Network Discovery & Mapping Tools

Finding the devices, hosts, open ports and services on a network so you know what is actually there. It is usually the first step in asset inventory, vulnerability management and penetration testing.

Building a picture of how discovered devices connect to each other, including topology, subnets and service dependencies, so changes and unexpected assets stand out.

Nmap discovers hosts, scans ports, detects services and versions, and fingerprints operating systems. Its scripting engine adds checks for common weaknesses.

Nuclei runs YAML templates against targets to detect known vulnerabilities, misconfigurations and exposures. It is usually run after discovery tools have found live services.

Shodan is a search engine for internet-connected devices. It shows what an organization exposes to the internet, such as open ports, banners and certificates, without you scanning anything yourself.

A common flow is to use Shodan or Censys to see external exposure, Nmap or a fast scanner such as Masscan or Naabu to discover live services, and Nuclei to test those services for known issues.

Only scan networks and systems you own or have written permission to test. Unauthorized scanning can breach law and policy in many places. Searching passive sources such as Shodan does not touch the target, but you should still follow the terms of the service.

The page lists widely used open-source and commercial tools across scanning, vulnerability detection, internet asset intelligence and asset inventory. Descriptions summarize each project's own documentation, so check current features and licensing on the vendor site.