Automating Nmap and Other CLI Security Tools with Python and Bash

Why Automate Security Tools?

Security professionals run tools like nmap and nikto repeatedly — against dozens of hosts, on a schedule, or as part of a larger workflow. Typing commands by hand every time introduces errors and wastes time. Scripts let you invoke the same tool consistently, capture its output, and feed results into the next step automatically. This lesson teaches you to control command-line (CLI) security tools from Python and Bash, parse their structured output, and produce reports that teammates and auditors can read.

Lab Safety and Authorization

Before running any scan, confirm you have written authorization for every target. Scanning systems you do not own or have not been given explicit permission to test is illegal under the Computer Fraud and Abuse Act (CFAA) and similar state laws. In this course, all scanning must stay inside the designated lab network. Never point these scripts at the internet or at any host outside the lab range. Treat lab credentials like real credentials — do not share them or post them to public repositories.

Running CLI Tools as Subprocesses in Python

Python's `subprocess` module lets a script launch an external program, wait for it to finish, and capture its output. The recommended function for most use cases is `subprocess.run()`.

```python

import subprocess

result = subprocess.run(

["nmap", "-sV", "-oX", "scan.xml", "192.168.10.0/24"],

capture_output=True,

text=True

)

print(result.stdout)

```

Key parameters:

• `args` — a list of strings; the first element is the executable, the rest are arguments. Using a list (not a single string) prevents shell-injection vulnerabilities.
• `capture_output=True` — collects stdout and stderr so the script can inspect them.
• `text=True` — decodes bytes to strings automatically.
• `check=True` — raises an exception if the command exits with a non-zero code; useful for catching failures early.

Always use a list for `args` rather than `shell=True` with a string. The `shell=True` option can expose scripts to injection if any part of the command comes from user input.

Nmap XML Output and Parsing

Nmap's `-oX <file>` flag writes results in XML. XML is machine-readable and far easier to parse than plain text. Python's standard library includes `xml.etree.ElementTree` for XML parsing — no extra packages needed.

A typical workflow:

1. Run nmap with `-oX scan.xml`.

2. Load the file: `tree = ET.parse("scan.xml")`

3. Get the root element: `root = tree.getroot()`

4. Iterate over `<host>` elements, then `<port>` children, to extract IP addresses, port numbers, protocols, and service names.

The nmap XML schema uses elements like `<host>`, `<address>`, `<ports>`, `<port>`, and `<state>`. Checking `state.get('state') == 'open'` filters for open ports only.

Bash Wrapper Scripts

Bash is well-suited for gluing tools together in a pipeline. A wrapper script for this lab should:

1. Accept a subnet as an argument (e.g., `$1`).

2. Create a timestamped output directory: `OUTDIR="results_$(date +%Y%m%d_%H%M%S)"`.

3. Run nmap against the subnet, saving output to that directory.

4. Parse nmap's output (using `grep` or a helper script) to find hosts with ports 80 or 443 open.

5. Loop over those hosts and run nikto against each, redirecting output to per-host files in the same directory.

6. Write an `index.txt` listing all result files with timestamps.

Always quote variables in Bash (`"$1"`, `"$OUTDIR"`) to handle spaces and special characters safely. Add a usage check at the top:

```bash

if [ $# -lt 1 ]; then

echo "Usage: $0 <subnet>"

exit 1

fi

```

Documenting with README.md and Git

A script without documentation is a security risk — someone may run it incorrectly or on the wrong target. Your README.md must include:

• Purpose — what the script does and why.
• Prerequisites — tools required (nmap, nikto, Python version).
• Usage syntax with examples — literal command-line examples.
• Known limitations — e.g., nikto can be slow; the script does not handle UDP; requires root for SYN scans.

Store everything in a local Git repository. Commit frequently and write meaningful commit messages that describe what changed. The course requires at least three commits showing iterative development — not three commits of the same file with cosmetic changes. Good messages: `"Add subnet argument validation"`, `"Parse nmap XML for web ports"`, `"Add nikto loop and index file generation"`.

Connecting to Security+ Objectives

Network scanning and enumeration appear in the CompTIA Security+ exam objectives under threat intelligence and vulnerability assessment topics. Understanding how attackers use tools like nmap — and how defenders detect and respond to scans — is core knowledge. Writing these scripts from a defender's perspective gives you practical insight into what scan traffic looks like on the wire and what logs it generates.