distributed scanning

Remote scanning enables:

* Scanning from different network locations
* Internal network assessment from external SVM installations
* Distributed scanning across multiple scanners

## Report Management

SVM automatically manages scanner reports:

### Report Locations

All reports are stored in the project documentation folder:

```
<Project>\Documentation\<ScannerName>Report - <Timestamp>.<ext>
```

### Report Formats

* **Qualys**: XML, PDF (configurable template)
* **Nessus**: HTML and XML (.nessus format)
* **OpenVAS**: Multiple formats based on selected format ID
* **Nmap**: HTML (converted from XML)

### Report Processing

SVM automatically:

* Timestamps all reports
* Opens reports upon completion
* Preserves raw scan data (XML/JSON)
* Cleans up temporary files

## Best Practices

<AccordionGroup>
  <Accordion title="Scan Timing">
    Schedule intensive scans during maintenance windows. Use scan policies that balance thoroughness with scan duration. Nmap full port scans can take hours for large networks.
  </Accordion>

  <Accordion title="Credential Scanning">
    Use authenticated scanning whenever possible for more accurate results. Configure credentials in scanner policies for Windows, Linux, and database systems.
  </Accordion>

  <Accordion title="Network Segmentation">
    Select appropriate scan appliances (Qualys) or scanner locations based on network topology. Internal appliances provide better visibility for internal assets.
  </Accordion>

  <Accordion title="Concurrent Scans">
    Monitor concurrent scan limits for each platform:

    * Qualys: API limits vary by license
    * Nessus: License-based concurrent scan limits
    * OpenVAS: Resource-dependent
    * Nmap: No inherent limits (resource-bound)
  </Accordion>

  <Accordion title="API Keys and Credentials">
    Store API credentials securely. Update Qualys and Nessus credentials in SVM configuration before launching scans.
  </Accordion>
</AccordionGroup>

## Integration Architecture

```mermaid theme={null}
graph LR
    A[SVM] --> B{Scanner Type}
    B -->|API| C[Qualys Cloud]
    B -->|API| D[Nessus Server]
    B -->|OMP/SSH| E[OpenVAS Server]
    B -->|CLI/SSH| F[Nmap]
    C --> G[Project Reports]
    D --> G
    E --> G
    F --> G
```

## Next Steps

<CardGroup>
  <Card title="Mobile Tools" icon="mobile" href="/scanners/mobile-tools">
    Android application security analysis tools
  </Card>

  <Card title="Web Scanners" icon="globe" href="/scanners/web-scanners">
    Web application vulnerability scanners
  </Card>
</CardGroup>


# Web Scanners
Source: https://simplevulnerabilitymanager-svm.mintlify.app/scanners/web-scanners

Automated web application vulnerability scanning tools integrated with SVM

SVM integrates with leading web application security scanners to automate vulnerability detection in web applications. These tools perform comprehensive security assessments including testing for SQL injection, XSS, CSRF, and other OWASP Top 10 vulnerabilities.

## Available Tools

<CardGroup>
  <Card title="Acunetix" icon="shield-check" href="https://www.acunetix.com/">
    Industry-leading web vulnerability scanner supporting both automated and manual testing. SVM supports Acunetix v6.0-10.50 and v11.0+.
  </Card>

  <Card title="Burpsuite" icon="spider-web" href="https://portswigger.net/burp">
    Professional web security testing toolkit with integrated spider, scanner, and proxy. Works with Carbonator extension for automated scanning.
  </Card>

  <Card title="Netsparker" icon="bug" href="https://www.netsparker.com/">
    Automated web application security scanner with proof-based scanning technology to eliminate false positives.
  </Card>

  <Card title="Arachni" icon="spider" href="https://www.arachni-scanner.com/">
    Open-source web application security scanner framework supporting multiple platforms and authentication methods.
  </Card>
</CardGroup>

## Tool Capabilities

### Acunetix

Acunetix performs comprehensive web application security testing with features including:

* Deep crawling with JavaScript rendering (WebKit support)
* AcuSensor technology for enhanced detection accuracy
* Port scanning integration for network-level discovery
* Login sequence replay (.lsr files)
* Automated PDF report generation
* Concurrent scan management (up to 5 simultaneous scans)

<Info>
  **Version Support**: SVM automatically detects whether you're using Acunetix v6.0-10.50 (`wvs_console.exe`) or v11.0+ (`wvsc.exe`) and adjusts execution accordingly.
</Info>

**Script Reference**: [acunetix\_scan.bat](/scripts/acunetix)

### Burpsuite

Burpsuite integration enables professional web security testing workflows:

* Support for both JAR and EXE distributions
* Carbonator extension integration for automated crawling
* Configurable memory allocation (2GB default)
* Scheme, hostname, and port targeting
* Custom user-agent and scan configuration

<Info>
  **Requirements**: Burpsuite Pro license required for automated scanning features. Carbonator extension available at [integrissecurity.com](https://www.integrissecurity.com/index.php?resources=Carbonator)
</Info>

**Script Reference**: [burpsuite\_scan.bat](/scripts/burpsuite)

### Netsparker

Netsparker provides automated vulnerability scanning with:

* Custom profile support per project
* Proof-based scanning to minimize false positives
* HTML report generation
* Concurrent scan management (up to 2 simultaneous scans)
* Automated scan queuing and throttling

<Info>
  **Configuration**: Create named profiles in Netsparker matching your project names for automatic profile selection during scans.
</Info>

**Script Reference**: [netsparker\_scan.bat](/scripts/netsparker)

### Arachni

Arachni is a feature-rich open-source scanner supporting:

* Remote execution via SSH
* Login script plugins (browser-based and HTTP-based)
* Platform-specific checks (Windows/IIS/ASP.NET or Linux/Apache/PHP)
* Custom scope exclusion patterns
* Comprehensive audit coverage (links, forms, cookies, headers, JSON, XML, UI inputs)
* HTML report generation from .afr scan files

<Info>
  **Authentication**: Supports both browser-based login scripts (Watir/Selenium) and HTTP POST authentication. Login scripts should be placed in the project documentation folder.
</Info>

**Script Reference**: [arachni\_scan\_remote.bat](/scripts/arachni)

## Integration Workflow

All web scanners in SVM follow a consistent workflow:

1. **Project Setup**: Select target URL and scanner in SVM
2. **Configuration**: Login sequences and scan profiles are automatically loaded
3. **Scan Execution**: Scanner launches with project-specific parameters
4. **Report Generation**: Results exported to project documentation folder
5. **Evidence Collection**: Screenshots and findings imported into SVM project

## Authentication Support

Web scanners support various authentication methods:

* **Acunetix**: Login sequence replay files (.lsr)
* **Burpsuite**: Interactive login and session handling
* **Netsparker**: Profile-based authentication configuration
* **Arachni**: Login scripts (Ruby-based) for custom authentication flows

## Output Formats

Each scanner generates reports in standardized formats:

* **Acunetix**: PDF reports and .wvs project files
* **Burpsuite**: Native Burp project files
* **Netsparker**: HTML reports with detailed findings
* **Arachni**: HTML reports (converted from .afr format)

## Best Practices

<AccordionGroup>
  <Accordion title="Scan Scheduling">
    Use SVM's built-in delay mechanism to stagger multiple scans and avoid overwhelming target applications. Scans automatically queue when concurrent limits are reached.
  </Accordion>

  <Accordion title="Login Sequences">
    Test login sequences independently before launching full scans. Ensure session validation patterns (e.g., "Logout" link presence) are correctly configured.
  </Accordion>

  <Accordion title="Scope Management">
    Configure exclusion patterns to prevent scanners from triggering logout actions or testing out-of-scope functionality.
  </Accordion>

  <Accordion title="Resource Allocation">
    Monitor system resources when running multiple scanners concurrently. Each tool has different memory and CPU requirements.
  </Accordion>
</AccordionGroup>

## Next Steps

<CardGroup>
  <Card title="Service Scanners" icon="network-wired" href="/scanners/service-scanners">
    Network and service vulnerability scanning tools
  </Card>

  <Card title="Script Reference" icon="code" href="/scripts/acunetix">
    Detailed script documentation and parameters
  </Card>
</CardGroup>


# Acunetix Scanner Scripts
Source: https://simplevulnerabilitymanager-svm.mintlify.app/scripts/acunetix

Documentation for acunetix_scan.bat and acunetix_v11_scan.bat vulnerability scanning scripts

Two scripts are provided for Acunetix vulnerability scanning:

* **acunetix\_scan.bat** - Legacy script supporting Acunetix v6.0-10.50 and v11.0
* **acunetix\_v11\_scan.bat** - API-based script for Acunetix v11/v12 with advanced features

## acunetix\_scan.bat

Legacy Acunetix scanner that supports both command-line (v6.0-10.50) and newer console (v11.0) versions.

### Parameters

| Parameter       | Position | Description                                  |
| --------------- | -------- | -------------------------------------------- |
| `Proyecto`      | 1        | Project name for identification              |
| `DirApp`        | 2        | Directory path to Acunetix installation      |
| `URL`           | 3        | Target URL to scan                           |
| `Documentacion` | 4        | Output directory for scan reports            |
| `Timestamp`     | 5        | Timestamp for file naming                    |
| `NRO`           | 6        | Scan number (used for staggered start delay) |

### Usage

```batch theme={null}
acunetix_scan.bat "MyProject" "C:\Program Files\Acunetix" "http://example.com" "C:\Reports" "20260303_120000" "1"
```

### Features

* **Concurrent scan management**: Limits to maximum 5 concurrent scans
* **Staggered start**: Delays scan start based on NRO parameter (NRO × 20 seconds)
* **Auto-detection**: Automatically detects Acunetix version (v6-10.50 vs v11)
* **Login sequence support**: Uses Login.lsr file for authenticated scanning

### Script Behavior

#### For Acunetix v6.0-10.50 (wvs\_console.exe)

```batch theme={null}
wvs_console.exe /Scan %URL% /Profile Default /Settings default \
  /LoginSeq %Login% /Save /SaveFolder %Doc1% /SavetoDatabase \
  /GenerateReporte /ReporteFormat PDF /Timestamps /Verbose \
  --GetFirstOnly=FALSE --RobotsTxt=TRUE --UseWebKit=TRUE \
  --EnablePortScanning=TRUE --UseAcuSensor=TRUE
```

**Options enabled:**

* Default scanning profile
* PDF report generation
* WebKit browser engine
* Port scanning
* AcuSensor support
* robots.txt parsing

#### For Acunetix v11.0 (wvsc.exe)

```batch theme={null}
wvsc.exe /scan %URL% /profile Default /status \
  /login-sequence %Login% /allow-interactive-login /save %Doc2%
```

### Prerequisites

<Note>
  * Acunetix must be installed (either wvs\_console.exe or wvsc.exe)
  * Login.lsr file must exist in parent directory of Documentacion folder
  * Sufficient disk space for reports in Documentacion directory
</Note>

<Warning>
  The script limits concurrent scans to 5. Additional scans will wait (60 second intervals) until a slot becomes available.
</Warning>

***

## acunetix\_v11\_scan.bat

API-driven scanner for Acunetix v11 and v12 using REST API. Provides full automation including target creation, scan execution, and report generation.

### Parameters

| Parameter       | Position | Description                                                                    |
| --------------- | -------- | ------------------------------------------------------------------------------ |
| `Proyecto`      | 1        | Project name for target identification                                         |
| `URL`           | 2        | Target URL to scan                                                             |
| `APIURL`        | 3        | Acunetix API base URL (e.g., [https://127.0.0.1:3443](https://127.0.0.1:3443)) |
| `APIKEY`        | 4        | API authentication key (X-Auth header)                                         |
| `Documentacion` | 5        | Output directory for HTML and PDF reports                                      |
| `Timestamp`     | 6        | Timestamp for file naming                                                      |
| `NRO`           | 7        | Scan number (used for staggered start delay)                                   |

### Usage

```batch theme={null}
acunetix_v11_scan.bat "MyProject" "http://example.com" ^
  "https://127.0.0.1:3443" "1986b1e744d29b1c26ce8146874609988b92e85e60c07c4aa" ^
  "C:\Reports" "20260303_120000" "1"
```

### Required Dependencies

The script expects these tools in the same directory (`%~dp0`):

* **curl.exe** - For API requests
* **jq-win32.exe** - For JSON parsing

### API Workflow

The script executes the following API operations:

#### 1. Add Target

```bash theme={null}
curl -X POST -H "Content-Type: application/json" -H "X-Auth: API_KEY" \
  -d '{"address":"URL","description":"PROJECT","criticality":"10"}' \
  https://127.0.0.1:3443/api/v1/targets
```

**Endpoint**: `POST /api/v1/targets`\
**Returns**: `target_id`

#### 2. Start Scan

```bash theme={null}
curl -X POST -H "Content-Type: application/json" -H "X-Auth: API_KEY" \
  -d '{"profile_id":"11111111-1111-1111-1111-111111111111","target_id":"TARGET_ID"}' \
  https://127.0.0.1:3443/api/v1/scans
```

**Endpoint**: `POST /api/v1/scans`\
**Profile**: Full Scan (11111111-1111-1111-1111-111111111111)\
**Returns**: `scan_id` (from Location header)

#### 3. Monitor Scan Status

```bash theme={null}
curl -H "X-Auth: API_KEY" \
  https://127.0.0.1:3443/api/v1/scans/SCAN_ID
```

**Endpoint**: `GET /api/v1/scans/{scan_id}`\
**Polls**: Every 60 seconds\
**Status values**: `processing`, `queued`, `scheduled`, `starting`, `completed`, `failed`, `aborting`

#### 4. Generate Report

```bash theme={null}
curl -X POST -H "Content-Type: application/json" -H "X-Auth: API_KEY" \
  -d '{"template_id":"11111111-1111-1111-1111-111111111115","source":{"list_type":"scans","id_list":["SCAN_ID"]}}' \
  https://127.0.0.1:3443/api/v1/reports
```

**Endpoint**: `POST /api/v1/reports`\
**Template**: Affected Items (11111111-1111-1111-1111-111111111115)\
**Returns**: `report_id`

#### 5. Download Reports

```bash theme={null}
curl -H "X-Auth: API_KEY" \
  https://127.0.0.1:3443/api/v1/reports/REPORT_ID/download
```

**Endpoint**: `GET /api/v1/reports/{report_id}`\
**Formats**: HTML (download\[0]) and PDF (download\[1])

### Built-in Scan Profiles

The script uses the Full Scan profile. Available profiles:

| Profile                              | Profile ID                             |
| ------------------------------------ | -------------------------------------- |
| Full Scan                            | `11111111-1111-1111-1111-111111111111` |
| High Risk Vulnerabilities            | `11111111-1111-1111-1111-111111111112` |
| SQL Injection Vulnerabilities        | `11111111-1111-1111-1111-111111111113` |
| Weak Passwords                       | `11111111-1111-1111-1111-111111111115` |
| Cross-site Scripting Vulnerabilities | `11111111-1111-1111-1111-111111111116` |
| Crawl Only                           | `11111111-1111-1111-1111-111111111117` |

### Built-in Report Templates

The script uses the Affected Items template. Available templates:

| Template                   | Template ID                            |
| -------------------------- | -------------------------------------- |
| Developer                  | `11111111-1111-1111-1111-111111111111` |
| Quick                      | `11111111-1111-1111-1111-111111111112` |
| Executive Summary          | `11111111-1111-1111-1111-111111111113` |
| HIPAA                      | `11111111-1111-1111-1111-111111111114` |
| Affected Items             | `11111111-1111-1111-1111-111111111115` |
| CWE 2011                   | `11111111-1111-1111-1111-111111111116` |
| ISO 27001                  | `11111111-1111-1111-1111-111111111117` |
| NIST SP800 53              | `11111111-1111-1111-1111-111111111118` |
| OWASP Top 10 2013          | `11111111-1111-1111-1111-111111111119` |
| PCI DSS 3.2                | `11111111-1111-1111-1111-111111111120` |
| Sarbanes Oxley             | `11111111-1111-1111-1111-111111111121` |
| STIG DISA                  | `11111111-1111-1111-1111-111111111122` |
| WASC Threat Classification | `11111111-1111-1111-1111-111111111123` |
| Scan Comparison            | `11111111-1111-1111-1111-111111111124` |
| OWASP Top 10 2017          | `11111111-1111-1111-1111-111111111125` |

### Output Files

Generated reports:

* `AcunetixReport - {Timestamp}.html` - HTML format report
* `AcunetixReport - {Timestamp}.pdf` - PDF format report

### Error Handling

The script exits with error messages for:

* **Target creation failure**: `Error: Generando Target`
* **Scan start failure**: `Error: Iniciando Scan`
* **Scan stopped**: `Error: Se detuvo el escaneo`
* **Scan failed**: `Error: Error en el escaneo`
* **Scan aborted**: `Error: Scaneo detenido`
* **Report generation failure**: `Error: No se genero el Reporte`

### Advanced Configuration

The script includes commented-out code for advanced target configuration:

```json theme={null}
{
  "excluded_paths": ["manager", "phpmyadmin", "testphp"],
  "user_agent": "Mozilla/5.0...",
  "custom_headers": ["Accept: */*", "Connection: Keep-alive"],
  "custom_cookies": [{"url": "...", "cookie": "..."}],
  "scan_speed": "moderate",
  "technologies": ["PHP"],
  "proxy": {"enabled": false, "address": "127.0.0.1", "port": 8080},
  "login": {"kind": "automatic", "credentials": {"enabled": false}},
  "authentication": {"enabled": false}
}
```

To enable, uncomment and modify lines 36-37 in acunetix\_v11\_scan.bat:36-37.

### Prerequisites

<Note>
  * Acunetix v11 or v12 must be installed and running
  * API must be accessible at APIURL
  * Valid API key with scan permissions
  * curl.exe and jq-win32.exe in script directory
</Note>

<Warning>
  The script automatically opens the HTML report in the default browser upon completion. The PDF report is generated but not automatically opened.
</Warning>


# AndroBugs Framework Script
Source: https://simplevulnerabilitymanager-svm.mintlify.app/scripts/androbugs

Automated Android vulnerability analysis with severity classification

The AndroBugs Framework script performs automated security analysis of Android APK files on remote Linux servers, generating detailed text reports with vulnerability classifications and severity ratings.

## Overview

**Script**: `androbugs_framework.bat`

**Platform**: Windows (SSH client for remote Linux execution)

**Purpose**: Automated Android APK security analysis with detailed vulnerability reporting

## Tool Information

**AndroBugs Framework**: Android Security Analysis Tool

* **Developer**: AndroBugs Team
* **Repository**: `https://github.com/AndroBugs/AndroBugs_Framework`
* **Type**: Efficient Android vulnerability scanner
* **Language**: Python
* **Output**: Text-based vulnerability reports with severity ratings

### Installation

From install scripts (Linux):

```bash theme={null}
cd ~
git clone --depth 1 https://github.com/AndroBugs/AndroBugs_Framework
cd AndroBugs_Framework
```

No additional dependencies required - uses standard Python libraries.

## Script Parameters

```batch theme={null}
androbugs_framework.bat <PathAPK> <FileApk> <Timestamp> <Documentacion> <DirApp> <Server> <Username> <Password>
```

| Parameter       | Description                   | Example                     |
| --------------- | ----------------------------- | --------------------------- |
| `PathAPK`       | Local path to APK file        | `C:\samples\app.apk`        |
| `FileApk`       | APK filename (no extension)   | `app`                       |
| `Timestamp`     | Unique timestamp identifier   | `20230615_143022`           |
| `Documentacion` | Local output directory        | `C:\reports`                |
| `DirApp`        | AndroBugs directory on server | `/root/AndroBugs_Framework` |
| `Server`        | SSH server hostname/IP        | `192.168.1.100`             |
| `Username`      | SSH username                  | `root`                      |
| `Password`      | SSH password                  | `password123`               |

## Analysis Workflow

<Steps>
  <Step title="Create Temp Directory">
    Creates timestamped directory on remote server for analysis.

    ```batch theme={null}
    plink.exe -P 22 -ssh -l %Username% -pw %Password% -C %Server% ^
      "mkdir '/tmp/%Timestamp%'"
    ```
  </Step>

  <Step title="Upload APK">
    Transfers APK file to remote temporary directory.

    ```batch theme={null}
    pscp.exe -l %Username% -pw %Password% -C "%PathAPK%" ^
      %Server%:"/tmp/%Timestamp%/%FileApk%_%Timestamp%.apk"
    ```
  </Step>

  <Step title="Execute Analysis">
    Runs AndroBugs Framework with specified parameters.

    ```bash theme={null}
    cd '/root/AndroBugs_Framework'
    python ./androbugs.py \
      -f '/tmp/20230615_143022/app_20230615_143022.apk' \
      -e 2 \
      -o '/tmp/20230615_143022'
    ```

    Analysis is performed directly on the server.
  </Step>

  <Step title="Download Report">
    Transfers generated text report back to local machine.

    ```batch theme={null}
    pscp.exe -P 22 -l %Username% -pw %Password% -C ^
      %Server%:"/tmp/%Timestamp%/*.txt" %Documentacion%
    ```
  </Step>

  <Step title="Cleanup">
    Removes temporary directory and files from server.

    ```batch theme={null}
    plink.exe -P 22 -ssh -l %Username% -pw %Password% -C %Server% ^
      "rm -f '/tmp/%Timestamp%/'"
    ```
  </Step>
</Steps>

## Script Implementation

```batch theme={null}
@echo off
setlocal
set PathAPK=%1
set FileApk=%2
set Timestamp=%3
set Documentacion=%4
set DirApp=%5
set Server=%6
set Username=%7
set Password=%8

set PathAPK=%PathAPK:"=%
set FileApk=%FileApk:"=%
set DirApp=%DirApp:"=%
set Documentacion=%Documentacion:"=%
set Documentacion="%Documentacion%\AndroBugs_Framework - %FileApk%_%Timestamp%.txt"

@title=[AndroBugs_Framework] - %FileApk%

# Create temp directory
"%~dp0plink.exe" -P 22 -ssh -l %Username% -pw %Password% -C %Server% ^
  "mkdir '/tmp/%Timestamp%'"

# Upload APK
"%~dp0pscp.exe" -l %Username% -pw %Password% -C "%PathAPK%" ^
  %Server%:"/tmp/%Timestamp%/%FileApk%_%Timestamp%.apk"

# Run analysis
"%~dp0plink.exe" -P 22 -ssh -l %Username% -pw %Password% -C %Server% ^
  "cd '%DirApp%' ; python ./androbugs.py -f '/tmp/%Timestamp%/%FileApk%_%Timestamp%.apk' -e 2 -o '/tmp/%Timestamp%'"

# Download report
"%~dp0pscp.exe" -P 22 -l %Username% -pw %Password% -C ^
  %Server%:"/tmp/%Timestamp%/*.txt" %Documentacion%

# Cleanup
"%~dp0plink.exe" -P 22 -ssh -l %Username% -pw %Password% -C %Server% ^
  "rm -f '/tmp/%Timestamp%/'"

echo %Documentacion%
pause
```

## Command Line Options

### AndroBugs Parameters

```bash theme={null}
python ./androbugs.py -f <APK_PATH> -e <EFFICIENCY_MODE> -o <OUTPUT_DIR>
```

| Option | Description                      | Value in Script                              |
| ------ | -------------------------------- | -------------------------------------------- |
| `-f`   | Path to APK file to analyze      | `/tmp/<Timestamp>/<FileApk>_<Timestamp>.apk` |
| `-e`   | Efficiency mode (analysis depth) | `2` (Standard mode)                          |
| `-o`   | Output directory for report      | `/tmp/<Timestamp>`                           |

### Efficiency Modes

| Mode | Description   | Analysis Speed | Detail Level           |
| ---- | ------------- | -------------- | ---------------------- |
| `1`  | Fast mode     | Fastest        | Basic checks only      |
| `2`  | Standard mode | Balanced       | Comprehensive analysis |
| `3`  | Deep mode     | Slowest        | Maximum detail         |

The script uses mode `2` for balanced performance and coverage.

## Report Format

### Text Report Structure

The generated report contains:

```
[INFO] APK Information
[INFO] Package Name: com.example.app
[INFO] Version: 1.0
[INFO] Min SDK: 21
[INFO] Target SDK: 30

[CRITICAL] Critical Vulnerabilities
- Exported components without permission
- Hardcoded cryptographic keys

[WARNING] Security Warnings  
- Debug mode enabled
- Backup allowed

[NOTICE] Security Notices
- Uses external storage
- Network communication detected

[INFO] Information Items
- Certificate details
- Permissions list
```

### Severity Levels

| Level      | Color  | Description                                     |
| ---------- | ------ | ----------------------------------------------- |
| `CRITICAL` | Red    | Immediate security risks requiring urgent fixes |
| `WARNING`  | Yellow | Security issues that should be addressed        |
| `NOTICE`   | Blue   | Potential security concerns to review           |
| `INFO`     | White  | Informational findings, no direct risk          |

## Vulnerability Categories

AndroBugs Framework checks for:

### Critical Issues

* **SSL/TLS Security**: Certificate validation, hostname verification
* **Cryptography**: Weak algorithms, hardcoded keys, ECB mode usage
* **WebView Security**: JavaScript injection, file access vulnerabilities
* **Database Security**: Unencrypted SQLite databases
* **Code Injection**: Dynamic code loading, reflection abuse

### Warnings

* **Exported Components**: Unprotected activities, services, receivers
* **Debug Features**: Debuggable flag, logging sensitive data
* **Backup Security**: Android backup enabled for sensitive apps
* **External Storage**: Writing sensitive data to SD card
* **Permissions**: Dangerous permission usage

### Notices

* **Network Communication**: HTTP usage, clear-text traffic
* **Third-party Libraries**: Known vulnerable library versions
* **Code Obfuscation**: ProGuard/R8 configuration analysis
* **Content Providers**: SQL injection vulnerabilities

### Information

* **Certificate Details**: Signing certificate information
* **Permissions List**: All requested permissions
* **Components**: Application components inventory
* **API Usage**: Sensitive API calls detected

## Output Location

### Report File Naming

```
<Documentacion>\AndroBugs_Framework - <FileApk>_<Timestamp>.txt
```

Example:

```
C:\reports\AndroBugs_Framework - vulnerable_app_20230615_143022.txt
```

### Report Contents Example

```text theme={null}
====================================================================================
AndroBugs Framework Report
====================================================================================

[INFO] APK Path: /tmp/20230615_143022/vulnerable_app_20230615_143022.apk
[INFO] Package Name: com.example.vulnerable
[INFO] Version Code: 1
[INFO] Version Name: 1.0
[INFO] Min SDK: 21
[INFO] Target SDK: 30

====================================================================================
[CRITICAL] <SSL_Security> SSL Implementation Checking
====================================================================================
Severity: CRITICAL

The app uses SSL/TLS connection but does not properly verify the server certificate.

This may allow attackers to perform Man-in-the-Middle attacks.

Files:
- com/example/vulnerable/NetworkManager.java

====================================================================================
[WARNING] <Hacker_Debug_Mode> Debug Mode Checking
====================================================================================
Severity: WARNING

The application is debuggable. This allows attackers to easily inspect and modify
the app's behavior at runtime.

AndroidManifest.xml:
- android:debuggable="true"

====================================================================================
```

## Usage Example

```batch theme={null}
androbugs_framework.bat ^
  "C:\samples\vulnerable_app.apk" ^
  "vulnerable_app" ^
  "20230615_143022" ^
  "C:\reports" ^
  "/root/AndroBugs_Framework" ^
  "192.168.1.100" ^
  "root" ^
  "password123"
```

## Comparison with Other Tools

| Feature             | AndroBugs | MobSF     | QARK |
| ------------------- | --------- | --------- | ---- |
| Output Format       | Text      | PDF       | HTML |
| Exploit Generation  | No        | No        | Yes  |
| Analysis Speed      | Fast      | Medium    | Slow |
| Report Detail       | High      | Very High | High |
| Server Required     | Yes       | Yes       | Yes  |
| Automation Friendly | Excellent | Good      | Good |

## Performance Characteristics

* **Analysis Time**: 2-5 minutes for typical APK
* **Large APKs**: 10-15 minutes for complex applications
* **Resource Usage**: Lightweight compared to MobSF/QARK
* **Network Transfer**: Minimal (APK upload + text report download)

## Troubleshooting

### Python Not Found

```
python: command not found
```

**Solution**: Install Python on remote server:

```bash theme={null}
apt-get install python python-pip -y
```

### Script Not Found

```
python: can't open file './androbugs.py': [Errno 2] No such file or directory
```

**Solution**: Verify AndroBugs Framework installation:

```bash theme={null}
cd /root
git clone --depth 1 https://github.com/AndroBugs/AndroBugs_Framework
ls -la AndroBugs_Framework/androbugs.py
```

### Directory Already Exists

If timestamp directory already exists:

```bash theme={null}
# Manual cleanup
ssh root@192.168.1.100
rm -rf /tmp/20230615_143022
```

### Permission Denied

```
mkdir: cannot create directory '/tmp/20230615_143022': Permission denied
```

**Solution**: Ensure SSH user has write permissions to `/tmp/`:

```bash theme={null}
chmod 1777 /tmp
```

### Report Download Failed

If report file not found:

* Check analysis completed successfully
* Verify output path in `-o` parameter
* Look for Python errors in SSH output

## Advanced Usage

### Custom Analysis Mode

Modify script to use deep analysis:

```batch theme={null}
# Change -e 2 to -e 3 in script
python ./androbugs.py -f '/tmp/%Timestamp%/%FileApk%_%Timestamp%.apk' -e 3 -o '/tmp/%Timestamp%'
```

### Multiple APK Analysis

Batch process multiple APKs:

```batch theme={null}
for %%f in (C:\samples\*.apk) do (
  androbugs_framework.bat "%%f" "%%~nf" "%date:~-4%%date:~3,2%%date:~0,2%_%%time:~0,2%%%%time:~3,2%%%%time:~6,2%%" ^
    "C:\reports" "/root/AndroBugs_Framework" "192.168.1.100" "root" "password123"
)
```

### Parse Report for CI/CD

Extract critical findings:

```batch theme={null}
findstr /C:"[CRITICAL]" "AndroBugs_Framework - app_20230615_143022.txt"

# Exit with error if critical issues found
findstr /C:"[CRITICAL]" "report.txt" && exit 1
```

## Integration with SVM

AndroBugs Framework integrates with Simple Vulnerability Manager:

1. **Automated Scanning**: Called from SVM web interface
2. **Report Storage**: Results stored in project documentation folder
3. **Centralized Management**: All mobile app scans tracked in SVM database
4. **Timestamp Tracking**: Unique identifiers for version comparison

## Security Considerations

* **Credentials**: Script uses plain-text SSH passwords
* **Network**: Ensure SSH traffic is on secure network
* **Data Protection**: Reports may contain sensitive app information
* **Cleanup**: Temporary files automatically removed from server
* **Access Control**: Restrict access to report files

## Related Scripts

* `mobsf.bat`: PDF-based comprehensive mobile security analysis
* `qark.bat`: HTML reports with exploit generation
* `apktool_decode_local.bat`: Manual code review and modification


# Apktool Scripts
Source: https://simplevulnerabilitymanager-svm.mintlify.app/scripts/apktool

APK decoding, building, signing, and installation automation scripts

Apktool scripts automate the complete APK analysis workflow from decompilation to installation. These scripts handle local and remote execution, APK rebuilding, signing with certificates, and device installation.

## Overview

| Script                      | Purpose                       | Environment   |
| --------------------------- | ----------------------------- | ------------- |
| `apktool_decode_local.bat`  | Decode APK locally            | Windows       |
| `apktool_decode_remote.bat` | Decode APK on remote server   | Windows (SSH) |
| `apktool_build_local.bat`   | Rebuild APK from source       | Windows       |
| `apk_sign_local.bat`        | Sign APK with certificate     | Windows       |
| `apk_install_local.bat`     | Install APK to Android device | Windows       |

## Tool Version

**Apktool**: v2.4.0 (from install scripts)

Download: `https://bitbucket.org/iBotPeaches/apktool/downloads/apktool_2.4.0.jar`

## APK Analysis Workflow

<Steps>
  <Step title="Decode APK">
    Decompile the APK to extract resources, manifest, and smali code.

    Choose local or remote execution based on your environment.
  </Step>

  <Step title="Analyze & Modify">
    Review the decompiled code, AndroidManifest.xml, and resources.

    Make necessary modifications for security testing or research.
  </Step>

  <Step title="Rebuild APK">
    Recompile the modified source back into an APK file.

    The build process creates a new APK in the `dist/` subdirectory.
  </Step>

  <Step title="Sign APK">
    Sign the rebuilt APK with a certificate for installation.

    Uses uber-apk-signer for automatic signing and alignment.
  </Step>

  <Step title="Install APK">
    Install the signed APK to an Android device or emulator.

    Uses ADB to push and install the application.
  </Step>
</Steps>

## apktool\_decode\_local.bat

Decodes an APK file locally using Apktool, extracting all resources and code.

### Parameters

```batch theme={null}
apktool_decode_local.bat <AppExe> <PathAPK> <FileApk> <Timestamp> <Documentacion>
```

| Parameter       | Description                 | Example                        |
| --------------- | --------------------------- | ------------------------------ |
| `AppExe`        | Path to apktool.jar         | `C:\tools\apktool\apktool.jar` |
| `PathAPK`       | Full path to APK file       | `C:\apps\sample.apk`           |
| `FileApk`       | APK filename (no extension) | `sample`                       |
| `Timestamp`     | Unique timestamp identifier | `20230615_143022`              |
| `Documentacion` | Output directory path       | `C:\reports`                   |

### Script Implementation

```batch theme={null}
@echo off
setlocal
set AppExe=%1
set PathAPK=%2
set FileApk=%~n3
set Timestamp=%4
set Documentacion=%5

set JAVA="java.exe"
set FileApk=%FileApk:"=%
set Documentacion=%Documentacion:"=%

@title=[Apktool - Local] - %FileApk%

copy %PathAPK% "%Documentacion%\%FileApk%_%Timestamp%.apk"
%JAVA% -jar %AppExe% d "%Documentacion%\%FileApk%_%Timestamp%.apk" -o "%Documentacion%\%FileApk%_%Timestamp%"
echo "%Documentacion%\%FileApk%_%Timestamp%"
pause
```

### Output Structure

```
Documentacion/
├── sample_20230615_143022.apk          # Original APK copy
└── sample_20230615_143022/             # Decoded output
    ├── AndroidManifest.xml             # Decoded manifest
    ├── apktool.yml                     # Build metadata
    ├── res/                            # Resources
    ├── smali/                          # Dalvik bytecode
    └── original/                       # Original files
```

### Usage Example

```batch theme={null}
apktool_decode_local.bat ^
  "C:\tools\apktool\apktool.jar" ^
  "C:\samples\vulnerable_app.apk" ^
  "vulnerable_app" ^
  "20230615_143022" ^
  "C:\analysis\reports"
```

## apktool\_decode\_remote.bat

Decodes an APK file on a remote Linux server via SSH, useful for distributed analysis.

### Parameters

```batch theme={null}
apktool_decode_remote.bat <PathAPK> <FileApk> <Timestamp> <Documentacion> <AppExe> <Server> <Username> <Password>
```

| Parameter       | Description                 | Example                     |
| --------------- | --------------------------- | --------------------------- |
| `PathAPK`       | Local path to APK file      | `C:\samples\app.apk`        |
| `FileApk`       | APK filename (no extension) | `app`                       |
| `Timestamp`     | Unique timestamp identifier | `20230615_143022`           |
| `Documentacion` | Local output directory      | `C:\reports`                |
| `AppExe`        | Remote path to apktool.jar  | `/root/apktool/apktool.jar` |
| `Server`        | SSH server hostname/IP      | `192.168.1.100`             |
| `Username`      | SSH username                | `root`                      |
| `Password`      | SSH password                | `password123`               |

### Workflow

<Steps>
  <Step title="Upload APK">
    Transfers APK to `/tmp/` on remote server using `pscp.exe`.
  </Step>

  <Step title="Execute Apktool">
    Runs Apktool on remote server with Java runtime.
  </Step>

  <Step title="Archive Results">
    Creates tar.gz archive of APK and decoded directory.
  </Step>

  <Step title="Download Report">
    Transfers archive back to local machine.
  </Step>

  <Step title="Cleanup">
    Removes temporary files from remote server.
  </Step>
</Steps>

### Script Implementation

```batch theme={null}
set JAVA=/usr/bin/java

"%~dp0pscp.exe" -P 22 -l %Username% -pw %Password% -C "%PathAPK%" %Server%:"/tmp/%FileApk%_%Timestamp%.apk"

"%~dp0plink.exe" -no-antispoof -ssh -P 22 -l %Username% -pw %Password% -C %Server% ^
  "cd /tmp ; %JAVA% -jar '%AppExe%' d '/tmp/%FileApk%_%Timestamp%.apk'"

"%~dp0plink.exe" -no-antispoof -ssh -P 22 -l %Username% -pw %Password% -C %Server% ^
  "cd /tmp ; tar -cvzf 'ApktoolReport - %FileApk%_%Timestamp%.tar.gz' '%FileApk%_%Timestamp%.apk' '%FileApk%_%Timestamp%'"

"%~dp0pscp.exe" -P 22 -l %Username% -pw %Password% -C ^
  %Server%:"/tmp/ApktoolReport - %FileApk%_%Timestamp%.tar.gz" %Documentacion%
```

### Usage Example

```batch theme={null}
apktool_decode_remote.bat ^
  "C:\samples\app.apk" ^
  "app" ^
  "20230615_143022" ^
  "C:\reports" ^
  "/root/apktool/apktool.jar" ^
  "192.168.1.100" ^
  "root" ^
  "password123"
```

## apktool\_build\_local.bat

Rebuilds an APK from decoded source code, with optional signing step.

### Parameters

```batch theme={null}
apktool_build_local.bat <AppExe> <PathDirAPK> <AppExeSign>
```

| Parameter    | Description                 | Example                          |
| ------------ | --------------------------- | -------------------------------- |
| `AppExe`     | Path to apktool.jar         | `C:\tools\apktool\apktool.jar`   |
| `PathDirAPK` | Decoded APK directory       | `C:\reports\app_20230615_143022` |
| `AppExeSign` | Path to uber-apk-signer.jar | `C:\tools\uber-apk-signer.jar`   |

### Build Process

The script:

1. Extracts the directory name from the path
2. Builds the APK using Apktool
3. Creates output in `dist/` subdirectory
4. Prompts for optional signing
5. Calls `apk_sign_local.bat` if user confirms

### Script Implementation

```batch theme={null}
set JAVA="java.exe"
set PathDirAPK=%PathDirAPK:"=%
if %PathDirAPK:~-1% == \ set PathDirAPK=%PathDirAPK:~0,-1%
for %%i in (%PathDirAPK%) do set LastDirAPK=%%~nxi

%JAVA% -jar %AppExe% b "%PathDirAPK%"

echo "%PathDirAPK%\dist\%LastDirAPK%.apk"

:retry
echo Want to sign the apk?
set /p respuesta="Yes/No(y/n)"
if %respuesta% == y (
  call apk_sign_local.bat %AppExeSign% "%PathDirAPK%\dist\%LastDirAPK%.apk"
) else (
  if %respuesta% == n (
    goto :fin
  ) else (
    goto :retry
  )
)
```

### Output Location

Built APK is created at:

```
<PathDirAPK>\dist\<directory_name>.apk
```

Example:

```
C:\reports\app_20230615_143022\dist\app_20230615_143022.apk
```

### Usage Example

```batch theme={null}
apktool_build_local.bat ^
  "C:\tools\apktool\apktool.jar" ^
  "C:\reports\app_20230615_143022" ^
  "C:\tools\uber-apk-signer\uber-apk-signer.jar"
```

## apk\_sign\_local.bat

Signs an APK file using uber-apk-signer for installation compatibility.

### Parameters

```batch theme={null}
apk_sign_local.bat <AppExe> <PathAPK>
```

| Parameter | Description                 | Example                        |
| --------- | --------------------------- | ------------------------------ |
| `AppExe`  | Path to uber-apk-signer.jar | `C:\tools\uber-apk-signer.jar` |
| `PathAPK` | Path to APK file to sign    | `C:\apps\modified.apk`         |

### Signing Tool

**Uber APK Signer**: v1.0.0

Download: `https://github.com/patrickfav/uber-apk-signer/releases/download/v1.0.0/uber-apk-signer-1.0.0.jar`

The tool automatically:

* Creates debug keystore if needed
* Signs the APK
* Aligns the APK with zipalign
* Overwrites the original file

### Script Implementation

```batch theme={null}
java.exe -jar %AppExe% -a %PathAPK% --overwrite
echo %PathAPK%
pause
```

### Manual Signing (Alternative)

The script includes commented examples for manual signing:

```batch theme={null}
# Generate keystore
keytool -genkey -keystore keystore.ks -alias android -keyalg RSA -keysize 2048 ^
  -validity 365 -dname "C=US, O=Android, CN=Android Debug"

# Sign APK
jarsigner -verbose -sigalg MD5withRSA -digestalg SHA1 -keystore keystore.ks ^
  app.apk android

# Verify alignment
zipalign -c -v 4 app.apk
```

### Usage Example

```batch theme={null}
apk_sign_local.bat ^
  "C:\tools\uber-apk-signer\uber-apk-signer.jar" ^
  "C:\reports\app_20230615_143022\dist\app_20230615_143022.apk"
```

## apk\_install\_local.bat

Installs a signed APK to an Android device or emulator using ADB.

### Parameters

```batch theme={null}
apk_install_local.bat <PathAPK> <FileAPK> <Timestamp> <Documentacion>
```

| Parameter       | Description                 | Example              |
| --------------- | --------------------------- | -------------------- |
| `PathAPK`       | Path to signed APK file     | `C:\apps\signed.apk` |
| `FileAPK`       | APK filename                | `signed.apk`         |
| `Timestamp`     | Unique timestamp identifier | `20230615_143022`    |
| `Documentacion` | Log output directory        | `C:\reports`         |

### Installation Process

<Steps>
  <Step title="Kill ADB Server">
    Stops any running ADB server instances.

    ```batch theme={null}
    adb.exe kill-server
    ```
  </Step>

  <Step title="Start ADB Server">
    Starts fresh ADB server and detects connected devices.

    ```batch theme={null}
    adb.exe start-server
    ```
  </Step>

  <Step title="Install APK">
    Pushes and installs APK to connected Android device.

    ```batch theme={null}
    adb.exe install <PathAPK>
    ```
  </Step>
</Steps>

### Script Implementation

```batch theme={null}
@echo off
setlocal
set PathAPK=%1
set FileAPK=%2
set Timestamp=%3
set Documentacion=%4

set Documentacion=%Documentacion:"=%
set Documentacion="%Documentacion%\apk_install - %Timestamp%.txt"

@title=[ADB]

echo Kill-server
"%~dp0adb\windows\adb.exe" kill-server

echo Start-server
"%~dp0adb\windows\adb.exe" start-server

echo Installing...
"%~dp0adb\windows\adb.exe" install %PathAPK%

echo Done
pause
```

### Prerequisites

* Android device connected via USB with USB debugging enabled
* ADB drivers installed on Windows
* Device authorized for debugging (accept RSA key fingerprint)

### Usage Example

```batch theme={null}
apk_install_local.bat ^
  "C:\reports\app_20230615_143022\dist\app_20230615_143022.apk" ^
  "app_20230615_143022.apk" ^
  "20230615_143022" ^
  "C:\reports"
```

### Troubleshooting

**Device not found:**

```batch theme={null}
# Check connected devices
adb.exe devices

# Verify USB debugging is enabled on device
# Accept RSA key fingerprint when prompted
```

**Installation failed:**

```batch theme={null}
# Uninstall existing app first
adb.exe uninstall com.example.package

# Try install again
adb.exe install -r app.apk  # -r flag for reinstall
```

## Complete Workflow Example

Here's a complete example of analyzing and modifying an APK:

```batch theme={null}
# 1. Decode APK locally
apktool_decode_local.bat ^
  "C:\tools\apktool\apktool.jar" ^
  "C:\samples\vulnerable_app.apk" ^
  "vulnerable_app" ^
  "20230615_143022" ^
  "C:\reports"

# 2. Modify the decoded files as needed
# Edit files in C:\reports\vulnerable_app_20230615_143022\

# 3. Rebuild the APK
apktool_build_local.bat ^
  "C:\tools\apktool\apktool.jar" ^
  "C:\reports\vulnerable_app_20230615_143022" ^
  "C:\tools\uber-apk-signer\uber-apk-signer.jar"
# Answer 'y' when prompted to sign

# 4. Install to device
apk_install_local.bat ^
  "C:\reports\vulnerable_app_20230615_143022\dist\vulnerable_app_20230615_143022.apk" ^
  "vulnerable_app_20230615_143022.apk" ^
  "20230615_143022" ^
  "C:\reports"
```

## Related Tools

* **ADB (Android Debug Bridge)**: Platform tools for device communication
* **JD-GUI**: Java decompiler for viewing DEX bytecode
* **Enjarify**: Convert Dalvik bytecode to Java bytecode


# Arachni Remote Scanner Script
Source: https://simplevulnerabilitymanager-svm.mintlify.app/scripts/arachni

Documentation for arachni_scan_remote.bat remote vulnerability scanning with SSH

Remote Arachni vulnerability scanner that executes scans on a remote Linux server via SSH and retrieves results.

## Overview

The `arachni_scan_remote.bat` script connects to a remote Linux server running Arachni, executes a comprehensive vulnerability scan, generates HTML reports, and downloads the results. It uses PuTTY tools (plink and pscp) for SSH communication.

## Parameters

| Parameter       | Position | Description                          |
| --------------- | -------- | ------------------------------------ |
| `Proyecto`      | 1        | Project name for identification      |
| `URL`           | 2        | Target URL to scan                   |
| `Documentacion` | 3        | Local output directory for reports   |
| `Timestamp`     | 4        | Timestamp for file naming            |
| `NRO`           | 5        | Scan number identifier               |
| `Server`        | 6        | Remote server hostname or IP address |
| `Username`      | 7        | SSH username for remote server       |
| `Password`      | 8        | SSH password for authentication      |

## Usage

```batch theme={null}
arachni_scan_remote.bat "MyWebApp" "http://example.com" ^
  "C:\Reports" "20260303_120000" "1" ^
  "scanner.company.com" "scanuser" "SecureP@ss123"
```

## Prerequisites

<Note>
  **Required tools in script directory:**

  * **plink.exe** - PuTTY command-line SSH client
  * **pscp.exe** - PuTTY secure copy (SCP) client
  * **Login\_fast.rb** - Login script template (copied to remote server)

  **Remote server requirements:**

  * Arachni installed and in PATH
  * SSH server running on port 22
  * Write access to /tmp directory
  * Ruby installed (for login scripts)
</Note>

## Script Workflow

### 1. Upload Login Script

Copies the local login script to the remote server:

```batch theme={null}
pscp.exe -P 22 -l USERNAME -pw PASSWORD -C "%Documentacion%Login_fast.rb" SERVER:"/tmp/Login"
plink.exe -ssh -P 22 -l USERNAME -pw PASSWORD -C SERVER "chmod 755 /tmp/Login"
```

Source: `%~dp0Login_fast.rb` → Destination: `/tmp/Login` on remote server

### 2. Execute Arachni Scan

Runs a comprehensive Arachni scan on the remote server:

```bash theme={null}
arachni --output-verbose --output-only-positives \
  --http-user-agent='USER_AGENT' \
  --audit-links --audit-forms --audit-cookies --audit-headers \
  --audit-jsons --audit-xmls --audit-ui-inputs --audit-ui-forms \
  --checks=* \
  --plugin=login_script:script=/tmp/Login \
  --scope-exclude-pattern=PATTERN \
  --platforms=PLATFORM \
  --report-save-path='/tmp/ArachniReport - TIMESTAMP.afr' \
  URL
```

### 3. Generate HTML Report

Converts the Arachni Framework Report (.afr) to HTML:

```bash theme={null}
arachni_reporter '/tmp/ArachniReport - TIMESTAMP.afr' \
  --reporter=html:outfile='/tmp/ArachniReport - TIMESTAMP.zip'
```

### 4. Download and Cleanup

Retrieves the report and removes remote files:

```batch theme={null}
pscp.exe -P 22 -l USERNAME -pw PASSWORD -C SERVER:"/tmp/ArachniReport - TIMESTAMP.zip" "%Documentacion%\ArachniReport - TIMESTAMP.zip"
plink.exe -ssh -P 22 -l USERNAME -pw PASSWORD -C SERVER "rm -fr '/tmp/Login' '/tmp/ArachniReport - TIMESTAMP.zip' '/tmp/ArachniReport - TIMESTAMP.afr'"
```

## Scan Configuration

### Default Platform Settings

The script is configured for Windows/IIS/ASP.NET applications:

```batch theme={null}
set plataform=windows,sql,iis,aspx
```

For Linux/Apache/PHP applications, uncomment arachni\_scan\_remote.bat:23:

```batch theme={null}
set plataform=linux,mysql,apache,php
```

View all available platforms:

```bash theme={null}
arachni --platforms-list
```

### Scope Exclusion

The script excludes logout pages to prevent session termination:

```batch theme={null}
set scope-exclude-pattern=Logout
```

Modify at arachni\_scan\_remote.bat:21 to exclude other patterns:

```batch theme={null}
set scope-exclude-pattern=Logout|admin|manager|phpmyadmin
```

### User Agent

Default user agent:

```
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.112 Safari/537.36
```

## Audit Modules

The script enables all audit modules:

| Module              | Description                       |
| ------------------- | --------------------------------- |
| `--audit-links`     | Audit links and query parameters  |
| `--audit-forms`     | Audit HTML forms                  |
| `--audit-cookies`   | Audit cookies for vulnerabilities |
| `--audit-headers`   | Audit HTTP headers                |
| `--audit-jsons`     | Audit JSON inputs                 |
| `--audit-xmls`      | Audit XML inputs                  |
| `--audit-ui-inputs` | Audit UI input elements           |
| `--audit-ui-forms`  | Audit UI form elements            |
| `--checks=*`        | Run all vulnerability checks      |

## Login Script Configuration

The script uses the `login_script` plugin with `/tmp/Login` for authenticated scanning.

### Fast Login (No Browser)

Example login script structure in `Login_fast.rb`:

```ruby theme={null}
response = http.post( 'http://example.com/login.php',
    parameters:     {
        'username' => 'test',
        'password' => 'test'
    },
    mode:           :sync,
    update_cookies: true
)
framework.options.session.check_url     = to_absolute( response.headers.location, response.url )
framework.options.session.check_pattern = /Logout|Sign out|Cerrar Sesion/
```

### Browser-Based Login (Commented)

For complex login forms requiring JavaScript, see comments at arachni\_scan\_remote.bat:32-44:

```ruby theme={null}
browser.goto 'http://testphp.acunetix.com/login.php'
form = browser.form( id: 'loginform' )
form.text_field( name: 'uname' ).set 'test'
form.text_field( name: 'pass' ).set 'test'
form.submit
framework.options.session.check_url     = browser.url
framework.options.session.check_pattern = /Logout/
```

**Note**: Browser-based login requires additional gems:

```bash theme={null}
gem install watir-webdriver
gem install selenium-webdriver
```

### Alternative: AutoLogin Plugin

For simple form-based authentication, use the `autologin` plugin (see comments at arachni\_scan\_remote.bat:63-65):

```batch theme={null}
set LoginPage=%URL%/login.php
--plugin=autologin:url=%LoginPage%,parameters='username=test&password=test',check='Logout'
```

## HTTP Authentication

For HTTP Basic/Digest authentication, uncomment and configure arachni\_scan\_remote.bat:16-19:

```batch theme={null}
set http-username=Admin
set http-password=Password
--http-authentication-username=%http-username% --http-authentication-password=%http-password%
```

## Output Files

### Local Report

Downloaded to:

```
%Documentacion%\ArachniReport - {Timestamp}.zip
```

Extract the ZIP to access the HTML report.

### Remote Files (Auto-Deleted)

* `/tmp/Login` - Login script
* `/tmp/ArachniReport - {Timestamp}.afr` - Arachni Framework Report
* `/tmp/ArachniReport - {Timestamp}.zip` - HTML report archive

All remote files are deleted after download.

## Example Usage Scenarios

### Windows/IIS Application

```batch theme={null}
arachni_scan_remote.bat "CorporatePortal" "https://portal.company.com" ^
  "D:\Scans" "20260303_140000" "1" ^
  "arachni-server.local" "scanuser" "P@ssw0rd"
```

### Linux/Apache/PHP Application

Modify platform at arachni\_scan\_remote.bat:23, then:

```batch theme={null}
arachni_scan_remote.bat "PHPApp" "http://webapp.example.com" ^
  "C:\Reports" "20260303_150000" "1" ^
  "192.168.1.100" "root" "SecurePass"
```

### Multiple Scans with Different Logins

Create custom login scripts for different applications:

```batch theme={null}
rem Copy app-specific login script before each scan
copy Login_App1.rb %Documentacion%\Login_fast.rb
arachni_scan_remote.bat "App1" "http://app1.com" ...

copy Login_App2.rb %Documentacion%\Login_fast.rb  
arachni_scan_remote.bat "App2" "http://app2.com" ...
```

## Security Considerations

<Warning>
  * **Passwords in plain text**: The script passes SSH passwords on the command line
  * **Use key-based authentication** in production environments instead of passwords
  * **Secure the remote server**: Ensure only authorized users have SSH access
  * **Network security**: Use VPN or private network for scanner traffic
</Warning>

### Using SSH Keys Instead

Modify the script to use Pageant (PuTTY's SSH agent) or convert to use SSH keys:

```batch theme={null}
rem Remove -pw PASSWORD and use Pageant-loaded keys
plink.exe -ssh -P 22 -l USERNAME SERVER "command"
```

## Troubleshooting

### SSH Connection Failed

**Symptoms**: Script hangs or shows connection errors

**Solutions**:

* Verify server hostname/IP is reachable: `ping SERVER`
* Check SSH is running on port 22
* Verify credentials are correct
* Test manual connection: `plink.exe -ssh -P 22 -l USERNAME -pw PASSWORD SERVER`

### Arachni Command Not Found

**Symptoms**: Remote command fails with "arachni: command not found"

**Solutions**:

* Install Arachni on remote server
* Ensure Arachni is in PATH: `which arachni`
* Use full path: `/opt/arachni/bin/arachni`

### Login Script Errors

**Symptoms**: Scan completes but misses authenticated pages

**Solutions**:

* Test login script manually on remote server
* Verify session check pattern matches logged-in state
* Check credentials in Login\_fast.rb are correct
* Review Arachni scan log for authentication errors

### Report Download Fails

**Symptoms**: pscp.exe fails to download report

**Solutions**:

* Verify local `Documentacion` path exists and is writable
* Check remote /tmp has sufficient space
* Ensure firewall allows SCP traffic
* Test manual download: `pscp.exe -P 22 -l USER -pw PASS SERVER:/tmp/test.txt C:\`

### Insufficient Disk Space

**Symptoms**: Scan fails or report generation fails

**Solutions**:

* Check remote /tmp disk space: `plink.exe ... SERVER "df -h /tmp"`
* Clean up old scan files in /tmp
* Configure Arachni to use different output directory with more space

## Performance Tuning

### Concurrent Scans

The script does not limit concurrent scans. For multiple targets, stagger execution manually:

```batch theme={null}
start arachni_scan_remote.bat ... "1" ...
timeout /t 60
start arachni_scan_remote.bat ... "2" ...
```

### Scan Speed

To adjust scan aggressiveness, add to the Arachni command:

```bash theme={null}
--http-request-concurrency=20    # Default: 20 concurrent HTTP requests
--http-request-timeout=10000     # Timeout in milliseconds
--scope-page-limit=1000          # Maximum pages to crawl
```

### Resource Limits

Monitor remote server resources during scans:

```bash theme={null}
plink.exe ... SERVER "top -b -n 1 | grep arachni"
```


# Burp Suite Scanner Script
Source: https://simplevulnerabilitymanager-svm.mintlify.app/scripts/burpsuite

Documentation for burpsuite_scan.bat automated scanning with Carbonator extension

Automated Burp Suite scanning script using the Carbonator extension for headless operation.

## Overview

The `burpsuite_scan.bat` script launches Burp Suite Professional with the Carbonator extension to perform automated vulnerability scans. Carbonator enables headless scanning and spider automation.

### Carbonator Extension

Carbonator is a Burp Suite extension that provides:

* Headless scanning capabilities
* Automated spider and scan
* Command-line driven operation

**Extension URL**: [https://www.integrissecurity.com/index.php?resources=Carbonator](https://www.integrissecurity.com/index.php?resources=Carbonator)

## Parameters

| Parameter   | Position | Description                                  |
| ----------- | -------- | -------------------------------------------- |
| `burpsuite` | 1        | Path to Burp Suite executable (.jar or .exe) |
| `scheme`    | 2        | URL scheme (http or https)                   |
| `fqdn`      | 3        | Fully qualified domain name or IP address    |
| `port`      | 4        | Target port number                           |
| `folder`    | 5        | Target folder/path on the server             |

## Usage

### Using JAR File

```batch theme={null}
burpsuite_scan.bat "C:\Tools\burpsuite_pro.jar" "https" "example.com" "443" "app"
```

This executes:

```batch theme={null}
java -jar -Xmx2g C:\Tools\burpsuite_pro.jar https example.com 443 app
```

### Using EXE File

```batch theme={null}
burpsuite_scan.bat "C:\Program Files\BurpSuite\burpsuite.exe" "http" "testsite.local" "80" "/"
```

This executes:

```batch theme={null}
C:\Program Files\BurpSuite\burpsuite.exe http testsite.local 80 /
```

## Script Behavior

### JAR Execution

When the burpsuite parameter ends with `.jar`:

* Launches Java with 2GB heap memory (`-Xmx2g`)
* Passes scheme, FQDN, port, and folder as arguments to Carbonator

```batch theme={null}
java -jar -Xmx2g %burpsuite% %scheme% %fqdn% %port% %folder%
```

### EXE Execution

When the burpsuite parameter ends with `.exe`:

* Launches the executable directly
* Passes the same arguments

```batch theme={null}
%burpsuite% %scheme% %fqdn% %port% %folder%
```

## Example Scan Scenarios

### HTTPS Web Application

```batch theme={null}
burpsuite_scan.bat "burpsuite_pro.jar" "https" "webapp.company.com" "443" "admin"
```

Scans: `https://webapp.company.com:443/admin`

### HTTP Application on Custom Port

```batch theme={null}
burpsuite_scan.bat "burpsuite_pro.jar" "http" "192.168.1.100" "8080" "api/v1"
```

Scans: `http://192.168.1.100:8080/api/v1`

### Root Path Scan

```batch theme={null}
burpsuite_scan.bat "burpsuite_pro.jar" "https" "example.com" "443" "/"
```

Scans: `https://example.com:443/`

## Prerequisites

<Note>
  * **Burp Suite Professional** with valid license (Carbonator requires Pro)
  * **Java Runtime Environment** (JRE) for .jar execution
  * **Carbonator extension** installed in Burp Suite
  * Sufficient memory (script allocates 2GB heap)
</Note>

### Installing Carbonator

1. Download Carbonator from [https://www.integrissecurity.com/index.php?resources=Carbonator](https://www.integrissecurity.com/index.php?resources=Carbonator)
2. In Burp Suite, go to **Extender** > **Extensions**
3. Click **Add** and select the Carbonator .jar file
4. Configure Carbonator settings for automated scanning

## Configuration Notes

### Memory Allocation

The script uses `-Xmx2g` to allocate 2GB of heap memory. For larger scans, modify this value:

```batch theme={null}
rem Increase to 4GB for large applications
java -jar -Xmx4g %burpsuite% %scheme% %fqdn% %port% %folder%
```

### Headless Mode (Commented Out)

The script includes a commented-out headless mode option:

```batch theme={null}
rem java -jar -Xmx2g %burpsuite% -Djava.awt.headless=true %scheme% %fqdn% %port% /%folder%
```

To enable true headless operation, uncomment this line at burpsuite\_scan.bat:18.

## Limitations

<Warning>
  * Requires Burp Suite Professional (Community edition does not support scanning)
  * Carbonator must be pre-configured within Burp Suite before running the script
  * The script does not configure proxy settings or authentication
  * No output file path is specified - reports must be configured in Carbonator settings
</Warning>

## Troubleshooting

### Java Not Found

If Java is not in the system PATH:

```batch theme={null}
"C:\Program Files\Java\jdk-11\bin\java.exe" -jar -Xmx2g burpsuite_pro.jar ...
```

### Insufficient Memory

If scans fail with OutOfMemoryError:

* Increase heap size: `-Xmx4g` or `-Xmx8g`
* Close other applications to free system memory

### Carbonator Not Running

Ensure Carbonator is:

* Installed in Burp Suite Extender
* Enabled and not showing errors
* Configured with appropriate scan settings


# EyeWitness Remote Scanner
Source: https://simplevulnerabilitymanager-svm.mintlify.app/scripts/eyewitness

Web application screenshot and reconnaissance tool for visual analysis of web services

## Overview

The `EyeWitness_remote.bat` script automates web application reconnaissance using EyeWitness. It captures screenshots of web applications, performs active scanning, and generates comprehensive visual reports of discovered web services on remote Linux systems.

## Prerequisites

* Remote Linux system with SSH access
* EyeWitness installed on remote system
* PuTTY tools (plink.exe, pscp.exe) on Windows
* Python with Selenium dependencies on remote system

## Usage

```batch theme={null}
EyeWitness_remote.bat <Proyecto> <File> <Documentacion> <Timestamp> <DirApp> <Server> <Username> <Password>
```

### Parameters

| Parameter       | Description                                        |
| --------------- | -------------------------------------------------- |
| `Proyecto`      | Project name                                       |
| `File`          | Local file containing target URLs (one per line)   |
| `Documentacion` | Output directory path for reports                  |
| `Timestamp`     | Timestamp identifier for report files              |
| `DirApp`        | EyeWitness installation directory on remote system |
| `Server`        | Remote server IP or hostname                       |
| `Username`      | SSH username                                       |
| `Password`      | SSH password                                       |

### Example

```batch theme={null}
EyeWitness_remote.bat "WebAudit" "C:\targets.txt" "C:\Reports" "20240315" "/root/EyeWitness" "192.168.1.100" "kali" "password"
```

## Input File Format

Create a text file with one URL per line:

```text theme={null}
http://example.com
https://test.com:8443
http://192.168.1.50
https://internal.company.com/app
```

## EyeWitness Options

The script executes EyeWitness with the following configuration:

| Option            | Value            | Description                 |
| ----------------- | ---------------- | --------------------------- |
| `-f`              | Input file       | File containing target URLs |
| `--web`           | Enabled          | Web application mode        |
| `--timeout`       | 20 seconds       | Request timeout             |
| `--threads`       | 10               | Concurrent threads          |
| `--user-agent`    | Chrome 41        | Custom user agent string    |
| `--prepend-https` | Enabled          | Try HTTPS for all targets   |
| `--active-scan`   | Enabled          | Perform active scanning     |
| `--resolve`       | Enabled          | Resolve domain names        |
| `--no-prompt`     | Enabled          | Non-interactive mode        |
| `-d`              | Output directory | Report destination          |

### User Agent

```text theme={null}
Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21
```

## Generated Reports

The script generates a compressed archive containing:

* **Screenshots** - PNG images of each web application
* **HTML Report** - Interactive report with all findings
* **Source Code** - HTML source of captured pages
* **Report Data** - JSON/XML data files
* **Categorization** - Applications grouped by technology

Output file: `EyeWitnessReport_[Timestamp].tar.gz`

## Workflow

1. **File Upload** - Transfers target URL file to remote system
2. **Directory Creation** - Creates temporary output directory
3. **Script Generation** - Builds EyeWitness execution script
4. **Execution** - Runs EyeWitness with configured options
5. **Archiving** - Compresses report directory into tar.gz
6. **Download** - Transfers archive to local documentation directory
7. **Cleanup** - Removes temporary files from remote system

## Installation

### Remote System Setup

Install EyeWitness on the remote Linux system:

```bash theme={null}
git clone https://github.com/ChrisTruncer/EyeWitness
cd EyeWitness/setup
./setup.sh
```

The setup script installs:

* Python dependencies
* Selenium WebDriver
* PhantomJS/Chrome drivers
* Image processing libraries

## Script Execution Details

<CodeGroup>
  ```batch Windows Script theme={null}
  @echo off
  setlocal
  set Proyecto=%1
  set File=%2
  set Documentacion=%3
  set Timestamp=%4
  set DirApp=%5
  set Server=%6
  set Username=%7
  set Password=%8
  ```

  ```bash Remote Execution theme={null}
  #!/bin/bash
  cd /root/EyeWitness
  chmod 755 EyeWitness.py

  ./EyeWitness.py \
    -f /tmp/EyeWitnessReport_20240315.txt \
    --web \
    --timeout 20 \
    --threads 10 \
    --user-agent "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21" \
    --prepend-https \
    --active-scan \
    --resolve \
    --no-prompt \
    -d "/tmp/EyeWitnessReport_20240315/"
  ```
</CodeGroup>

## Report Contents

After extraction, the report directory contains:

```text theme={null}
EyeWitnessReport_20240315/
├── report.html               # Main HTML report
├── screens/                  # Screenshot directory
│   ├── http_example_com.png
│   ├── https_test_com.png
│   └── ...
├── source/                   # HTML source files
│   ├── http_example_com.txt
│   └── ...
├── categorized/             # Technology-based categorization
│   ├── apache/
│   ├── nginx/
│   └── iis/
└── databases/               # Data exports
    ├── data.json
    └── data.xml
```

## Active Scan Features

When `--active-scan` is enabled, EyeWitness performs:

* **Default Credentials** - Tests common username/password combinations
* **Directory Enumeration** - Checks for common paths
* **Technology Detection** - Identifies frameworks and platforms
* **Vulnerability Indicators** - Flags potential security issues

## Use Cases

### Network Scanning Integration

Combine with Nmap or other scanners:

```bash theme={null}
# Nmap to find web services
nmap -p 80,443,8080,8443 192.168.1.0/24 -oG - | \
  grep open | awk '{print $2}' > targets.txt

# Feed to EyeWitness
EyeWitness_remote.bat "Scan" "targets.txt" "C:\Reports" ...
```

### Subdomain Reconnaissance

Use with Recon-ng output:

```bash theme={null}
# Use Recon-ng subdomain list
# Format: Add http:// prefix to each subdomain
cat recon-ngReport-Subdomains.txt | \
  awk '{print "http://"$1}' > eyewitness-targets.txt
```

## Performance Tuning

### Thread Configuration

Adjust threads based on target count and network:

```bash theme={null}
# Fast network, many targets
--threads 20

# Slow network or rate-limiting
--threads 5
```

### Timeout Settings

```bash theme={null}
# Fast-responding services
--timeout 10

# Slow or high-latency targets
--timeout 30
```

## Troubleshooting

### Common Issues

**Selenium/WebDriver errors:**

```bash theme={null}
# Reinstall EyeWitness
cd EyeWitness/setup
./setup.sh
```

**Screenshot failures:**

```bash theme={null}
# Update Chrome/Chromium driver
# Check EyeWitness documentation for latest drivers
```

**Memory issues with large scans:**

```bash theme={null}
# Reduce threads
--threads 5

# Split target list into smaller batches
split -l 100 targets.txt batch_
```

## Output Example

The HTML report includes:

* Visual thumbnails of all web applications
* HTTP response headers
* Server information
* Certificate details (HTTPS)
* Technology fingerprints
* Categorization by server type
* Interactive filtering and sorting

## Security Considerations

* **User Agent** - Default configuration uses Chrome user agent to avoid WAF blocks
* **HTTPS** - Automatically tries HTTPS connections
* **Active Scanning** - May trigger IDS/IPS alerts
* **Rate Limiting** - Respect target application rate limits
* **Authorization** - Only scan systems you have permission to test

## References

* [EyeWitness GitHub](https://github.com/ChrisTruncer/EyeWitness)
* [EyeWitness Documentation](https://github.com/ChrisTruncer/EyeWitness/wiki)

## Notes

* Requires Python 2.7 or Python 3.x on remote system
* Screenshots are captured using headless browser (Chromium/PhantomJS)
* Report generation can take significant time for large target lists
* Archive compression reduces transfer size significantly
* The `--resolve` option ensures DNS resolution before screenshot attempts


# Tool Installation Scripts
Source: https://simplevulnerabilitymanager-svm.mintlify.app/scripts/install-tools

Automated installation and upgrade scripts for security testing tools on Windows and Linux platforms

## Overview

SVM provides installation scripts for setting up security testing tools on both local Windows systems and remote Linux systems. These scripts automate the download, installation, and configuration of various security tools.

## Scripts

### Windows Local Installation

**Script:** `install_upgrade_tools_local.bat`

Installs tools on Windows systems.

### Linux Remote Installation

**Scripts:**

* `install_upgrade_tools_remoto.bat` (Windows wrapper)
* `install_upgrade_tools_remoto.sh` (Linux installation script)

Installs tools on remote Linux systems via SSH.

## Supported Platforms

<Tabs>
  <Tab title="Linux">
    * **Kali Linux** - Full support
    * **Debian** - Full support
    * **Ubuntu** - Full support
    * **Windows 10 Ubuntu** - WSL (Windows Subsystem for Linux)
  </Tab>

  <Tab title="Windows">
    * **Windows 10** - Direct installation
    * **Windows Server** - Compatible versions
  </Tab>
</Tabs>

## Tool Categories

### Web Scanning Tools

#### Arachni

Web application security scanner framework.

**Platforms:** Linux (Kali, Debian, Ubuntu)

**Dependencies:**

* libsqlite3-dev
* libpq-dev
* postgresql-server-dev-10
* default-libmysqlclient-dev
* curl, libcurl3, libcurl4-openssl-dev

**Ruby Gems:**

* watir-webdriver
* watir
* selenium-webdriver
* arachni-reactor
* arachni-rpc

**Installation:**

```bash theme={null}
sudo ./install_upgrade_tools_remoto.sh Arachni
```

### Information Gathering Tools

#### Recon-ng

OSINT reconnaissance framework.

**Platforms:** Linux (Kali, Debian, Ubuntu)

**Dependencies:**

* dos2unix
* libxml2-dev
* libxslt1-dev
* zlib1g-dev
* Python packages (from REQUIREMENTS file)

**Installation:**

```bash theme={null}
sudo ./install_upgrade_tools_remoto.sh Recon-ng
```

**Repository:**

```bash theme={null}
git clone https://bitbucket.org/LaNMaSteR53/recon-ng
cd recon-ng
pip install -r REQUIREMENTS
```

#### EyeWitness

Web application screenshot and reconnaissance tool.

**Platforms:** Linux (Kali, Debian, Ubuntu)

**Dependencies:**

* python-levenshtein
* selenium==2.53.6 (specific version)

**Installation:**

```bash theme={null}
sudo ./install_upgrade_tools_remoto.sh EyeWitness
```

**Setup:**

```bash theme={null}
git clone https://github.com/ChrisTruncer/EyeWitness
cd EyeWitness/setup
./setup.sh
```

### Service Scanning Tools

#### OpenVAS

Comprehensive vulnerability scanner.

**Platforms:** Linux (Kali, Debian, Ubuntu)

**Core Dependencies:**

* sqlite3, xsltproc
* texlive-latex-base
* texlive-latex-extra
* texlive-fonts-recommended
* alien

**Scanning Tools:**

* nmap
* nikto
* ike-scan
* lsof
* pnscan
* netdiag
* ldapscripts
* dirmngr
* hydra

**Installation:**

<Tabs>
  <Tab title="Kali Linux">
    ```bash theme={null}
    sudo ./install_upgrade_tools_remoto.sh OpenVAS

    # Kali packages
    apt-get install openvas openvas-manager openvas-manager-common \
      openvas-cli openvas-scanner libopenvas9 \
      greenbone-security-assistant greenbone-security-assistant-common

    # Setup
    openvas-setup
    ```
  </Tab>

  <Tab title="Ubuntu/Debian">
    ```bash theme={null}
    sudo ./install_upgrade_tools_remoto.sh OpenVAS

    # Add PPA repository
    add-apt-repository ppa:mrazavi/openvas
    apt-get update

    # Install packages
    apt-get install openvas9
    apt-get install greenbone-security-assistant9
    ```
  </Tab>
</Tabs>

**Default Credentials:**

```text theme={null}
Username: admin
Password: OpenVAS
```

**Post-Installation:**

The script automatically configures remote access:

* Detects server IP address
* Updates Greenbone Security Assistant to listen on IP
* Creates default admin user
* Sets default password

#### OpenVAS Plugin Updates

Keep OpenVAS vulnerability definitions current.

```bash theme={null}
sudo ./install_upgrade_tools_remoto.sh OpenVASPlugins
```

**Updates:**

* greenbone-certdata-sync
* greenbone-nvt-sync
* greenbone-scapdata-sync
* openvas-feed-update

#### Nessus Plugin Updates

Update Nessus vulnerability plugins.

**Platforms:** Linux (where Nessus is installed)

```bash theme={null}
sudo ./install_upgrade_tools_remoto.sh NessusPlugins
```

**Command:**

```bash theme={null}
/opt/nessus/sbin/nessuscli update --plugins-only
```

#### Nmap

Network scanner and service detection tool.

**Platforms:** Linux, Windows

<Tabs>
  <Tab title="Linux">
    ```bash theme={null}
    sudo ./install_upgrade_tools_remoto.sh Nmap

    # Installs Nmap and updates script database
    apt-get install nmap
    nmap --script-updatedb
    ```
  </Tab>

  <Tab title="Windows">
    ```batch theme={null}
    install_upgrade_tools_local.bat Nmap 0

    # Downloads Nmap 7.70 installer
    # Installs to: %~dp0tools\nmap\
    ```
  </Tab>
</Tabs>

### Development Tools

#### Java JDK

Java Development Kit for running Java-based tools.

**Platforms:** Linux

**Installation:**

```bash theme={null}
sudo ./install_upgrade_tools_remoto.sh Java
```

**Packages Installed:**

* openjdk-9-jdk (preferred)
* openjdk-8-jdk (fallback)

**Verification:**

```bash theme={null}
java -version
```

### Mobile Security Tools

#### Android SDK

Android development and testing tools.

**Platforms:** Linux

**Dependencies:**

* android-tools-adb

**Installation:**

```bash theme={null}
sudo ./install_upgrade_tools_remoto.sh AndroidSDK
```

**Downloads:**

* android-sdk\_r24.4.1-linux.tgz

**Post-Install:**

```bash theme={null}
cd ~/androidsdk/android-sdk-linux
tools/android update sdk --no-ui
```

#### Apktool

APK decompilation and recompilation tool.

**Platforms:** Linux, Windows

<Tabs>
  <Tab title="Linux">
    ```bash theme={null}
    sudo ./install_upgrade_tools_remoto.sh ApkTools

    # Downloads latest version from BitBucket
    # Installs to: ~/apktool/
    ```
  </Tab>

  <Tab title="Windows">
    ```batch theme={null}
    install_upgrade_tools_local.bat Apktool 0

    # Downloads apktool_2.4.0.jar
    # Installs to: tools\apktool\apktool.jar
    ```
  </Tab>
</Tabs>

#### UberApkSigner

APK signing tool.

**Platforms:** Windows

```batch theme={null}
install_upgrade_tools_local.bat UberApkSigner 0

# Downloads uber-apk-signer-1.0.0.jar
# Installs to: tools\uber-apk-signer\
```

#### JD-GUI

Java decompiler with GUI.

**Platforms:** Windows

```batch theme={null}
install_upgrade_tools_local.bat Jdgui 0

# Downloads:
# - jd-gui-1.5.2.jar
# - jd-gui-windows-1.5.2.zip
# Installs to: tools\jdgui\
```

#### Enjarify

DEX to JAR converter.

**Platforms:** Linux, Windows

<Tabs>
  <Tab title="Linux">
    ```bash theme={null}
    sudo ./install_upgrade_tools_remoto.sh Enjarify

    git clone https://github.com/Storyyeller/enjarify
    cd enjarify
    ```
  </Tab>

  <Tab title="Windows">
    ```batch theme={null}
    install_upgrade_tools_local.bat Enjarify 0

    # Downloads enjarify-1.0.3.zip
    # Manual extraction required
    ```
  </Tab>
</Tabs>

#### Drozer

Android security assessment framework.

**Platforms:** Linux

**Dependencies:**

* protobuf-compiler
* dex2jar
* python-setuptools
* python-yaml
* python-service-identity
* pyopenssl

**Installation:**

```bash theme={null}
sudo ./install_upgrade_tools_remoto.sh Drozer

git clone https://github.com/mwrlabs/drozer
cd drozer
make
python setup.py build
python setup.py install
```

#### QARK

Quick Android Review Kit.

**Platforms:** Linux

**Installation:**

```bash theme={null}
sudo ./install_upgrade_tools_remoto.sh Qark

git clone https://github.com/linkedin/qark
cd qark
pip install -r requirements.txt
python ./setup.py install
```

**Dependencies:**

* Android SDK tools
* Python requirements from requirements.txt

#### MobSF

Mobile Security Framework.

**Platforms:** Linux

**Dependencies:**

* libffi-dev
* libtiff5-dev, libjpeg8-dev, libjpeg62-dev, libjpeg62-turbo-dev
* zlib1g-dev
* libfreetype6, libfreetype6-dev
* liblcms2-dev
* libwebp-dev
* tcl8.6-dev, tk8.6-dev
* python-tk
* libssl-dev
* wkhtmltopdf
* python3-django-wkhtmltopdf
* python3-venv

**Python Packages:**

* scrapy
* cryptography
* cffi
* pycparser
* colorlog

**Installation:**

```bash theme={null}
sudo ./install_upgrade_tools_remoto.sh MobSF

git clone https://github.com/ajinabraham/Mobile-Security-Framework-MobSF
cd Mobile-Security-Framework-MobSF
pip install -r requirements.txt --upgrade
./setup.sh
```

#### AndroBugs Framework

Android vulnerability scanner.

**Platforms:** Linux

**Installation:**

```bash theme={null}
sudo ./install_upgrade_tools_remoto.sh AndroBugs_Framework

git clone https://github.com/AndroBugs/AndroBugs_Framework
```

### Utility Tools

#### GreenShot

Screenshot utility.

**Platforms:** Windows

```batch theme={null}
install_upgrade_tools_local.bat GreenShot 0

# Opens download page in browser
```

## Usage

### Windows Local Installation

<CodeGroup>
  ```batch Basic Usage theme={null}
  install_upgrade_tools_local.bat <Tool> <UsoProxy> [ProxyIP] [ProxyPort] [ProxyUser] [ProxyPassword]
  ```

  ```batch Without Proxy theme={null}
  install_upgrade_tools_local.bat Nmap 0
  ```

  ```batch With Proxy theme={null}
  install_upgrade_tools_local.bat Apktool 1 proxy.company.com 8080 user password
  ```
</CodeGroup>

**Parameters:**

* `Tool` - Tool name to install
* `UsoProxy` - Use proxy (0=No, 1=Yes)
* `ProxyIP` - Proxy server IP
* `ProxyPort` - Proxy port
* `ProxyUser` - Proxy username
* `ProxyPassword` - Proxy password

### Linux Remote Installation

<CodeGroup>
  ```batch Windows Wrapper theme={null}
  install_upgrade_tools_remoto.bat <Server> <Username> <Password> <Tool>
  ```

  ```batch Example theme={null}
  install_upgrade_tools_remoto.bat 192.168.1.100 root password Recon-ng
  ```

  ```bash Direct Linux theme={null}
  sudo ./install_upgrade_tools_remoto.sh <Tool>
  ```

  ```bash Install All Tools theme={null}
  sudo ./install_upgrade_tools_remoto.sh Todas
  ```
</CodeGroup>

**Special Tool Names:**

* `Todas` - Install all available tools (Linux only)

## Installation Workflow

### Remote Installation Process

1. **Upload Script** - Transfers .sh script to /tmp/ on remote system
2. **Format Conversion** - Removes Windows line endings (tr -d '\15\32')
3. **Permission Setting** - Makes script executable (chmod 755)
4. **Execution** - Runs with sudo if needed
5. **Cleanup** - Removes temporary script files

### Environment Setup

The Linux script configures:

```bash theme={null}
export TERM=linux
export DEBIAN_FRONTEND="noninteractive"
```

This ensures:

* Non-interactive installation
* No prompts during package installation
* Headless operation suitable for automation

### Root Check

```bash theme={null}
userid=`id -u`
if [ "${userid}" != '0' ]; then
  echo '[Error]: You must run this setup script with root privileges.'
  exit 1
fi
```

## WSL (Windows Subsystem for Linux) Setup

For Windows 10 Ubuntu or Kali WSL:

```bash theme={null}
# Install SSH server
sudo apt-get install openssh-server

# Generate SSH keys
cd /etc/ssh/
sudo /usr/bin/ssh-keygen -A

# Configure SSH
sudo nano /etc/ssh/sshd_config
# Add: ListenAddress 0.0.0.0

# Start SSH service
sudo service ssh --full-restart
sudo update-rc.d ssh enable
```

### Passwordless Sudo (Optional)

```bash theme={null}
sudo visudo
# Add: username ALL=(ALL) NOPASSWD: ALL
```

## Common Dependencies

All Linux installations include:

```bash theme={null}
apt-get update
apt-get install -y \
  git wget \
  python python3 python3-dev python3-pip python3-dugong \
  python-pip python-dev \
  build-essential \
  ruby ruby-dev rubygems-integration rubygems \
  python-setuptools \
  gcc gawk original-awk \
  xmlstarlet \
  unzip
```

## Troubleshooting

### Permission Denied

**Issue:** Script execution fails with permission error

**Solution:**

```bash theme={null}
chmod 755 install_upgrade_tools_remoto.sh
sudo ./install_upgrade_tools_remoto.sh <Tool>
```

### Package Installation Failures

**Issue:** apt-get fails to install packages

**Solution:**

```bash theme={null}
# Update package lists
sudo apt-get update

# Fix broken dependencies
sudo apt-get -f install

# Retry installation
```

### Git Clone Failures

**Issue:** Git repository already exists

**Solution:**
The scripts handle this automatically:

```bash theme={null}
if [ $? -ne 0 ] ; then
  cd tool-directory
  git pull
else
  # Fresh clone
fi
```

### OpenVAS Remote Access

**Issue:** Cannot access OpenVAS web interface remotely

**Solution:**
The script automatically configures this, but manual fix:

```bash theme={null}
# Edit service file
nano /lib/systemd/system/greenbone-security-assistant.service

# Change:
--listen=127.0.0.1

# To:
--listen=0.0.0.0

# Reload and restart
systemctl daemon-reload
/etc/init.d/greenbone-security-assistant restart
```

## References

* [Arachni Repository](https://github.com/Arachni/arachni)
* [Recon-ng Repository](https://bitbucket.org/LaNMaSteR53/recon-ng)
* [EyeWitness Repository](https://github.com/ChrisTruncer/EyeWitness)
* [OpenVAS Documentation](https://www.openvas.org/)
* [MobSF Repository](https://github.com/MobSF/Mobile-Security-Framework-MobSF)

## Notes

* All Linux installations use `apt-get` package manager
* Scripts support both fresh installations and updates
* Windows installations download directly from official sources
* Some tools require manual extraction after download
* Plugin/feed updates should be run after initial installation
* Installation requires active internet connection
* Proxy support available for Windows local installations


# MobSF Script
Source: https://simplevulnerabilitymanager-svm.mintlify.app/scripts/mobsf

Automated Mobile Security Framework scanning and PDF report generation

The MobSF script automates static analysis of Android APK files using Mobile Security Framework (MobSF). It handles authentication, file upload, analysis execution, and PDF report generation through the MobSF REST API.

## Overview

**Script**: `mobsf.bat`

**Platform**: Windows

**Purpose**: Automated APK static analysis with PDF report generation

## Tool Information

**MobSF**: Mobile Security Framework

* **Repository**: `https://github.com/ajinabraham/Mobile-Security-Framework-MobSF`
* **Type**: Open-source mobile application security testing framework
* **Analysis**: Static and dynamic analysis for Android and iOS apps

### Installation

From install scripts (Linux):

```bash theme={null}
cd ~
git clone --depth 1 https://github.com/ajinabraham/Mobile-Security-Framework-MobSF
cd Mobile-Security-Framework-MobSF
pip install -r requirements.txt --upgrade
./setup.sh
```

### Starting MobSF Server

<Tabs>
  <Tab title="Windows">
    ```batch theme={null}
    c:\python27\python.exe c:\MobSF\manage.py runserver 0.0.0.0:8000
    ```
  </Tab>

  <Tab title="Linux">
    ```bash theme={null}
    python ./manage.py runserver 0.0.0.0:8000
    ```
  </Tab>
</Tabs>

## Script Parameters

```batch theme={null}
mobsf.bat <PathAPK> <FileApk> <Timestamp> <Documentacion> <Server>
```

| Parameter       | Description                     | Example                     |
| --------------- | ------------------------------- | --------------------------- |
| `PathAPK`       | Full path to APK file           | `C:\samples\app.apk`        |
| `FileApk`       | APK filename (no extension)     | `app`                       |
| `Timestamp`     | Unique timestamp identifier     | `20230615_143022`           |
| `Documentacion` | Output directory for PDF report | `C:\reports`                |
| `Server`        | MobSF server URL                | `http://192.168.1.100:8000` |

## Analysis Workflow

<Steps>
  <Step title="Server Verification">
    Checks if MobSF server is running and accessible.

    ```batch theme={null}
    curl.exe -s -k "http://192.168.1.100:8000"
    ```

    If server is not responding, script prompts user to start MobSF.
  </Step>

  <Step title="CSRF Token Retrieval">
    Obtains CSRF token from MobSF homepage for authenticated requests.

    ```batch theme={null}
    curl.exe -k -H "Referer: %Server%" -D "mobsf_auth.txt" "%Server%"
    ```

    Extracts `X-CSRFToken` from response headers.
  </Step>

  <Step title="APK Upload">
    Uploads APK file to MobSF via multipart form POST request.

    ```batch theme={null}
    curl.exe -k -X POST -b "mobsf_auth.txt" ^
      -H "X-CSRFToken: %TOKEN%" ^
      -H "Referer: %Server%" ^
      -F file="@%PathAPK%" ^
      "%Server%/upload/"
    ```

    Response contains file checksum (MD5) for subsequent requests.
  </Step>

  <Step title="Static Analysis">
    Triggers static analysis by accessing the analyzer endpoint.

    ```batch theme={null}
    curl.exe -k -b "mobsf_auth.txt" -H "Referer: %Server%" ^
      "%Server%/StaticAnalyzer/?name=%FileApk%&type=apk&checksum=%checksum%"
    ```

    MobSF performs comprehensive security analysis.
  </Step>

  <Step title="PDF Report Generation">
    Downloads generated PDF report with analysis results.

    ```batch theme={null}
    curl.exe -k -b "mobsf_auth.txt" ^
      -H "Referer: %Server%/StaticAnalyzer/?name=%FileApk%&type=apk&checksum=%checksum%" ^
      "%Server%/PDF/?md5=%checksum%&type=APK" ^
      -o "MobSFReport - %FileApk%_%Timestamp%.pdf"
    ```
  </Step>

  <Step title="Cleanup & Display">
    Removes temporary authentication files and opens PDF report.

    Script automatically launches the PDF viewer.
  </Step>
</Steps>

## Script Implementation

```batch theme={null}
@echo off
setlocal
set PathAPK=%1
set FileApk=%2
set Timestamp=%3
set Documentacion=%4
set Server=%5

set PathAPK=%PathAPK:"=%
set FileApk=%FileApk:"=%
set Documentacion=%Documentacion:"=%
set Documentacion="%Documentacion%\MobSFReport - %FileApk%_%Timestamp%.pdf"

@title=[MobSF] - %FileApk%

# Check if MobSF is running
"%~dp0curl.exe" -s -k "%Server%"
if %ERRORLEVEL% NEQ 0 (
  echo MobSF no iniciado. Inicie sesion por SSH a %Server% y ejecute
  echo python /root/Mobile-Security-Framework-MobSF/manage.py runserver %Server%
  pause
  exit
)

# Request 1: Get CSRF Token
"%~dp0curl.exe" -k -H "Referer: %Server%" -D "%TEMP%\mobsf_auth_%Timestamp%.txt" ^
  "%Server%" > "%TEMP%\mobsf_token_1_%Timestamp%.txt"
findstr /C:"X-CSRFToken" "%TEMP%\mobsf_token_1_%Timestamp%.txt" > "%TEMP%\mobsf_token_2_%Timestamp%.txt"
set /p TOKEN=<"%TEMP%\mobsf_token_2_%Timestamp%.txt"
FOR /F "tokens=1-2" %%A IN ("%TOKEN%") DO set TOKEN=%%B
set TOKEN=%TOKEN:'=%
set TOKEN=%TOKEN:)=%
set TOKEN=%TOKEN:;=%

# Request 2: Upload APK
"%~dp0curl.exe" -k -X POST -b "%TEMP%\mobsf_auth_%Timestamp%.txt" ^
  -H "X-CSRFToken: %TOKEN%" -H "Referer: %Server%" ^
  -F file="@%PathAPK%" "%Server%/upload/" | "%~dp0jq-win32.exe" .url > "%TEMP%\mobsf_json_%Timestamp%.txt"
set /p requestId=<"%TEMP%\mobsf_json_%Timestamp%.txt"

# Extract checksum from response
for /f "tokens=1,2,3 delims=:&" %%a in (%requestId%) do set getchecksum=%%c
for /f "tokens=1,2 delims=:=" %%a in ("%getchecksum%") do set checksum=%%b

# Request 3: Trigger analysis
"%~dp0curl.exe" -k -b "%TEMP%\mobsf_auth_%Timestamp%.txt" -H "Referer: %Server%" ^
  "%Server%/StaticAnalyzer/?name=%FileApk%&type=apk&checksum=%checksum%" > NUL

# Request 4: Download PDF report
"%~dp0curl.exe" -k -b "%TEMP%\mobsf_auth_%Timestamp%.txt" ^
  -H "Referer: %Server%/StaticAnalyzer/?name=%FileApk%&type=apk&checksum=%checksum%" ^
  "%Server%/PDF/?md5=%checksum%&type=APK" -o %Documentacion%

# Cleanup
del /F "%TEMP%\mobsf_auth_%Timestamp%.txt"
del /F "%TEMP%\mobsf_token_1_%Timestamp%.txt"
del /F "%TEMP%\mobsf_token_2_%Timestamp%.txt"
del /F "%TEMP%\mobsf_json_%Timestamp%.txt"

echo %Documentacion%
start "" /WAIT /I ""%Documentacion%""
pause
```

## Output

### PDF Report Contents

The generated PDF report includes:

* **Application Information**: Package name, version, permissions
* **Security Analysis**: Code vulnerabilities, insecure configurations
* **Certificate Analysis**: Signing certificate details
* **Manifest Analysis**: AndroidManifest.xml security issues
* **Code Analysis**: Hardcoded secrets, insecure APIs, cryptography issues
* **Binary Analysis**: Native library vulnerabilities
* **File Analysis**: Resource files, assets, and databases

### Report Location

```
<Documentacion>\MobSFReport - <FileApk>_<Timestamp>.pdf
```

Example:

```
C:\reports\MobSFReport - vulnerable_app_20230615_143022.pdf
```

## Usage Example

```batch theme={null}
mobsf.bat ^
  "C:\samples\vulnerable_app.apk" ^
  "vulnerable_app" ^
  "20230615_143022" ^
  "C:\reports" ^
  "http://192.168.1.100:8000"
```

## API Endpoints

The script uses these MobSF REST API endpoints:

| Endpoint           | Method | Purpose                                |
| ------------------ | ------ | -------------------------------------- |
| `/`                | GET    | Retrieve CSRF token and session cookie |
| `/upload/`         | POST   | Upload APK for analysis                |
| `/StaticAnalyzer/` | GET    | Trigger static analysis                |
| `/PDF/`            | GET    | Generate and download PDF report       |

## Dependencies

The script requires these utilities in the same directory:

* `curl.exe`: HTTP client for API requests
* `jq-win32.exe`: JSON parser for extracting response data
* `pscp.exe`: For remote file transfers (if needed)
* `plink.exe`: For remote command execution (if needed)

## Troubleshooting

### Server Not Running

```
Error: MobSF no iniciado
```

**Solution**: Start MobSF server on the specified host:

```bash theme={null}
# SSH to server
ssh user@192.168.1.100

# Start MobSF
cd /root/Mobile-Security-Framework-MobSF
python ./manage.py runserver 0.0.0.0:8000
```

### Connection Refused

Check firewall settings and ensure MobSF is listening on `0.0.0.0:8000` (not `127.0.0.1:8000`).

### Analysis Taking Too Long

Large APK files or complex applications may take several minutes to analyze. The script waits for analysis completion before generating the PDF.

### Missing CSRF Token

If CSRF token extraction fails, verify that:

* MobSF server is responding
* curl.exe can access the server
* No proxy is interfering with requests

## Security Considerations

* **Credentials**: Script stores cookies in TEMP directory temporarily
* **HTTPS**: Uses `-k` flag to allow self-signed certificates
* **Cleanup**: Automatically removes temporary authentication files
* **Network**: Ensure MobSF server is on trusted network or use VPN

## Advanced Configuration

### Custom Server Port

MobSF can run on custom ports:

```bash theme={null}
python ./manage.py runserver 0.0.0.0:9000
```

Update script calls accordingly:

```batch theme={null}
mobsf.bat ... "http://192.168.1.100:9000"
```

### Remote Analysis

For remote servers, ensure:

* Network connectivity to MobSF port
* No firewall blocking HTTP traffic
* Sufficient server resources for analysis

## Related Scripts

* `apktool_decode_local.bat`: Decode APK for manual inspection
* `qark.bat`: Alternative security analysis tool
* `androbugs_framework.bat`: Another APK security scanner


# Nessus Scripts
Source: https://simplevulnerabilitymanager-svm.mintlify.app/scripts/nessus

Automated Nessus vulnerability scanning and policy retrieval scripts

## Overview

The Nessus scripts automate vulnerability scanning using Tenable Nessus via REST API. These scripts authenticate, launch scans, monitor progress, and export reports in HTML and XML formats.

## nessus\_scan.bat

Launches a Nessus vulnerability scan and generates reports.

### Parameters

<ParamField type="string">
  Project name for the scan
</ParamField>

<ParamField type="string">
  Target IP address or range to scan
</ParamField>

<ParamField type="string">
  Nessus authentication username
</ParamField>

<ParamField type="string">
  Nessus authentication password
</ParamField>

<ParamField type="string">
  Nessus server hostname or IP
</ParamField>

<ParamField type="string">
  Nessus server port (typically 8834)
</ParamField>

<ParamField type="string">
  Name of the Nessus scan policy to use
</ParamField>

<ParamField type="string">
  Timestamp for unique file naming
</ParamField>

<ParamField type="string">
  Output directory for reports
</ParamField>

### Usage

```batch theme={null}
nessus_scan.bat "MyProject" "192.168.1.100" "admin" "password" "nessus.local" "8834" "Basic Network Scan" "20240315_143000" "C:\Reports"
```

### Workflow

1. **Service Detection** - Verifies Nessus service is running
2. **Authentication** - Logs in via `/session` endpoint
3. **Policy Resolution** - Retrieves policy ID and template UUID
4. **Scan Creation** - Creates new scan with target configuration
5. **Scan Launch** - Starts the scan execution
6. **Progress Monitoring** - Polls scan status every 60 seconds
7. **Report Generation** - Exports HTML and XML reports
8. **Cleanup** - Logs out and removes temporary files

### API Endpoints Used

| Endpoint                             | Method | Purpose                      |
| ------------------------------------ | ------ | ---------------------------- |
| `/session`                           | POST   | Authenticate and get token   |
| `/policies`                          | GET    | List available scan policies |
| `/scans`                             | POST   | Create new scan              |
| `/scans/{id}/launch`                 | POST   | Launch scan                  |
| `/scans/{id}`                        | GET    | Get scan status and details  |
| `/scans/{id}/export`                 | POST   | Request report export        |
| `/scans/{id}/export/{file}/status`   | GET    | Check export status          |
| `/scans/{id}/export/{file}/download` | GET    | Download report              |
| `/session`                           | DELETE | Logout                       |

### Authentication Pattern

```batch theme={null}
curl -X POST -H "Content-Type: application/json" \
  -d '{"username":"admin","password":"password"}' \
  https://nessus.local:8834/session
```

The token is extracted and used in subsequent requests:

```batch theme={null}
curl -H "X-Cookie: token=TOKEN_VALUE" \
  https://nessus.local:8834/scans
```

### Scan Configuration

The script creates scans with the following settings:

```json theme={null}
{
  "uuid": "TEMPLATE_UUID",
  "settings": {
    "name": "ProjectName",
    "description": "SVM Nessus Scan",
    "text_targets": "192.168.1.100",
    "scanner_id": "1",
    "launch": "ON_DEMAND",
    "policy_id": POLICY_ID
  }
}
```

### Report Export

Two report formats are generated:

**HTML Report:**

```json theme={null}
{
  "format": "html",
  "chapters": "vuln_hosts_summary;vuln_by_plugin"
}
```

**XML Report (Nessus format):**

```json theme={null}
{
  "format": "nessus",
  "chapters": "vuln_hosts_summary;vuln_by_plugin"
}
```

### Error Handling

* **Service not running** - Prompts to start Nessus daemon: `/etc/init.d/nessusd start`
* **Authentication failure** - Exits if token is null
* **Scan paused** - Waits and continues monitoring
* **Scan canceled** - Exits gracefully
* **Export failure** - Exits if status report is null

### Output Files

* `NessusReport - {Timestamp}.html` - HTML formatted report
* `NessusReport - {Timestamp}.xml` - XML/Nessus formatted report

The HTML report automatically opens after completion.

***

## nessus\_get\_policies.bat

Retrieves available Nessus scan policies for use in scans.

### Parameters

<ParamField type="string">
  Nessus server hostname or IP
</ParamField>

<ParamField type="string">
  Nessus server port
</ParamField>

<ParamField type="string">
  Nessus authentication username
</ParamField>

<ParamField type="string">
  Nessus authentication password
</ParamField>

<ParamField type="string">
  Timestamp for temporary file naming
</ParamField>

### Usage

```batch theme={null}
nessus_get_policies.bat "nessus.local" "8834" "admin" "password" "20240315_143000"
```

### Implementation

The script retrieves policy names using the Nessus API:

```batch theme={null}
curl -H "X-Cookie: token=TOKEN" \
  https://nessus.local:8834/policies | jq ".policies[].name"
```

### Output

Policy names are written to: `%TEMP%\nessus_scan_policies_{Timestamp}.txt`

Example output:

```
"Basic Network Scan"
"Advanced Scan"
"Web Application Tests"
"Custom Policy"
```

### Error Handling

* Validates service availability before authentication
* Checks credentials and exits with error message if invalid
* Cleans up temporary token files

### Notes

* Use retrieved policy names as the `Policy_Name` parameter in `nessus_scan.bat`
* The commented line shows how to retrieve scan templates instead of policies


# Netsparker Scanner Script
Source: https://simplevulnerabilitymanager-svm.mintlify.app/scripts/netsparker

Documentation for netsparker_scan.bat automated web vulnerability scanning

Automated Netsparker scanning script with concurrent scan management and profile-based configuration.

## Overview

The `netsparker_scan.bat` script launches Netsparker in automated mode using pre-configured scanning profiles. It manages concurrent scans to prevent resource exhaustion.

## Parameters

| Parameter       | Position | Description                                         |
| --------------- | -------- | --------------------------------------------------- |
| `Proyecto`      | 1        | Project name (must match a Netsparker profile name) |
| `Netsparker`    | 2        | Path to Netsparker.exe executable                   |
| `URL`           | 3        | Target URL to scan                                  |
| `Documentacion` | 4        | Output directory for HTML reports                   |
| `Timestamp`     | 5        | Timestamp for file naming                           |
| `NRO`           | 6        | Scan number (used for staggered start delay)        |

## Usage

```batch theme={null}
netsparker_scan.bat "MyWebApp" "C:\Program Files\Netsparker\Netsparker.exe" ^
  "http://example.com" "C:\Reports" "20260303_120000" "1"
```

## Script Behavior

### Staggered Start

The script delays execution based on the NRO parameter:

```batch theme={null}
SLEEP = NRO × 20 seconds
```

Examples:

* NRO=1 → 20 second delay
* NRO=2 → 40 second delay
* NRO=5 → 100 second delay

This prevents multiple scans from starting simultaneously.

### Concurrent Scan Limiting

The script limits concurrent Netsparker instances to **maximum 2**:

```batch theme={null}
tasklist /FI "IMAGENAME eq Netsparker.exe" /NH | find /C "Netsparker.exe"
```

If 2 or more instances are running:

* Script waits 60 seconds
* Rechecks process count
* Repeats until a slot is available

### Netsparker Command

Once a slot is available, the script launches:

```batch theme={null}
Netsparker.exe /auto /profile "PROJECT_NAME" /url URL /report "OUTPUT.html"
```

**Parameters:**

* `/auto` - Automated scan mode (no GUI interaction)
* `/profile "PROJECT_NAME"` - Use the specified scanning profile
* `/url URL` - Target URL to scan
* `/report "PATH.html"` - Output HTML report location

## Scanning Profiles

### Profile Requirement

<Warning>
  The `Proyecto` parameter must match an existing Netsparker scanning profile name exactly. If the profile does not exist, the scan will fail.
</Warning>

### Creating Profiles in Netsparker

1. Open Netsparker GUI
2. Configure scan settings (authentication, crawling, policies)
3. Save as a named profile
4. Use that exact name as the `Proyecto` parameter

### Profile Components

Profiles can include:

* Authentication credentials
* Crawling scope and depth
* Scan policies and checks
* Form filling rules
* Custom headers and cookies
* Performance settings

## Output Files

Generated report format:

```
NetsparkerReport - {Timestamp}-URL_{NRO}.html
```

Example:

```
NetsparkerReport - 20260303_120000-URL_1.html
```

## Example Usage Scenarios

### Single Scan

```batch theme={null}
netsparker_scan.bat "ProductionProfile" ^
  "C:\Program Files\Netsparker\Netsparker.exe" ^
  "https://webapp.company.com" ^
  "D:\ScanReports" ^
  "20260303_143000" ^
  "1"
```

### Multiple URLs with Staggered Start

Scan 3 URLs with 20-second intervals:

```batch theme={null}
rem URL 1 - starts immediately
start netsparker_scan.bat "MyProfile" "C:\...\Netsparker.exe" "http://site1.com" "C:\Reports" "20260303_150000" "1"

rem URL 2 - starts after 40 seconds
start netsparker_scan.bat "MyProfile" "C:\...\Netsparker.exe" "http://site2.com" "C:\Reports" "20260303_150000" "2"

rem URL 3 - starts after 60 seconds  
start netsparker_scan.bat "MyProfile" "C:\...\Netsparker.exe" "http://site3.com" "C:\Reports" "20260303_150000" "3"
```

### Different Profiles for Different Apps

```batch theme={null}
rem Authenticated scan
netsparker_scan.bat "AuthenticatedProfile" "C:\...\Netsparker.exe" ^
  "https://secure.app.com" "C:\Reports" "20260303_160000" "1"

rem Public-facing scan
netsparker_scan.bat "PublicProfile" "C:\...\Netsparker.exe" ^
  "https://public.app.com" "C:\Reports" "20260303_160000" "2"
```

## Prerequisites

<Note>
  * **Netsparker Standard or Enterprise** with valid license
  * Scanning profile must be pre-configured with the exact name used in `Proyecto`
  * Sufficient disk space in `Documentacion` directory for HTML reports
  * Windows system with administrative privileges (for process listing)
</Note>

## Temporary Files

The script creates a temporary file to track scan counts:

```
%TEMP%\netsparker_scan_count_{Timestamp}-URL_{NRO}.txt
```

This file is automatically deleted upon completion.

## Limitations

<Warning>
  * Maximum 2 concurrent scans (hardcoded limit)
  * Only HTML report format is generated
  * Profile must exist before running the script
  * No error handling for missing profiles
</Warning>

## Troubleshooting

### Profile Not Found Error

If Netsparker reports "Profile not found":

1. Open Netsparker GUI
2. Check **File** > **Manage Scanning Profiles**
3. Verify the profile name matches exactly (case-sensitive)
4. Create the profile if it doesn't exist

### Scan Hangs Waiting for Slot

If the script waits indefinitely:

1. Check Task Manager for orphaned Netsparker.exe processes
2. Manually terminate stuck processes
3. Script will automatically proceed

### Missing Reports

If reports are not generated:

* Verify `Documentacion` path exists and is writable
* Check Netsparker scan completed successfully
* Review Netsparker logs for errors

## Performance Tuning

### Adjusting Concurrent Limit

To allow more concurrent scans, modify the limit at netsparker\_scan.bat:28:

```batch theme={null}
rem Change from 2 to 4 concurrent scans
if %CANT% GEQ 4 ( ping -n 61 127.0.0.1 > NUL && goto :while1 ) else ( ... )
```

### Adjusting Stagger Delay

To change the delay multiplier, modify netsparker\_scan.bat:17:

```batch theme={null}
rem Change from 20 to 30 seconds per NRO
set /a SLEEP=%NRO%*30
```


# Nmap Scripts
Source: https://simplevulnerabilitymanager-svm.mintlify.app/scripts/nmap

Network scanning and port enumeration using Nmap locally and remotely

## Overview

The Nmap scripts perform comprehensive network scanning and port enumeration. They support local Windows execution and remote Linux scanning via SSH, generating detailed HTML reports.

## nmap\_scan.bat

Executes Nmap scans locally on Windows systems.

### Parameters

<ParamField type="string">
  Project name for the scan
</ParamField>

<ParamField type="string">
  Target IP addresses (comma-separated for multiple targets)
</ParamField>

<ParamField type="string">
  Timestamp for unique file naming
</ParamField>

<ParamField type="string">
  Output directory for reports
</ParamField>

<ParamField type="string">
  Path to nmap.exe executable
</ParamField>

### Usage

```batch theme={null}
nmap_scan.bat "MyProject" "192.168.1.100" "20240315_143000" "C:\Reports" "C:\Program Files\Nmap\nmap.exe"
```

**Multiple targets:**

```batch theme={null}
nmap_scan.bat "Network Audit" "192.168.1.1,192.168.1.100,192.168.1.254" "20240315_143000" "C:\Reports" "nmap.exe"
```

### Nmap Command

The script executes the following Nmap command:

```batch theme={null}
echo 192.168.1.100 | nmap -Pn -O --system-dns -vv -sS -sC -sV \
  -oA "C:\Reports\NmapReport - 20240315_143000" \
  -pT:1-65535,U:7,9,13,17,19,21,37,53,67-69,98,111,121,123,135,137-138,161,... \
  --webxml -iL -
```

### Scan Options Explained

| Option         | Description                              |
| -------------- | ---------------------------------------- |
| `-Pn`          | Skip host discovery (assume host is up)  |
| `-O`           | Enable OS detection                      |
| `--system-dns` | Use system DNS resolver                  |
| `-vv`          | Very verbose output                      |
| `-sS`          | TCP SYN scan (stealth scan)              |
| `-sC`          | Run default NSE scripts                  |
| `-sV`          | Version detection for services           |
| `-oA`          | Output in all formats (XML, nmap, gnmap) |
| `--webxml`     | Generate XML suitable for web display    |
| `-iL -`        | Read targets from stdin                  |

### Port Ranges

Comprehensive port scanning configuration:

**TCP Ports:** Full range 1-65535

**UDP Ports:** Common service ports

<Accordion title="View complete UDP port list">
  7 (Echo), 9 (Discard), 13 (Daytime), 17 (QOTD), 19 (CHARGEN), 21 (FTP), 37 (Time), 53 (DNS), 67-69 (DHCP/TFTP), 98 (Linuxconf), 111 (RPC), 121 (ERPC), 123 (NTP), 135 (MS RPC), 137-138 (NetBIOS), 161 (SNMP), 177 (XDMCP), 371 (ClearCase), 389 (LDAP), 407 (Timbuktu), 445 (SMB), 456 (MACON), 464 (Kerberos), 500 (ISAKMP), 512 (biff), 514 (syslog), 517-518 (talk), 520 (RIP), 555 (phAse Zero), 635 (RLZ DBase), 666 (Doom), 858 (pftp), 1001 (JtoMB), 1010-1011 (surf), 1015 (SUPDUP), 1024-1049 (Reserved), 1051-1055 (Kerberos), 1170 (AT\&T MeTV), 1194 (OpenVPN), 1243 (SubSeven), 1245 (VoiceChat), 1434 (MS SQL Monitor), 1492 (Trojan), 1600 (issd), 1604 (DarkComet), 1645 (RADIUS), 1701 (L2TP), 1807 (FJI), 1812 (RADIUS), 1900 (SSDP), 1978 (UniSQL), 1981 (PersistentMQ), 1999 (SubSeven), 2001-2002 (DC), 2023 (xinuexpansion), 2049 (NFS), 2115 (KDM), 2140 (DeepThroat), 2801 (IGMP), 2967 (SSC-Agent), 3024 (NDS\_SSS), 3129 (Master's Paradise), 3150 (Deep Throat), 3283 (Net Assistant), 3527 (VERITAS), 3700 (Portal of Doom), 3801 (EAP over UDP), 4000 (ICQ), 4092 (WorkSpaceAudio), 4156 (Stat Scanner), 4569 (IAX), 4590 (RID), 4781 (Kazaa), 5000-5001 (UPnP), 5036 (MenandMice), 5060 (SIP), 5321 (Firewall), 5400-5402 (Excerpt), 5503 (fcp-addr-srvr1), 5569 (rdmnet-ctrl), 5632 (pcANYWHERE), 5742 (Netvision), 6051 (X11), 6073 (DirectPlay8), 6502 (BoKS), 6670 (VocalTec), 6771 (BackWeb), 6912 (Mach), 6969 (acmsoda), 7000 (AOL), 7111 (Somfy), 7222 (unknown), 7300-7301 (swx), 7306-7308 (swx), 7778 (Unreal), 7789 (office), 7938 (LGTOMAPPER), 9872-9875 (Session Announcement), 9989 (iNIC), 10067 (Portal of Doom), 10167 (Portal of Doom), 11000 (IRISA), 11223 (Prism Deploy), 12223 (TrustedWeb), 12345-12346 (NetBus), 12361-12362 (Whack-a-mole), 15253 (Hydap), 15345 (XPCom), 16969 (unknown), 17185 (Soundsvirtual), 20001 (Millennium), 20034 (NetBus 2 Pro), 21544 (Schxxob), 21862 (unknown), 22222 (Prosiak), 23456 (EvilFTP), 26274 (Delta Source), 26409 (unknown), 27444 (Trinoo), 30029 (AOL Admin), 31335 (Trinoo), 31337-31339 (Back Orifice), 31666 (BOWhack), 31785 (Hack'a'Tack), 31789 (Hack'a'Tack), 31791-31792 (Hack'a'Tack), 32771 (Solaris RPC), 33333 (Prosiak), 34324 (BigGluck), 40412 (The Spy), 40421-40423 (Master Paradise), 40426 (Master Paradise), 47262 (Delta), 50505 (Socket de Troie), 50766 (Fore), 51100-51101 (InfoMaN), 51109 (Adleman), 53001 (Remote Shutdown), 54321 (School Bus), 61466 (TeleCommando)
</Accordion>

### Report Generation

Nmap generates XML output which is transformed to HTML:

```batch theme={null}
xml.exe tr nmap.xsl "C:\Reports\NmapReport - 20240315_143000.xml" > "C:\Reports\NmapReport - 20240315_143000.html"
```

The script uses an XSL stylesheet (`nmap.xsl`) to convert Nmap XML to formatted HTML.

### Output Files

| File                             | Description                                     |
| -------------------------------- | ----------------------------------------------- |
| `NmapReport - {Timestamp}.xml`   | Raw XML scan results (deleted after conversion) |
| `NmapReport - {Timestamp}.html`  | Formatted HTML report                           |
| `NmapReport - {Timestamp}.nmap`  | Nmap native format                              |
| `NmapReport - {Timestamp}.gnmap` | Grepable format                                 |

### IP Address Handling

The script processes IP addresses:

```batch theme={null}
set IP=%IP:"=%       rem Remove quotes
set IP=%IP:,= %      rem Convert commas to spaces
```

Pipes to Nmap via stdin:

```batch theme={null}
echo 192.168.1.1 192.168.1.100 192.168.1.254 | nmap ... -iL -
```

***

## nmap\_scan\_remote.bat

Executes Nmap scans on remote Linux servers via SSH.

### Parameters

<ParamField type="string">
  Project name
</ParamField>

<ParamField type="string">
  Target IP addresses (comma-separated)
</ParamField>

<ParamField type="string">
  Unique timestamp
</ParamField>

<ParamField type="string">
  Local output directory
</ParamField>

<ParamField type="string">
  Remote Linux server hostname/IP
</ParamField>

<ParamField type="string">
  SSH username
</ParamField>

<ParamField type="string">
  SSH password
</ParamField>

### Usage

```batch theme={null}
nmap_scan_remote.bat "MyProject" "192.168.1.100" "20240315_143000" "C:\Reports" "scanner.company.com" "root" "password"
```

### Prerequisites

Remote server requirements:

```bash theme={null}
apt-get install nmap
```

### Remote Execution Workflow

1. **SSH Connection** - Connect to remote server via plink
2. **Execute Nmap** - Run scan on remote server
3. **File Transfer** - Download XML results via pscp
4. **Local Conversion** - Transform XML to HTML locally
5. **Cleanup** - Remove remote temporary files

### SSH Command Execution

**Run Nmap remotely:**

```batch theme={null}
plink.exe -no-antispoof -ssh -P 22 -l root -pw password -C scanner.company.com \
  "echo 192.168.1.100 | nmap -Pn -O --system-dns -vv -sS -sC -sV \
  -oX '/tmp/NmapReport - 20240315_143000.xml' \
  -pT:1-65535,U:7,9,13,17,19,... --webxml -iL - "
```

### File Transfer

**Download results:**

```batch theme={null}
pscp.exe -P 22 -l root -pw password -C \
  scanner.company.com:"/tmp/NmapReport - 20240315_143000.xml" \
  "%TEMP%\NmapReport - 20240315_143000.xml"

pscp.exe -P 22 -l root -pw password -C \
  scanner.company.com:"/tmp/NmapReport - 20240315_143000.xml" \
  "C:\Reports\NmapReport - 20240315_143000.xml"
```

**Remove remote files:**

```batch theme={null}
plink.exe -no-antispoof -ssh -P 22 -l root -pw password -C \
  scanner.company.com "rm -f '/tmp/NmapReport - 20240315_143000.xml'"
```

### Local vs Remote Comparison

<Tabs>
  <Tab title="Local (nmap_scan.bat)">
    **Execution:**

    ```batch theme={null}
    echo 192.168.1.100 | nmap.exe [options] -iL -
    ```

    **Advantages:**

    * Direct execution
    * No network dependencies
    * Faster for local networks

    **Requirements:**

    * Nmap installed on Windows
    * Administrator privileges
    * Direct network access to targets
  </Tab>

  <Tab title="Remote (nmap_scan_remote.bat)">
    **Execution:**

    ```batch theme={null}
    plink.exe -ssh server "echo 192.168.1.100 | nmap [options] -iL -"
    ```

    **Advantages:**

    * Scan from different network segment
    * Leverage Linux Nmap capabilities
    * Centralized scanning infrastructure

    **Requirements:**

    * SSH access to remote server
    * Nmap installed on remote server
    * plink.exe and pscp.exe (PuTTY tools)
  </Tab>
</Tabs>

### SSH Tools Used

**plink.exe** - PuTTY Link (SSH client)

```batch theme={null}
plink.exe -no-antispoof -ssh -P 22 -l username -pw password -C server "command"
```

Options:

* `-no-antispoof` - Skip host key verification prompt
* `-ssh` - Use SSH protocol
* `-P 22` - SSH port
* `-l username` - Login username
* `-pw password` - Password authentication
* `-C` - Enable compression

**pscp.exe** - PuTTY Secure Copy

```batch theme={null}
pscp.exe -P 22 -l username -pw password -C server:remotefile localfile
```

### HTML Report Display

Both scripts automatically open the HTML report:

```batch theme={null}
echo "C:\Reports\NmapReport - 20240315_143000.html"
start "" /WAIT /I """C:\Reports\NmapReport - 20240315_143000.html"""
```

### XSL Transformation

The `nmap.xsl` stylesheet formats the XML into a styled HTML report with:

* Host discovery summary
* Open ports table
* Service versions
* OS detection results
* NSE script output
* Scan statistics

### Cleanup

**Local script:**

```batch theme={null}
del /F "%DocumentacionXML%"
```

**Remote script:**

```batch theme={null}
del /F "%TEMP%\%DocumentacionXML%"
plink.exe ... "rm -f '/tmp/%DocumentacionXML%'"
```

### Network Access Patterns

**Local Scan:**

```
Windows Client --[Nmap]--> Target Network
```

**Remote Scan:**

```
Windows Client --[SSH]--> Linux Scanner --[Nmap]--> Target Network
```

### Common Use Cases

**Internal Network Audit:**

```batch theme={null}
nmap_scan.bat "Internal Audit" "10.0.0.0/24" "20240315_143000" "C:\Audits" "nmap.exe"
```

**DMZ Scanning from Jump Server:**

```batch theme={null}
nmap_scan_remote.bat "DMZ Scan" "203.0.113.10,203.0.113.20" "20240315_143000" "C:\Reports" "jumpbox.company.com" "scanuser" "password"
```

**Multiple Target Enumeration:**

```batch theme={null}
nmap_scan.bat "Server Survey" "192.168.1.10,192.168.1.20,192.168.1.30,192.168.1.40" "20240315_143000" "C:\Results" "nmap.exe"
```


# OpenVAS Scripts
Source: https://simplevulnerabilitymanager-svm.mintlify.app/scripts/openvas

OpenVAS/GVM vulnerability scanning scripts for local and remote execution

## Overview

The OpenVAS scripts automate vulnerability scanning using OpenVAS/Greenbone Vulnerability Manager (GVM) via the OMP (OpenVAS Management Protocol) API. Scripts support both local Windows execution and remote Linux scanning.

## openvas\_scan.bat

Launches OpenVAS vulnerability scans on Windows using the OMP protocol.

### Parameters

<ParamField type="string">
  Project name for the scan
</ParamField>

<ParamField type="string">
  Target IP addresses or ranges
</ParamField>

<ParamField type="string">
  OpenVAS server hostname or IP
</ParamField>

<ParamField type="string">
  OpenVAS manager port (typically 9390)
</ParamField>

<ParamField type="string">
  OpenVAS authentication username
</ParamField>

<ParamField type="string">
  OpenVAS authentication password
</ParamField>

<ParamField type="string">
  Scan configuration UUID
</ParamField>

<ParamField type="string">
  Report format UUID
</ParamField>

<ParamField type="string">
  Output directory for reports
</ParamField>

<ParamField type="string">
  Timestamp for unique file naming
</ParamField>

### Usage

```batch theme={null}
openvas_scan.bat "MyProject" "192.168.1.100" "openvas.local" "9390" "admin" "password" "daba56c8-73ec-11df-a475-002264764cea" "a994b278-1f62-11e1-96ac-406186ea4fc5" "C:\Reports" "20240315_143000"
```

### Workflow

1. **Create Target** - Defines scan target with IP and port configuration
2. **Create Task** - Associates target with scan configuration
3. **Start Task** - Launches the scan
4. **Monitor Progress** - Polls status every 60 seconds
5. **Generate Report** - Retrieves report in specified format
6. **Decode Report** - Decodes base64-encoded report data
7. **Cleanup** - Removes temporary files

### OMP Protocol Implementation

The script uses `omp_cracked.exe` to communicate via OMP XML protocol.

**Create Target:**

```xml theme={null}
<create_target>
  <name>"ProjectName_Timestamp"</name>
  <hosts>192.168.1.100</hosts>
  <alive_tests>Consider Alive</alive_tests>
  <port_range>T:1-65535,U:7,9,13,17,19,21,37,53,67-69,98,111,...</port_range>
</create_target>
```

**Create Task:**

```xml theme={null}
<create_task>
  <name>"ProjectName_Timestamp"</name>
  <config id="SCAN_CONFIG_UUID"></config>
  <target id="TARGET_ID"></target>
</create_task>
```

**Start Task:**

```xml theme={null}
<start_task task_id="TASK_ID"></start_task>
```

**Monitor Status:**

```xml theme={null}
<get_tasks task_id="TASK_ID"></get_tasks>
```

**Get Report:**

```xml theme={null}
<get_reports 
  report_id="REPORT_ID" 
  filter="autofp=0 apply_overrides=1 notes=1 overrides=1 result_hosts_only=1 sort-reverse=severity levels=hml min_qod=70" 
  format_id="FORMAT_ID"/>
```

### Port Configuration

The script scans comprehensive port ranges:

* **TCP:** 1-65535
* **UDP:** Common service ports (DNS, DHCP, SNMP, NTP, etc.)

Full UDP port list includes: 7, 9, 13, 17, 19, 21, 37, 53, 67-69, 98, 111, 121, 123, 135, 137-138, 161, 177, 371, 389, 407, 445, 456, 464, 500, 512, 514, 517-518, 520, 555, 635, 666, 858, 1001, 1010-1011, 1015, 1024-1049, 1051-1055, 1170, 1194, 1243, 1245, 1434, 1492, 1600, 1604, 1645, 1701, 1807, 1812, 1900, 1978, 1981, 1999, 2001-2002, 2023, 2049, 2115, 2140, 2801, 2967, 3024, 3129, 3150, 3283, 3527, 3700, 3801, 4000, 4092, 4156, 4569, 4590, 4781, 5000-5001, 5036, 5060, 5321, 5400-5402, 5503, 5569, 5632, 5742, 6051, 6073, 6502, 6670, 6771, 6912, 6969, 7000, 7111, 7222, 7300-7301, 7306-7308, 7778, 7789, 7938, 9872-9875, 9989, 10067, 10167, 11000, 11223, 12223, 12345-12346, 12361-12362, 15253, 15345, 16969, 17185, 20001, 20034, 21544, 21862, 22222, 23456, 26274, 26409, 27444, 30029, 31335, 31337-31339, 31666, 31785, 31789, 31791-31792, 32771, 33333, 34324, 40412, 40421-40423, 40426, 47262, 50505, 50766, 51100-51101, 51109, 53001, 54321, 61466

### Report Filters

Reports are filtered with:

* **autofp=0** - No automatic false positive detection
* **apply\_overrides=1** - Apply user overrides
* **notes=1** - Include notes
* **overrides=1** - Include overrides
* **result\_hosts\_only=1** - Only hosts with results
* **sort-reverse=severity** - Sort by severity (high to low)
* **levels=hml** - High, Medium, Low severities
* **min\_qod=70** - Minimum Quality of Detection 70%

### Error Handling

**Service Connection:**

```batch theme={null}
findstr.exe /C:"OK" output.txt
if %ERRORLEVEL% NEQ 0 (
  echo Revise Usuario/Contraseña o levante el servicio
  echo service openvas-scanner restart
  echo service openvas-manager restart
  echo service greenbone-security-assistant restart
)
```

**Status Checks:**

* **Internal Error** - Exits with error
* **Stopped** - Exits scan
* **Done** - Proceeds to report generation

### Output Files

* `OpenvasReport - {Timestamp}.html` - Decoded HTML report

The report automatically opens after completion.

***

## openvas\_scan\_remote.sh

Executes OpenVAS scans on remote Linux servers.

### Parameters

| Parameter       | Description                                   |
| --------------- | --------------------------------------------- |
| `Proyecto`      | Project name                                  |
| `IP`            | Target IP addresses                           |
| `Username`      | OpenVAS username                              |
| `Password`      | OpenVAS password                              |
| `OpenvasmdIP`   | OpenVAS manager IP (auto-detected if empty)   |
| `OpenvasmdPort` | OpenVAS manager port (auto-detected if empty) |
| `ScanConfig`    | Scan configuration UUID                       |
| `FormatID`      | Report format UUID                            |
| `Timestamp`     | Unique timestamp                              |

### Usage

<Tabs>
  <Tab title="Linux">
    ```bash theme={null}
    ./openvas_scan_remote.sh "MyProject" "192.168.1.100" "admin" "password" "" "" "daba56c8-73ec-11df-a475-002264764cea" "a994b278-1f62-11e1-96ac-406186ea4fc5" "20240315_143000"
    ```
  </Tab>
</Tabs>

### Prerequisites

The script validates required tools:

```bash theme={null}
which xmlstarlet >/dev/null
if [ $? -ne 0 ] ; then
  echo "Falta el programa xmlstarlet. Instalelo primero"
  exit
fi

which omp >/dev/null
if [ $? -ne 0 ] ; then
  echo "Falta el programa openvas-client(omp). Instalelo primero"
  exit
fi
```

**Required packages:**

* `xmlstarlet` - XML parsing
* `openvas-client` - OMP client (omp command)
* `openssl` - Base64 decoding

### Service Auto-Detection

If server/port parameters are empty, the script auto-detects using `netstat` or `ss`:

```bash theme={null}
OpenvasmdIP=$(netstat -anp | grep openvasmd | grep LISTEN | grep -oE '\b([0-9]{1,3}\.){3}[0-9]{1,3}\b' | grep -v 0.0.0.0)
OpenvasmdPort=$(netstat -ltp | grep openvasmd | grep LISTEN | grep -oE ':[0-9]{1,6}' | cut -d":" -f2)
```

Defaults to `127.0.0.1:9390` if detection fails.

### Scanner Initialization Wait

The script waits for scanner initialization:

```bash theme={null}
openvassd_status=$(ps ax | grep "openvassd: Initializing" | grep -v grep)
while [ ! -z $openvassd_status ] ; do
  echo $openvassd_status
  ping -c 61 127.0.0.1 > /dev/null
done
```

### Implementation Differences

<Tabs>
  <Tab title="Windows (BAT)">
    **Command:**

    ```batch theme={null}
    omp_cracked.exe --host=%Server% --port=%Port% \
      --username=%Username% --password=%Password% \
      --xml="<create_target>...</create_target>"
    ```

    **XML Parsing:**

    ```batch theme={null}
    type output.txt | xml.exe sel -t -m "create_target_response" -v "@id"
    ```

    **Base64 Decode:**

    ```batch theme={null}
    openssl.exe -in input.txt enc -base64 -d -out output.html
    ```
  </Tab>

  <Tab title="Linux (SH)">
    **Command:**

    ```bash theme={null}
    omp --host=$Server --port=$Port \
      --username=$Username --password=$Password \
      --xml="<create_target>...</create_target>"
    ```

    **XML Parsing:**

    ```bash theme={null}
    xmlstarlet sel -t -m "create_target_response" -v "@id" input.txt
    ```

    **Base64 Decode:**

    ```bash theme={null}
    cat input.txt | openssl enc -base64 -d -A > output.html
    ```
  </Tab>
</Tabs>

### Output Location

* **Windows:** `%Documentacion%\OpenvasReport - {Timestamp}.html`
* **Linux:** `/tmp/OpenvasReport - {Timestamp}.html`

### Cleanup

Both scripts remove temporary files:

```bash theme={null}
rm "/tmp/openvas_scan_target_$Timestamp.txt"
rm "/tmp/openvas_scan_target_id_$Timestamp.txt"
rm "/tmp/openvas_scan_task_$Timestamp.txt"
rm "/tmp/openvas_scan_task_id_$Timestamp.txt"
rm "/tmp/openvas_scan_report_$Timestamp.txt"
rm "/tmp/openvas_scan_report_id_$Timestamp.txt"
rm "/tmp/openvas_scan_status_scan_$Timestamp.txt"
rm "/tmp/openvas_scan_status_report_$Timestamp.txt"
rm "/tmp/openvas_scan_report_response_$Timestamp.txt"
rm "/tmp/openvas_scan_b64_report_$Timestamp.txt"
```

### API Documentation

OMP protocol documentation: [http://docs.greenbone.net/API/OMP/omp.html](http://docs.greenbone.net/API/OMP/omp.html)


# QARK Scripts
Source: https://simplevulnerabilitymanager-svm.mintlify.app/scripts/qark

Quick Android Review Kit automated security analysis scripts

QARK (Quick Android Review Kit) scripts automate security analysis of Android APK files by identifying vulnerabilities and generating exploit APKs. These scripts support remote Linux execution with automated reporting.

## Overview

| Script     | Purpose                          | Platform             |
| ---------- | -------------------------------- | -------------------- |
| `qark.bat` | Orchestrate remote QARK analysis | Windows (SSH client) |
| `qark.sh`  | Execute QARK analysis on Linux   | Linux                |

## Tool Information

**QARK**: Quick Android Review Kit

* **Developer**: LinkedIn
* **Repository**: `https://github.com/linkedin/qark`
* **Type**: Static analysis and exploit generation tool
* **Purpose**: Identify Android application vulnerabilities and create proof-of-concept exploits

### Installation

From install scripts (Linux):

```bash theme={null}
cd ~
git clone --depth 1 https://github.com/linkedin/qark
cd qark

# Download Android SDK tools
cd $HOME/qark/
wget https://dl.google.com/android/repository/sdk-tools-linux-4333796.zip -O sdk-tools-linux-4333796.zip
unzip sdk-tools-linux-4333796.zip
echo y | tools/android update sdk --no-ui

# Install QARK
pip install -r requirements.txt
python ./setup.py install
```

## qark.bat

Windows batch script that orchestrates remote QARK analysis on a Linux server.

### Parameters

```batch theme={null}
qark.bat <DirApp> <PathAPK> <FileApk> <Timestamp> <Documentacion> <Server> <Username> <Password>
```

| Parameter       | Description                           | Example              |
| --------------- | ------------------------------------- | -------------------- |
| `DirApp`        | QARK installation directory on server | `/root/qark`         |
| `PathAPK`       | Local path to APK file                | `C:\samples\app.apk` |
| `FileApk`       | APK filename (no extension)           | `app`                |
| `Timestamp`     | Unique timestamp identifier           | `20230615_143022`    |
| `Documentacion` | Local output directory                | `C:\reports`         |
| `Server`        | SSH server hostname/IP                | `192.168.1.100`      |
| `Username`      | SSH username                          | `root`               |
| `Password`      | SSH password                          | `password123`        |

### Analysis Workflow

<Steps>
  <Step title="Upload APK">
    Transfers APK file to `/tmp/` directory on remote server.

    ```batch theme={null}
    pscp.exe -l %Username% -pw %Password% -C ^
      "%PathAPK%" %Server%:"/tmp/%FileApk%_%Timestamp%.apk"
    ```
  </Step>

  <Step title="Upload Helper Script">
    Transfers `qark.sh` helper script to server.

    ```batch theme={null}
    pscp.exe -l %Username% -pw %Password% -C ^
      "qark.sh" %Server%:"/tmp/qark.sh"
    ```

    Converts line endings from Windows to Unix format.
  </Step>

  <Step title="Manual Execution Prompt">
    Script pauses and instructs user to manually run QARK on server.

    ```
    cd "/root/qark" ; chmod 755 ./qark.sh ; ./qark.sh "/root/qark" "app_20230615_143022"
    ```

    User must SSH to server and execute command, then press key to continue.
  </Step>

  <Step title="Archive Results">
    Creates tar.gz archive of analysis results.

    ```bash theme={null}
    cd '/root/qark/qark'
    tar -cvzf '/tmp/QarkReport - app_20230615_143022.tar.gz' \
      '/tmp/app_20230615_143022.apk' \
      'Report_app_20230615_143022/' \
      logs/ \
      exploit/
    ```
  </Step>

  <Step title="Download Report">
    Transfers archive back to local Windows machine.

    ```batch theme={null}
    pscp.exe -P 22 -l %Username% -pw %Password% -C ^
      %Server%:"/tmp/QarkReport - %FileApk%_%Timestamp%.tar.gz" ^
      %Documentacion%
    ```
  </Step>

  <Step title="Cleanup">
    Removes temporary files from remote server.

    ```bash theme={null}
    rm -f '/tmp/QarkReport - app_20230615_143022.tar.gz' '/root/qark/qark.sh'
    ```
  </Step>
</Steps>

### Script Implementation

```batch theme={null}
@echo off
setlocal
set DirApp=%1
set PathAPK=%2
set FileApk=%3
set Timestamp=%4
set Documentacion=%5
set Server=%6
set Username=%7
set Password=%8

set PathAPK=%PathAPK:"=%
set FileApk=%FileApk:"=%
set DirApp=%DirApp:"=%
set Documentacion=%Documentacion:"=%
set Documentacion="%Documentacion%\QarkReport - %FileApk%_%Timestamp%.tar.gz"

@title=[Qark] - %FileApk%

# Upload APK
"%~dp0pscp.exe" -l %Username% -pw %Password% -C ^
  "%PathAPK%" %Server%:"/tmp/%FileApk%_%Timestamp%.apk"

# Upload helper script
"%~dp0pscp.exe" -l %Username% -pw %Password% -C ^
  "%~dp0qark.sh" %Server%:"/tmp/qark.sh"

# Convert line endings
"%~dp0plink.exe" -P 22 -ssh -l %Username% -pw %Password% -C %Server% ^
  "tr -d '\15\32' < /tmp/qark.sh > '%DirApp%/qark.sh'"

"%~dp0plink.exe" -P 22 -ssh -l %Username% -pw %Password% -C %Server% ^
  "rm -f '/tmp/qark.sh'"

:retry
cls
echo Ejecutar en el server %Server% el comando:
echo cd "%DirApp%" ; chmod 755 ./qark.sh ; ./qark.sh "%DirApp%" "%FileApk%_%Timestamp%"
echo Solo cuando termine, presione una tecla para obtener el reporte
set /p respuesta="Desea continuar? (y/n)"
pause

if %respuesta% == y (
  # Archive results
  "%~dp0plink.exe" -P 22 -ssh -l %Username% -pw %Password% -C %Server% ^
    "cd '%DirApp%/qark' ; tar -cvzf '/tmp/QarkReport - %FileApk%_%Timestamp%.tar.gz' ^
    '/tmp/%FileApk%_%Timestamp%.apk' 'Report_%FileApk%_%Timestamp%/' logs/ exploit/"
  
  # Download archive
  "%~dp0pscp.exe" -P 22 -l %Username% -pw %Password% -C ^
    %Server%:"/tmp/QarkReport - %FileApk%_%Timestamp%.tar.gz" %Documentacion%
  
  # Cleanup
  "%~dp0plink.exe" -P 22 -ssh -l %Username% -pw %Password% -C %Server% ^
    "rm -f '/tmp/QarkReport - %FileApk%_%Timestamp%.tar.gz' '%DirApp%/qark.sh'"
  
  echo %Documentacion%
  pause
) else (
  if %respuesta% == n (
    goto :fin
  ) else (
    goto :retry
  )
)

:fin
```

### Usage Example

```batch theme={null}
qark.bat ^
  "/root/qark" ^
  "C:\samples\vulnerable_app.apk" ^
  "vulnerable_app" ^
  "20230615_143022" ^
  "C:\reports" ^
  "192.168.1.100" ^
  "root" ^
  "password123"
```

## qark.sh

Linux shell script that executes QARK analysis with proper parameters.

### Parameters

```bash theme={null}
qark.sh <DirApp> <APK>
```

| Parameter | Description                         | Example                          |
| --------- | ----------------------------------- | -------------------------------- |
| `DirApp`  | QARK installation directory         | `/root/qark`                     |
| `APK`     | APK filename in /tmp (no extension) | `vulnerable_app_20230615_143022` |

### Script Implementation

```bash theme={null}
#!/bin/bash
DirApp=$1
APK=$(echo $2 | sed 's/"//g')

cd $DirApp

# Clean previous results
rm -fr report/build/ logs/ exploit/

# Run QARK analysis
qark --apk "/tmp/$APK.apk" \
     --debug \
     --exploit-apk \
     --report-type html \
     --sdk-path tools/

# Copy exploit APK if generated
if [ -f build/qark/app/build/outputs/apk/app-debug.apk ] ; then
    mkdir exploit/
    cp build/qark/app/build/outputs/apk/app-debug.apk exploit/
fi

if [ -f build/qark/app/build/outputs/apk/app-debug-unaligned.apk ] ; then
    mkdir exploit/
    cp build/qark/app/build/outputs/apk/app-debug-unaligned.apk exploit/
fi
```

### QARK Command Options

| Option               | Purpose                                             |
| -------------------- | --------------------------------------------------- |
| `--apk`              | Path to APK file to analyze                         |
| `--debug`            | Enable debug output for troubleshooting             |
| `--exploit-apk`      | Generate exploit APK for identified vulnerabilities |
| `--report-type html` | Generate HTML format report                         |
| `--sdk-path tools/`  | Path to Android SDK tools                           |

### Analysis Output

The script generates:

1. **HTML Report**: Detailed vulnerability findings in `Report_<APK>/`
2. **Logs**: Analysis execution logs in `logs/`
3. **Exploit APKs**: Proof-of-concept exploits in `exploit/`

## Output Structure

After analysis, the tar.gz archive contains:

```
QarkReport - vulnerable_app_20230615_143022.tar.gz
├── /tmp/vulnerable_app_20230615_143022.apk   # Original APK
├── Report_vulnerable_app_20230615_143022/     # HTML report
│   ├── index.html                             # Main report page
│   ├── css/                                   # Stylesheets
│   └── ...                                    # Report assets
├── logs/                                      # Analysis logs
│   └── qark.log                               # Execution log
└── exploit/                                   # Exploit APKs
    ├── app-debug.apk                          # Signed exploit
    └── app-debug-unaligned.apk                # Unsigned exploit
```

## Vulnerability Detection

QARK identifies common Android security issues:

### Security Checks

* **Exported Components**: Activities, services, receivers without protection
* **Intent Vulnerabilities**: Implicit intents, intent injection
* **WebView Issues**: JavaScript enabled, file access, XSS vulnerabilities
* **Cryptography**: Weak algorithms, hardcoded keys, insecure random
* **Data Storage**: World-readable files, unencrypted databases
* **Network Security**: Clear-text traffic, SSL/TLS issues
* **Permissions**: Dangerous permissions, custom permission issues
* **Code Obfuscation**: ProGuard configuration analysis

### Exploit Generation

QARK automatically generates exploit APKs for:

* Exported component exploitation
* Intent hijacking
* Broadcast theft
* Activity hijacking
* Service manipulation

## Manual Execution Workflow

<Tabs>
  <Tab title="Windows to Linux">
    1. **Run qark.bat** on Windows machine
    2. **Wait for prompt** to execute on server
    3. **SSH to Linux server** in separate terminal
    4. **Execute command** shown in prompt:
       ```bash theme={null}
       cd "/root/qark"
       chmod 755 ./qark.sh
       ./qark.sh "/root/qark" "vulnerable_app_20230615_143022"
       ```
    5. **Wait for completion** (may take several minutes)
    6. **Return to Windows** terminal and press key
    7. **Archive downloads** automatically
  </Tab>

  <Tab title="Direct Linux">
    ```bash theme={null}
    # Upload APK
    scp vulnerable_app.apk root@192.168.1.100:/tmp/vulnerable_app_20230615_143022.apk

    # SSH to server
    ssh root@192.168.1.100

    # Run QARK
    cd /root/qark
    qark --apk "/tmp/vulnerable_app_20230615_143022.apk" \
         --debug \
         --exploit-apk \
         --report-type html \
         --sdk-path tools/

    # Archive results
    cd /root/qark/qark
    tar -cvzf /tmp/QarkReport.tar.gz \
      /tmp/vulnerable_app_20230615_143022.apk \
      Report_vulnerable_app_20230615_143022/ \
      logs/ \
      exploit/

    # Download
    scp root@192.168.1.100:/tmp/QarkReport.tar.gz ./
    ```
  </Tab>
</Tabs>

## Troubleshooting

### Script Not Found

```
bash: ./qark.sh: No such file or directory
```

**Solution**: Ensure qark.sh was uploaded and has correct permissions:

```bash theme={null}
ls -la /root/qark/qark.sh
chmod 755 /root/qark/qark.sh
```

### Line Ending Issues

```
bash: ./qark.sh: /bin/bash^M: bad interpreter
```

**Solution**: Script includes `tr -d '\15\32'` to fix Windows line endings automatically.

### QARK Not Installed

```
qark: command not found
```

**Solution**: Install QARK using installation commands:

```bash theme={null}
cd ~/qark
python ./setup.py install
```

### Missing Android SDK

```
Error: Android SDK not found
```

**Solution**: Download and configure SDK tools:

```bash theme={null}
cd $HOME/qark/
wget https://dl.google.com/android/repository/sdk-tools-linux-4333796.zip
unzip sdk-tools-linux-4333796.zip
echo y | tools/android update sdk --no-ui
```

### Exploit APK Not Generated

If no exploit APK appears in `exploit/` directory:

* No exploitable vulnerabilities found
* Build process failed (check logs/)
* Android SDK tools not properly configured

## Performance Considerations

* **Analysis Time**: 5-15 minutes for typical APK
* **Large APKs**: May take 30+ minutes for complex applications
* **Server Resources**: Requires adequate CPU and memory
* **Network**: Upload/download time depends on APK size and connection speed

## Security Best Practices

* **Credential Management**: Avoid hardcoding passwords in scripts
* **Secure Transport**: Use SSH keys instead of passwords when possible
* **Network Security**: Ensure SSH traffic is on trusted network
* **Cleanup**: Script automatically removes temporary files
* **Archive Security**: Protect downloaded archives containing sensitive analysis data

## Related Scripts

* `mobsf.bat`: Alternative mobile security framework
* `androbugs_framework.bat`: Another APK security scanner
* `apktool_decode_local.bat`: Manual APK decompilation for code review


# Qualys Scripts
Source: https://simplevulnerabilitymanager-svm.mintlify.app/scripts/qualys

Qualys vulnerability scanning and reporting automation scripts

## Overview

The Qualys scripts automate vulnerability scanning, report generation, and scanner appliance management using the Qualys API. Scripts support both internal and external scanners with optional proxy configuration.

## qualys\_scan.bat

Launches Qualys vulnerability scans using internal or external scanner appliances.

### Parameters

<ParamField type="string">
  Project name for the scan
</ParamField>

<ParamField type="string">
  Target IP addresses or ranges
</ParamField>

<ParamField type="string">
  Qualys account username
</ParamField>

<ParamField type="string">
  Qualys account password
</ParamField>

<ParamField type="string">
  Scanner appliance name or "External" for cloud scanners
</ParamField>

<ParamField type="string">
  Scan option profile title
</ParamField>

<ParamField type="boolean">
  1 = Generate automatic report, 0 = Scan only
</ParamField>

<ParamField type="string">
  Output directory for reports
</ParamField>

<ParamField type="string">
  Report format (pdf, html, xml, csv, mht)
</ParamField>

<ParamField type="string">
  Report template ID (for automatic reports)
</ParamField>

<ParamField type="string">
  Timestamp for unique file naming
</ParamField>

<ParamField type="boolean">
  1 = Use proxy, 0 = Direct connection
</ParamField>

<ParamField type="string">
  Proxy server IP (if UsoProxy=1)
</ParamField>

<ParamField type="string">
  Proxy server port (if UsoProxy=1)
</ParamField>

<ParamField type="string">
  Proxy authentication username
</ParamField>

<ParamField type="string">
  Proxy authentication password
</ParamField>

### Usage

**External Scanner:**

```batch theme={null}
qualys_scan.bat "MyProject" "192.168.1.100" "admin" "password" "External" "Initial Options" 1 "C:\Reports" "pdf" "1075927" "20240315_143000" 0
```

**Internal Scanner with Proxy:**

```batch theme={null}
qualys_scan.bat "MyProject" "10.0.0.50" "admin" "password" "Scanner-NYC" "Full Scan" 1 "C:\Reports" "html" "1075927" "20240315_143000" 1 "proxy.company.com" "8080" "proxyuser" "proxypass"
```

### Workflow

1. **Authentication** - Login to Qualys API
2. **Scan Launch** - Start vulnerability scan
3. **IP Validation** - Auto-add IPs to asset inventory if needed
4. **Progress Monitoring** - Poll scan status every 60 seconds
5. **Scan Report** - Generate post-scan report
6. **Custom Report** - Optional detailed report generation
7. **Cleanup** - Logout and remove temporary files

### API Endpoints Used

| Endpoint               | Purpose                       |
| ---------------------- | ----------------------------- |
| `/api/2.0/fo/session/` | Authentication                |
| `/api/2.0/fo/scan/`    | Launch and manage scans       |
| `/msp/asset_ip.php`    | Add IPs to asset inventory    |
| `/api/2.0/fo/report/`  | Generate and download reports |

### Authentication

**Login:**

```batch theme={null}
curl --compressed -H "X-Requested-With: Curl Sample" \
  -D auth_cookies.txt \
  --data "action=login" \
  --data "username=admin" \
  --data "password=password" \
  https://qualysapi.qualys.com/api/2.0/fo/session/
```

**Session Management:**
Cookies are stored in temporary files and reused:

```batch theme={null}
curl -b auth_cookies.txt \
  --data "action=list" \
  https://qualysapi.qualys.com/api/2.0/fo/scan/
```

### Proxy Configuration

When `UsoProxy=1`, the script configures proxy settings:

```batch theme={null}
set Proxy=--proxy proxy.company.com:8080 --proxy-anyauth --proxy-user username:password
curl %Proxy% https://qualysapi.qualys.com/...
```

### Scan Launch

**External Scanner:**

```batch theme={null}
curl --data-urlencode "action=launch" \
  --data-urlencode "ip=192.168.1.100" \
  --data-urlencode "scan_title=MyProject" \
  --data-urlencode "option_title=Initial Options" \
  https://qualysapi.qualys.com/api/2.0/fo/scan/
```

**Internal Scanner:**

```batch theme={null}
curl --data-urlencode "action=launch" \
  --data-urlencode "ip=10.0.0.50" \
  --data-urlencode "scan_title=MyProject" \
  --data-urlencode "iscanner_name=Scanner-NYC" \
  --data-urlencode "option_title=Full Scan" \
  https://qualysapi.qualys.com/api/2.0/fo/scan/
```

### IP Auto-Registration

If scan launch fails because IP is not in asset inventory:

```batch theme={null}
curl -u admin:password \
  --data-urlencode "action=add" \
  --data-urlencode "host_ips=192.168.1.100" \
  --data-urlencode "tracking_method=ip" \
  --data-urlencode "owner=admin" \
  --data-urlencode "comment=MyProject" \
  https://qualysapi.qualys.com/msp/asset_ip.php
```

### Status Monitoring

```batch theme={null}
curl --data-urlencode "action=list" \
  --data-urlencode "scan_ref=scan/1234567890.12345" \
  https://qualysapi.qualys.com/api/2.0/fo/scan/ | \
  xml.exe sel -t -v "/SCAN_LIST_OUTPUT/RESPONSE/SCAN_LIST/SCAN/STATUS/STATE"
```

**Possible states:**

* Running
* Paused
* Finished
* Error

### Error Handling

**Authentication Errors:**

```xml theme={null}
<SIMPLE_RETURN>
  <RESPONSE>
    <TEXT>Bad Login/Password</TEXT>
  </RESPONSE>
</SIMPLE_RETURN>
```

**API Throttling:**

```
This API cannot be run again for another X hours
```

**Scan Limit Reached:**

```
This limit has already been reached
```

**Service Maintenance:**

```
Service Unavailable
```

### Report Generation

The script calls `qualys_scan_report.bat` and optionally `qualys_report.bat`:

```batch theme={null}
call qualys_scan_report.bat "MyProject" "192.168.1.100" admin password "C:\Reports" pdf 1075927 20240315_143000 0

if %AutoReport% EQU 1 (
  call qualys_report.bat "MyProject" "192.168.1.100" admin password "C:\Reports" html 1234567 20240315_143000 0
)
```

***

## qualys\_report.bat

Generates custom Qualys vulnerability reports from asset inventory.

### Parameters

<ParamField type="string">
  Project name
</ParamField>

<ParamField type="string">
  Target IP addresses
</ParamField>

<ParamField type="string">
  Qualys username
</ParamField>

<ParamField type="string">
  Qualys password
</ParamField>

<ParamField type="string">
  Output directory
</ParamField>

<ParamField type="string">
  Report format (pdf, html, xml, csv, mht)
</ParamField>

<ParamField type="string">
  Report template ID
</ParamField>

<ParamField type="string">
  Unique timestamp
</ParamField>

<ParamField type="boolean">
  Proxy usage flag
</ParamField>

<ParamField type="string">
  Proxy IP address
</ParamField>

<ParamField type="string">
  Proxy port
</ParamField>

<ParamField type="string">
  Proxy username
</ParamField>

<ParamField type="string">
  Proxy password
</ParamField>

### Usage

```batch theme={null}
qualys_report.bat "MyProject" "192.168.1.100" "admin" "password" "C:\Reports" "pdf" "1234567" "20240315_143000" 0
```

### Report Launch

```batch theme={null}
curl --data-urlencode "action=launch" \
  --data-urlencode "ips=192.168.1.100" \
  --data-urlencode "template_id=1234567" \
  --data-urlencode "output_format=pdf" \
  --data-urlencode "report_title=MyProject" \
  https://qualysapi.qualys.com/api/2.0/fo/report/
```

### Report Status Polling

```batch theme={null}
curl --data "action=list" --data "id=REPORT_ID" \
  https://qualysapi.qualys.com/api/2.0/fo/report/ | \
  xml.exe sel -t -v "/REPORT_LIST_OUTPUT/RESPONSE/REPORT_LIST/REPORT/STATUS/STATE"
```

**States:**

* Submitted
* Running
* Finished

### Report Download

Once state is "Finished":

```batch theme={null}
curl https://qualysapi.qualys.com/api/2.0/fo/report/?action=fetch&id=REPORT_ID \
  -o "QualysReport - 20240315_143000.pdf"
```

### XML Report Parsing

For XML reports, the script displays vulnerability summaries:

```batch theme={null}
type report.xml | xml.exe sel -t \
  -m "ASSET_DATA_REPORT/GLOSSARY/VULN_DETAILS_LIST/VULN_DETAILS" \
  -v "QID[@id]" -o " - " -v "TITLE" -n
```

**Example output:**

```
45038 - DNS Server Recursive Query Cache Poisoning Weakness
86635 - SSL Certificate Cannot Be Trusted
38173 - Weak Ciphers Supported (SSL/TLS)
```

**Host-level results:**

```batch theme={null}
type report.xml | xml.exe sel -t \
  -m "ASSET_DATA_REPORT/HOST_LIST/HOST" \
  -n -v "IP" \
  -m "VULN_INFO_LIST/VULN_INFO" \
  -n -o "  QID:" -v "QID[@id]" \
  -n -o "  Resultado:" -n -v "RESULT" -n -n
```

### Output Files

* `QualysReport - {Timestamp}.{TypeReport}` - Generated report

Supported formats:

* **pdf** - PDF document
* **html** - HTML report
* **xml** - XML data
* **csv** - Comma-separated values
* **mht** - MHTML web archive

***

## qualys\_get\_scanner\_appliances.bat

Retrieves list of available Qualys scanner appliances.

### Parameters

<ParamField type="string">
  Qualys username
</ParamField>

<ParamField type="string">
  Qualys password
</ParamField>

<ParamField type="string">
  Unique timestamp
</ParamField>

<ParamField type="boolean">
  Proxy usage flag
</ParamField>

<ParamField type="string">
  Proxy IP
</ParamField>

<ParamField type="string">
  Proxy port
</ParamField>

<ParamField type="string">
  Proxy username
</ParamField>

<ParamField type="string">
  Proxy password
</ParamField>

### Usage

```batch theme={null}
qualys_get_scanner_appliances.bat "admin" "password" "20240315_143000" 0
```

### Implementation

**API Request:**

```batch theme={null}
curl -G --data "action=list" \
  https://qualysapi.qualys.com/api/2.0/fo/appliance/ \
  -o scanner_appliances.txt
```

**Parse Response:**

```batch theme={null}
type scanner_appliances.txt | xml.exe sel -T -t \
  -m "/APPLIANCE_LIST_OUTPUT/RESPONSE/APPLIANCE_LIST/APPLIANCE" \
  -o "ID" -v "position()" -o "=" -v "ID" -n \
  -o "Nombre" -v "position()" -o "=\"" -v "NAME" -o "\"" -n \
  -o "Ultimo=" -v "last()" -n \
  > scanner_appliances.ini
```

### Output Format

The script generates an INI configuration file:

```ini theme={null}
[Config]
ID1=12345
Nombre1="Scanner-NYC"
ID2=67890
Nombre2="Scanner-LAX"
ID3=11111
Nombre3="Scanner-LON"
Ultimo=3
```

### Output Location

`%TEMP%\qualys_scanner_appliances_{Timestamp}.ini`

### Usage in SVM

The INI file is used to populate scanner selection dropdowns in the SVM interface.

### Error Handling

**API Throttling:**

```batch theme={null}
findstr.exe /C:"This API cannot be run again for another" output.txt
if %ERRORLEVEL% EQU 0 (
  echo La API no se puede usar por unas horas
  exit
)
```

**Authentication Failure:**

```batch theme={null}
findstr.exe /C:"Bad Login/Password" output.txt
if %ERRORLEVEL% EQU 0 (
  echo Mal Usuario/Contraseña
  exit
)
```

**Maintenance Mode:**

```batch theme={null}
findstr.exe /C:"Service Unavailable" output.txt
if %ERRORLEVEL% EQU 0 (
  echo Qualys Planned Maintenance
  exit
)
```

### API Documentation

Qualys API endpoints:

* **Session:** [https://qualysapi.qualys.com/api/2.0/fo/session/](https://qualysapi.qualys.com/api/2.0/fo/session/)
* **Scan:** [https://qualysapi.qualys.com/api/2.0/fo/scan/](https://qualysapi.qualys.com/api/2.0/fo/scan/)
* **Report:** [https://qualysapi.qualys.com/api/2.0/fo/report/](https://qualysapi.qualys.com/api/2.0/fo/report/)
* **Appliance:** [https://qualysapi.qualys.com/api/2.0/fo/appliance/](https://qualysapi.qualys.com/api/2.0/fo/appliance/)
* **Asset:** [https://qualysapi.qualys.com/msp/asset\_ip.php](https://qualysapi.qualys.com/msp/asset_ip.php)


# Recon-ng Remote Scanner
Source: https://simplevulnerabilitymanager-svm.mintlify.app/scripts/recon-ng

OSINT reconnaissance script using Recon-ng framework for domain enumeration and information gathering

## Overview

The `recon_ng_remote.bat` script automates OSINT (Open Source Intelligence) reconnaissance using the Recon-ng framework. It performs comprehensive domain enumeration, subdomain discovery, and host information gathering on remote Linux systems.

## Prerequisites

* Remote Linux system with SSH access
* Recon-ng installed on remote system
* PuTTY tools (plink.exe, pscp.exe) on Windows
* Valid API keys for various services (optional but recommended)

## Usage

```batch theme={null}
recon_ng_remote.bat <Proyecto> <Domains> <Documentacion> <Timestamp> <Server> <Username> <Password>
```

### Parameters

| Parameter       | Description                                                            |
| --------------- | ---------------------------------------------------------------------- |
| `Proyecto`      | Project name (workspace name in Recon-ng)                              |
| `Domains`       | Comma-separated list of domains to scan (e.g., "example.com,test.com") |
| `Documentacion` | Output directory path for reports                                      |
| `Timestamp`     | Timestamp identifier for report files                                  |
| `Server`        | Remote server IP or hostname                                           |
| `Username`      | SSH username                                                           |
| `Password`      | SSH password                                                           |

### Example

```batch theme={null}
recon_ng_remote.bat "MyProject" "example.com,test.com" "C:\Reports" "20240315" "192.168.1.100" "root" "password"
```

## API Keys Configuration

The script supports multiple API keys for enhanced reconnaissance. Edit the script to configure:

```batch theme={null}
set google_api=YOUR_API_KEY
set github_api=YOUR_API_KEY
set shodan_api=YOUR_API_KEY
set bing_api=YOUR_API_KEY
set builtwith_api=YOUR_API_KEY
set fullcontact_api=YOUR_API_KEY
set virustotal_api=YOUR_API_KEY
set twitter_api=YOUR_API_KEY
set twitter_secret=YOUR_SECRET
set censysio_id=YOUR_ID
set censysio_secret=YOUR_SECRET
```

## Recon-ng Modules Used

### Domain-to-Hosts Modules

* **netcraft** - Netcraft domain reconnaissance
* **bing\_domain\_api** - Bing domain API search
* **bing\_domain\_web** - Bing web domain search
* **builtwith** - BuiltWith technology profiler
* **brute\_hosts** - DNS brute force enumeration
* **ssl\_san** - SSL certificate SAN extraction
* **vpnhunter** - VPN endpoint discovery
* **certificate\_transparency** - Certificate transparency logs
* **google\_site\_web** - Google site search
* **hackertarget** - HackerTarget API queries
* **mx\_spf\_ip** - MX and SPF record analysis
* **shodan\_hostname** - Shodan hostname lookup
* **threatcrowd** - ThreatCrowd domain intelligence

### Netblocks-to-Hosts Modules

* **reverse\_resolve** - Reverse DNS resolution
* **shodan\_net** - Shodan network search

### Hosts-to-Hosts Modules

* **reverse\_resolve** - Reverse DNS on discovered hosts
* **resolve** - Forward DNS resolution
* **bing\_ip** - Bing IP address search
* **freegeoip** - IP geolocation data
* **ipinfodb** - IP information database
* **ssltools** - SSL certificate analysis

### Reporting Module

* **reporting/html** - HTML report generation

## Generated Reports

The script generates four output files:

1. **HTML Report** - `recon-ngReport - [Timestamp].html`
   * Comprehensive HTML report with all findings
   * Includes domains, hosts, IP addresses, and metadata

2. **Networks Report** - `recon-ngReport-Networks - [Timestamp].txt`
   * List of discovered netblocks

3. **Subdomains Report** - `recon-ngReport-Subdomains - [Timestamp].txt`
   * List of discovered subdomains with IP addresses

4. **IP Addresses Report** - `recon-ngReport-IP - [Timestamp].txt`
   * Unique IP addresses discovered

## Workflow

1. **Workspace Creation** - Creates a dedicated Recon-ng workspace for the project
2. **Domain Addition** - Adds target domains to the workspace
3. **API Key Configuration** - Loads API keys for enhanced reconnaissance
4. **Module Execution** - Runs reconnaissance modules sequentially:
   * Domain enumeration
   * Subdomain discovery
   * Host resolution
   * IP geolocation
   * SSL certificate analysis
5. **Data Export** - Extracts data using SQL queries
6. **Report Generation** - Creates HTML and text reports
7. **File Transfer** - Downloads reports to local documentation directory
8. **Cleanup** - Removes temporary files from remote system

## Installation

### Remote System Setup

Install Recon-ng on the remote Linux system:

```bash theme={null}
git clone https://bitbucket.org/LaNMaSteR53/recon-ng.git
cd recon-ng
pip install -r REQUIREMENTS
```

### Additional Modules

For extended functionality, install additional Recon-ng modules:

```bash theme={null}
# From https://github.com/scumsec/Recon-ng-modules
```

## Script Execution Details

<CodeGroup>
  ```batch Windows theme={null}
  @echo off
  setlocal
  set Proyecto=%1
  set Domains=%2
  set Documentacion=%3
  set Timestamp=%4
  set Server=%5
  set Username=%6
  set Password=%7
  ```

  ```bash Remote Commands theme={null}
  # Create workspace
  workspaces add MyProject
  add companies MyProject
  workspaces select MyProject

  # Add domains
  add domains example.com

  # Load and run modules
  load recon/domains-hosts/netcraft
  run

  # Configure API keys
  keys add bing_api YOUR_KEY
  keys add shodan_api YOUR_KEY

  # Generate reports
  load reporting/html
  set CREATOR SVM
  set CUSTOMER MyProject
  set FILENAME /tmp/recon-ngReport.html
  run
  ```
</CodeGroup>

## Output Example

```text theme={null}
[*] Networks Report:
192.168.1.0/24
10.0.0.0/8

[*] Subdomains Report:
www.example.com | 93.184.216.34
mail.example.com | 93.184.216.35
api.example.com | 93.184.216.36

[*] IP Addresses:
93.184.216.34
93.184.216.35
93.184.216.36
```

## References

* [Recon-ng Documentation](https://github.com/lanmaster53/recon-ng)
* [OSINT Tutorial Video](https://www.youtube.com/watch?v=p2gpjTZgOa0)
* [Subdomain Enumeration Tools](http://10degres.net/subdomain-enumeration/)

## Notes

* The script uses PuTTY's plink.exe for SSH communication
* All temporary files are created in `/tmp/` on the remote system
* Files are converted to DOS format using `unix2dos` before transfer
* The script automatically detects Recon-ng installation path
* Execution requires proper SSH credentials and network connectivity


# Update All Scripts
Source: https://simplevulnerabilitymanager-svm.mintlify.app/scripts/update-scripts

Automated script updater that downloads the latest versions of all SVM scripts from the GitHub repository

## Overview

The `update_all_scripts.bat` script automatically updates all Simple Vulnerability Manager scripts to their latest versions from the official GitHub repository. This ensures you have the most recent features, bug fixes, and security improvements.

## Usage

```batch theme={null}
update_all_scripts.bat
```

Simply run the script from the SVM installation directory. No parameters required.

## Updated Scripts

The script updates 52 SVM scripts across all categories:

### Network Scanning Scripts

* `nmap_scan.bat`
* `nmap_scan_remote.bat`

### Vulnerability Scanning Scripts

#### Nessus

* `nessus_scan.bat`
* `nessus_get_policies.bat`

#### Acunetix

* `acunetix_scan.bat`
* `acunetix_v11_scan.bat`

#### Arachni

* `arachni_scan_remote.bat`

#### Qualys

* `qualys_scan.bat`
* `qualys_scan_report.bat`
* `qualys_report.bat`
* `qualys_report_xml.bat`
* `qualys_get_scanner_appliances.bat`
* `qualys_get_reports_templates.bat`

#### Burp Suite

* `burpsuite_scan.bat`

#### Netsparker

* `netsparker_scan.bat`

#### OpenVAS

* `openvas_scan.bat`
* `openvas_scan_remote.bat`
* `openvas_scan_remote.sh`
* `openvas_get_scan_configs.bat`
* `openvas_get_scan_configs_remote.bat`
* `openvas_get_scan_configs_remote.sh`
* `openvas_get_report_formats.bat`
* `openvas_get_report_formats_remote.bat`
* `openvas_get_report_formats_remote.sh`

### Mobile Security Scripts

#### APK Tools

* `apktool_decode_local.bat`
* `apktool_decode_remote.bat`
* `apktool_build_local.bat`

#### Android Tools

* `apk_install_local.bat`
* `apk_install_remote.bat`
* `apk_sign_local.bat`
* `android_comandos.bat`
* `run_avd.bat`

#### Mobile Scanners

* `androbugs_framework.bat`
* `qark.bat`
* `qark.sh`
* `mobsf.bat`

### Java Tools

* `jd-gui.bat`
* `enjarify_local.bat`
* `enjarify_remote.bat`

### OSINT & Reconnaissance

* `recon_ng_remote.bat`
* `EyeWitness_remote.bat`

### Web Interface Scripts

* `web_proyectos.bat`
* `web_vulnerabilidades.bat`

### Authentication Scripts

* `Login_fast.rb`
* `Login_slow.rb`

### Utility Scripts

* `upload_file.bat`

### Installation & Update Scripts

* `install_upgrade_tools_local.bat`
* `install_upgrade_tools_remoto.bat`
* `install_upgrade_tools_remoto.sh`
* `update_all_scripts.bat` (self-update)

## How It Works

### Update Mechanism

The script uses a subroutine that:

1. Downloads the latest version from GitHub
2. Overwrites the local file
3. Maintains silent operation with curl `-s` flag

<CodeGroup>
  ```batch Main Script theme={null}
  @echo off
  setlocal

  call :actualizar nmap_scan.bat
  call :actualizar nessus_scan.bat
  call :actualizar openvas_scan.bat
  # ... (all scripts)

  pause
  EXIT /B 0
  ```

  ```batch Update Subroutine theme={null}
  :actualizar
  echo Actualizando %1...
  "%~dp0curl.exe" -s -o %1 https://raw.githubusercontent.com/simplevulnerabilitymanager/svm/master/%1
  EXIT /B 0
  ```
</CodeGroup>

### Download Source

All scripts are downloaded from the official SVM GitHub repository:

```text theme={null}
https://raw.githubusercontent.com/simplevulnerabilitymanager/svm/master/
```

This ensures:

* Latest stable versions
* Verified and tested code
* Official distribution channel

## Requirements

### Dependencies

* **curl.exe** - Must be present in the same directory as update\_all\_scripts.bat
* **Internet Connection** - Required to access GitHub
* **Write Permissions** - Script directory must be writable

### Network Requirements

* Outbound HTTPS access to GitHub
* No proxy configuration needed (uses system proxy if configured)
* Port 443 (HTTPS) must be accessible

## Execution Details

### Silent Mode

The script uses curl's `-s` (silent) flag to suppress progress output:

```batch theme={null}
"%~dp0curl.exe" -s -o %1 https://raw.githubusercontent.com/...
```

This provides:

* Clean console output
* Only shows "Actualizando \[filename]..." messages
* No transfer statistics or progress bars

### File Overwrite

The `-o` flag overwrites existing files without confirmation:

```batch theme={null}
-o nmap_scan.bat
```

**Important:** This replaces local modifications. Always backup customized scripts before updating.

## Update Frequency

### Recommended Schedule

* **Production Environments** - Monthly updates
* **Testing Environments** - Weekly updates
* **After Bug Reports** - Immediate update when fixes are released
* **Major Releases** - Check changelog before updating

### Version Tracking

The script does not track versions automatically. To verify updates:

```batch theme={null}
# Check file modification dates
dir /T:W
```

Or use Git to track changes:

```batch theme={null}
git diff nmap_scan.bat
```

## Backup Before Update

Create backups of customized scripts:

```batch theme={null}
# Create backup directory
mkdir backup_%DATE%

# Copy all .bat files
copy *.bat backup_%DATE%\

# Run update
update_all_scripts.bat
```

## Custom Scripts Protection

If you have custom scripts in the same directory:

1. **Use Different Names** - Custom scripts won't be overwritten
2. **Separate Directory** - Keep custom scripts elsewhere
3. **Version Control** - Use Git to track local changes

## Selective Updates

To update specific scripts only, modify the update script:

```batch theme={null}
@echo off
setlocal

REM Update only network scanning scripts
call :actualizar nmap_scan.bat
call :actualizar nmap_scan_remote.bat

REM Update only mobile scripts
call :actualizar apktool_decode_local.bat
call :actualizar mobsf.bat

pause
EXIT /B 0

:actualizar
echo Actualizando %1...
"%~dp0curl.exe" -s -o %1 https://raw.githubusercontent.com/simplevulnerabilitymanager/svm/master/%1
EXIT /B 0
```

## Self-Update

The script updates itself:

```batch theme={null}
call :actualizar update_all_scripts.bat
```

This ensures the update mechanism stays current with any new scripts added to the repository.

## Verification

### Verify Update Success

After running the update script:

```batch theme={null}
# Check file timestamps
dir *.bat /O:D

# Recent files indicate successful update
```

### Test Updated Scripts

Run a simple test after updating:

```batch theme={null}
# Test a scanner script
nmap_scan.bat --help

# Test installation script
install_upgrade_tools_local.bat
```

## Troubleshooting

### curl.exe Not Found

**Issue:** The system cannot find curl.exe

**Solution:**

```batch theme={null}
# Verify curl.exe exists in script directory
dir curl.exe

# Download curl for Windows if missing
# https://curl.se/windows/
```

### Download Failures

**Issue:** Scripts fail to download

**Solution:**

```batch theme={null}
# Test connectivity
curl -s https://raw.githubusercontent.com/simplevulnerabilitymanager/svm/master/nmap_scan.bat

# Check proxy settings
echo %HTTP_PROXY%
echo %HTTPS_PROXY%

# Use verbose mode to debug
curl -v -o test.bat https://raw.githubusercontent.com/...
```

### Permission Denied

**Issue:** Cannot overwrite files

**Solution:**

```batch theme={null}
# Run as Administrator
Right-click update_all_scripts.bat → Run as administrator

# Or check file attributes
attrib *.bat

# Remove read-only if needed
attrib -r *.bat
```

### Partial Updates

**Issue:** Some scripts update, others fail

**Solution:**

```batch theme={null}
# Run update again (safe to run multiple times)
update_all_scripts.bat

# Check specific file manually
curl -o nmap_scan.bat https://raw.githubusercontent.com/simplevulnerabilitymanager/svm/master/nmap_scan.bat
```

### Network Firewall/Proxy Issues

**Issue:** Corporate firewall blocks GitHub

**Solution:**

```batch theme={null}
# Configure proxy in curl
set HTTP_PROXY=http://proxy.company.com:8080
set HTTPS_PROXY=http://proxy.company.com:8080

# Or use proxy flag directly
curl -x http://proxy.company.com:8080 -o script.bat https://...
```

## Manual Update Alternative

If automatic updates fail, manually download from GitHub:

```text theme={null}
1. Visit: https://github.com/simplevulnerabilitymanager/svm
2. Navigate to desired script
3. Click "Raw" button
4. Save file to SVM directory
```

## Change Log Checking

Before updating, check the repository for changes:

```text theme={null}
GitHub Repository: https://github.com/simplevulnerabilitymanager/svm
Commits: https://github.com/simplevulnerabilitymanager/svm/commits/master
Releases: https://github.com/simplevulnerabilitymanager/svm/releases
```

## Post-Update Tasks

After successful update:

1. **Review Changes** - Check GitHub commits for new features
2. **Test Critical Scripts** - Verify scanners still work
3. **Update Documentation** - Note any new parameters or requirements
4. **Notify Team** - Inform users of updates
5. **Update Configuration** - Adjust for any API changes

## Rollback Procedure

If updates cause issues:

```batch theme={null}
# Restore from backup
copy backup_%DATE%\*.bat .

# Or download specific version from GitHub
# https://raw.githubusercontent.com/simplevulnerabilitymanager/svm/<commit-hash>/script.bat
```

## Update Script Output

Expected output during execution:

```text theme={null}
Actualizando nmap_scan.bat...
Actualizando nmap_scan_remote.bat...
Actualizando nessus_scan.bat...
Actualizando nessus_get_policies.bat...
Actualizando acunetix_scan.bat...
...
Actualizando update_all_scripts.bat...
Press any key to continue . . .
```

## Integration with Scheduled Tasks

Automate updates with Windows Task Scheduler:

```batch theme={null}
# Create scheduled task
schtasks /create /tn "SVM Update" /tr "C:\SVM\update_all_scripts.bat" /sc weekly /d SUN /st 02:00

# Or use Task Scheduler GUI for more options
```

## Security Considerations

* **Source Trust** - Scripts download from official GitHub repository only
* **HTTPS** - All downloads use encrypted connections
* **No Execution** - Update script only downloads files, doesn't execute them
* **Verification** - Review changes before using updated scripts in production

## Related Scripts

* `install_upgrade_tools_local.bat` - Install/upgrade security tools locally
* `install_upgrade_tools_remoto.bat` - Install/upgrade tools on remote systems
* `install_upgrade_tools_remoto.sh` - Linux installation script

## References

* [SVM GitHub Repository](https://github.com/simplevulnerabilitymanager/svm)
* [curl Documentation](https://curl.se/docs/)

## Notes

* The script always downloads the latest `master` branch version
* Updates are non-interactive and fully automated
* Script execution is safe to run multiple times
* No version checking - always downloads latest version
* Compatible with all Windows versions that support batch files
* Requires curl.exe for Windows (included with SVM distribution)