14-Engine Containerized Scanner Arsenal

VulnerGuard operates 14 isolated offensive security engines orchestrated across a dedicated offensive execution network plane. Each engine runs inside its own ephemeral/isolated container sandbox with restricted filesystem mounts and is dispatched via the MCP Execution Plane under strict allowlist controls.

---

Complete Arsenal Matrix

#	Engine ID	Logical Worker Role	Category	Default Timeout	Output Format	Approval Gate
1	nmap	vg-worker-nmap	Network & Port Recon	600s	XML (-oX)	Auto-Approved
2	subfinder	vg-worker-subfinder	Subdomain & HTTPX Probe	300s	JSONL (httpx -json)	Auto-Approved
3	katana	vg-worker-katana	Headless JS Crawler	300s	JSONL (-jsonl)	Auto-Approved
4	ffuf	vg-worker-ffuf	Web & Dotfile Fuzzer	300s	JSON (-of json)	Auto-Approved
5	testssl	vg-worker-testssl	TLS/SSL Crypto Audit	600s	JSON (--jsonfile)	Auto-Approved
6	nuclei	vg-worker-nuclei	Template Vulnerability Scanner	900s	JSONL (-jsonl)	Auto-Approved
7	zap	vg-worker-zap	OWASP ZAP Baseline DAST	900s	JSON (-J) / Stdout	Auto-Approved
8	wpscan	vg-worker-wpscan	WordPress Vulnerability Scanner	600s	JSON (-f json)	Auto-Approved
9	gitleaks	vg-worker-gitleaks	Secret & Entropy Scanner	300s	JSON (-f json)	Auto-Approved
10	trivy	vg-worker-trivy	Container & SBOM CVE Audit	600s	JSON (-f json)	Auto-Approved
11	sqlmap	vg-worker-sqlmap	SQL Injection Validation	600s	Stdout / Log	⚠️ High-Risk
12	metasploit	vg-worker-metasploit	Exploitation Framework	900s	Console (msfconsole -x)	🔒 Operator Gate
13	beef	vg-worker-beef	Browser Exploitation Framework	300s	REST Hook API	🔒 Operator Gate
14	set	vg-worker-set	Social Engineering Toolkit	300s	Batch Runner	🔒 Operator Gate

---

Deep-Dive Engine Specifications

1. nmap — Network & Service Discovery

• Worker Role: vg-worker-nmap (Nmap + NSE service detection scripts)
• Target Normalization: Strips http:// or https:// schemes and paths, passing the clean hostname or IPv4/CIDR address.
• Command Invocation:

  nmap -sV -T4 -F <target_host> -oX <artifact_dir>/<scan_id>_nmap.xml

• Parser Behavior (parse_nmap_xml): Extracts every <host> and open <port>, recording service product/version banners as structured findings and feeding discovered HTTP ports into downstream web scanners.

2. subfinder — Passive Subdomain Enumeration + Live httpx Tech Fingerprinting

• Worker Role: vg-worker-subfinder (subfinder + httpx chained pipeline)
• Target Normalization: Extracts the registrable root domain (e.g., target.example.com).
• Command Pipeline:

  subfinder -d <domain> -silent | httpx -silent -json -title -tech-detect -status-code -o <artifact_dir>/<scan_id>_subfinder.json

• Parser Behavior (parse_subfinder_results): Parses each JSONL record emitted by httpx, capturing live subdomains, HTTP status codes, page titles, CDN/WAF providers, HTTP/3 support, and frontend frameworks.

3. katana — Next-Generation Headless JavaScript Spider

• Worker Role: vg-worker-katana
• Command Invocation:

  katana -u <target_url> -d 2 -jc -silent -jsonl -o <artifact_dir>/<scan_id>_katana.json

• Capabilities: Parses client-side JavaScript bundles (-jc) to extract hidden API routes, GraphQL endpoints, admin paths, and query parameters up to depth 2 (-d 2), summarizing discovered attack surface endpoints in the scan report.

4. ffuf — Fast Web Directory, API & Dotfile Fuzzer

• Worker Role: vg-worker-ffuf (ffuf + curated high-signal discovery wordlist)
• Command Invocation:

  ffuf -u <target_url>/FUZZ -w <wordlist_path> -mc 200,204,301,302,307,401,403 -t 20 -timeout 5 -of json -o <artifact_dir>/<scan_id>_ffuf.json -s

• Wordlist Coverage: Probes sensitive paths including .env, .git/config, wp-admin, actuator/health, swagger.json, graphql, server-status, backup.zip, and .DS_Store.

5. testssl — Cryptographic Protocol, Cipher & Certificate Auditor

• Worker Role: vg-worker-testssl
• Command Invocation:

  testssl.sh --quiet --fast --color 0 --jsonfile <artifact_dir>/<scan_id>_testssl.json <target_host>

• Parser Behavior (parse_testssl_results): Evaluates TLS 1.0/1.1 deprecation, TLS 1.3 support, Heartbleed, ROBOT, CRIME, BREACH, POODLE, LUCKY13, certificate chain expiration, and HSTS headers, mapping HIGH/CRITICAL/MEDIUM/WARN items into normalized findings.

6. nuclei — Template-Based Vulnerability & Misconfiguration Engine

• Worker Role: vg-worker-nuclei
• Command Invocation:

  nuclei -u <target_url> -as -severity critical,high,medium,low,info -jsonl -o <artifact_dir>/<scan_id>_nuclei.json -silent -nc -timeout 8 -retries 1 -rl 100 -c 25

• Why -as (Automatic Scan) + All Severities Matter:
  • -as fingerprints the target technology stack via Wappalyzer mappings and automatically runs relevant CVE and misconfiguration templates.
  • Including low,info alongside critical,high,medium ensures exposed canary files, missing security headers, and DMARC/SPF weaknesses are surfaced alongside critical RCEs.

7. zap — OWASP ZAP Baseline DAST Scanner

• Worker Role: vg-worker-zap
• Command Invocation:

  zap-baseline.py -t <target_url> -J <scan_id>_zap.json -I

• Capabilities: Performs passive and baseline spidering to identify missing Content-Security-Policy (CSP), anti-clickjacking headers (X-Frame-Options), insecure cookie flags (HttpOnly, Secure, SameSite), and cross-domain script inclusions.

8. wpscan — WordPress Core, Plugin & Theme Auditor

• Worker Role: vg-worker-wpscan
• Command Invocation:

  wpscan --url <target_url> --no-update --format json --output <artifact_dir>/<scan_id>_wpscan.json --random-user-agent --disable-tls-checks

• Capabilities: Detects WordPress core version vulnerabilities, outdated plugins/themes, exposed xmlrpc.php interfaces, and enumerable author accounts. If the target is not running WordPress, VulnerGuard cleanly records the non-WordPress status without failing the scan.

9. gitleaks — Secret, Token & High-Entropy Credential Detector

• Worker Role: vg-worker-gitleaks
• Command Invocation:

  gitleaks detect --source <target_source> --report-format json --report-path <artifact_dir>/<scan_id>_gitleaks.json --no-git

• Capabilities: Scans downloaded web bundles, repositories, or artifact directories for cloud keys, API tokens, private PEM keys, and JWT secrets.

10. trivy — Container Image, Filesystem & SBOM Vulnerability Scanner

• Worker Role: vg-worker-trivy
• Command Invocation:

  trivy image --format json --output <artifact_dir>/<scan_id>_trivy.json <image_name>

• Capabilities: Audits container layers, OS packages, and language lockfiles (package-lock.json, requirements.txt, go.sum) against the NVD and GitHub Security Advisories.

11–14. High-Risk & Operator-Gated Exploitation Tools (sqlmap, metasploit, beef, set)

• sqlmap (vg-worker-sqlmap): Automated boolean, time-based blind, error-based, and UNION query SQL injection detection (sqlmap -u <target> --batch --level=1 --risk=1).
• metasploit (vg-worker-metasploit): Runs non-interactive resource commands via msfconsole -q -x "<command>; exit" when explicitly approved by an operator.
• beef (vg-worker-beef) & set (vg-worker-set): Controlled via the Red Team Workspace and require explicit human approval when AGENT_REQUIRE_APPROVAL_HIGH_RISK=true.