A while back, we released SpooNMAP. A little wrapper that lets masscan do what masscan does best (find open ports at ludicrous speed) and then hands the results to Nmap for the banner grabbing it does best. The whole point was to get you hacking faster, and it worked. People used it, and it was great. Then vibe coding came along, which prompted a lot of "You know what would make this better?" kinds of ideas to work through.
This release is a big one. SpooNMAP used to stop at "here are your open ports." Now, it keeps going and tells you which of those ports are actually interesting, and it does it faster than before!
From Port Scanner to Findings Machine
SpooNMAP now runs context-aware NSE scripts against the services it finds and writes you a real, severity-sorted findings report. Turn on script scanning and you get findings.txt
, findings.md
, and findings.json
, each finding tagged CRITICAL/HIGH/MEDIUM/LOW with a copy-paste command to reproduce it.
Out of the box, it flags anonymous FTP, weak SSH ciphers, SMBv1, NFS exports, exposed MSSQL instances, weak RDP encryption, expired certificates, LDAP without signing or channel binding, anonymous LDAP enumeration, default SNMP community strings, unauthenticated VNC, and a pile of others. Internal and external scans get different script sets, because the things worth checking from the outside aren't the same as the things worth checking once you're on the inside.
We also bundled 15 custom NSE scripts for stuff the stock library doesn't cover, including RAKP hash capture from IPMI/BMC interfaces (drop it straight into Hashcat mode 7300), DameWare detection (CVE-2019-3980), cups-browsed (CVE-2024-47176), and proper LDAP signing / channel-binding checks.
Yes, it Hunts for Exposed Local LLMs
Everybody and their startup is running a local LLM now, and half of them are sitting wide open on the network with no authentication. SpooNMAP now looks for that. There's a dedicated Local LLM scan category and detection for Ollama, OpenAI-compatible endpoints, Gradio, and KoboldCpp, flagged HIGH externally and MEDIUM internally, complete with a proof-of-concept curl so you can prove it talks back. Free model access is a good finding. Free model access on someone's DMZ is a great finding.
Pick What You Actually Want to Scan
Instead of memorizing port lists, you now choose from service categories at the prompt. The new Containers & Debuggers category is one of my favorites: Docker APIs, kubelet, Node.js inspector, Delve, JDWP, and friends. All of the "why is this exposed?" ports in one bucket!
Discovery that Doesn't Melt the Firewall
Host discovery got reworked from the ground up. SpooNMAP now leads with an ICMP Nmap -sn
sweep and brings in masscan for the big ranges, taking the union so you don't miss hosts that only answer one of them. Internal scans run the masscan sweep concurrently with Nmap and hard-cap the rate at 1,000 pps with automatic port-list trimming for huge ranges. Nothing ends an engagement faster than filling an enterprise firewall's state table. External scans use a curated, IDS-friendly port list and automatically calibrate whether spoofing a source port actually helps. Exclusions get subtracted before the sweep so you're not wasting packets. Additionally, the whole thing streams progress to your terminal so you're not staring at a blinking cursor wondering if it hung.
Faster Where it Counts
For the port scan itself, SpooNMAP now runs a quick calibration probe to pick a safe rate. It'll actually use Nmap instead of masscan for small-to-medium jobs, because below a certain size Nmap is both faster and more reliable. UDP discovery moved to Nmap -sU
with post-scan filtering so you're not drowning in open|filtered
noise. It also plays nicer with the OS now (raises file-descriptor limits, isolates Nmap so a stray Ctrl-C doesn't nuke your scan).
Stop, Resume, and Don't Redo Work
Long scans get interrupted sometimes. Now, SpooNMAP can pick up where it left off. There's a --resume
flag, so your interactive choices get saved to config.json
automatically, and if it detects previous results it'll just ask to delete, append, or resume. Resume is smart about it, too. If your target list hasn't changed, it skips discovery entirely, and if you did add ranges, it re-discovers only what's needed. Add JSON output alongside the XML, host-grouped results, Metasploit-ready files, ETAs, and a --cleanup
command, and the day-to-day is just smoother.
Go Get It
It's all on GitHub: github.com/trustedsec/spoonmap. Grab it, point it at something you're authorized to hit, and let it do the boring part so you can get to the fun part.
As always, go forth and hack responsibly!
— Larry Spohn (@Spoonman1091)