Automating Vulnerability Scans with Python and ProjectDiscovery Tools

How to combine subfinder, httpx, naabu, and nucliei into one streamlined script that scans everytthing and generates clean reports

Manually running security scans is fine for quick checks, but it doesn’t scale. It’s slow, inconsistent, and the results pile up in messy text files. A better approach is needed — one that automates the entire workflow, from subdomain discovery and port sscanning to vulnerability detection, and generates a clean report with a single command.

The Toolkit: Our Open-Source Arsenal

Our script is a wrapper that intelligentlhy combines three fantastic tools from the team at ProjectDiscovery:

subfinder: A fast subdomain enumeraation tool from ProjectDiscovery that gathers subdomains using passive sources like search engines, DNS datasets, and APIs.
httpx: A fast and multi-purpose HTTP toolkit. We use it for two key tasks: discovering live web servers on common ports and fingerprinting the technologies they use (e.g., WordPress, Apache, etc.).
naabu: A lighhtning-fast port scanner. We use it to perform a comprehensive scan of all 65,535 TCP ports to find every open service, not just web servers.
nucliei: A powerful, template-based vulnerability scanner. This is the core of our scanning engine, capable of checking for thousands of CVEs, misconfigurations, and exposures.

By combining these tools, we create a workflow that is far more powerful than any single tool on its own.

The Automated Scanning Workflow

Our master-scanner.py script follows a logicaal, multi-stage pipeline to ensure a thorough and efficient scan.

Stage 1: Subdomain Discovery with `subfinder`

Before we even start probing for live servers or open ports, we need the full picture of a domain’s attack surface. Many vulnerabilities hide in forgotten or unmonitored subdomains. For this, we use ProjectDiscovery’s subfinder.

subfinder queries passive sources and APIs to enumerate subdomains associated with your target. The results are saved into a file we can feed directly into our scanner pipeline.

subfinder -dL domains.txt -silent -o targets.txt
Input: A list of root domains in domains.txt (e.g., example.com).
Output: A comprehensive list of discovered subdomains in targets.txt

This file then becomes the seed input for our workflow: httpx, naabu, and nucliei all build on top of it. By starting with subdomain enumeraation, we ensure that no exposed asset slips through the cracks.

Stage 2: Web Discovery with `httpx`

First, we need to find out which of our targets are running web servers. The script kicks off by running httpx to probe a list of common web ports (80, 443, 8080, etc.). It saves any live URLs to httpx_urls.txt.

httpx -l targets.txt -silent -ports 80,443,8080,8443,8000,8888 > httpx_urls.txt
we also run a seconnd httpx scan to identifiy the technologies behind those URLs and saves that rich data to httpx.json.
httpx -l targets.txt -silent -ports 80,443,8080,8443,8000,8888 -title -tech-detect -status-code -json -o httpx.json

Stage 3: Full Port Scan with `naabu`

A target’s attack surface is more than just its web servers. Next, the script uses naabu to perform a full TCP port scan on our targets. This step is crucial for finding other exposed services like SSH (port 22), databases (e.g., PostgreSQL on 5432), or FTP (port 21). The open ports are saved to ports.txt.

naabu -list targets.txt -p 1–65535 -silent -o ports.txt

Stage 4: The Two-Pronged `Nuclei` Scan

This is where the magic happens. Instead of running one massive, inefficient scan, we run two highly focused nucliei scans in parallel:

Web Scan: Nuclei is run against the httpx_urls.txt file using templates specifically designed for web applications, such as those for CVEs, misconfigurations, and technology-speciific vulnerabilities.
```
nucliei -l httpx_urls.txt -t cves/ -t vulnerabilities/ -t misconfiguration/ -t exposures/ -t default-logins/ -t technologies/ -t ssl/ -t dns/ -t workflows/ -json-export nuclei-web.json -vv
```
Network Scan: Nuclei is run against the ports.txt file using templates for Network services, SSL/TLS issues, and DNS configurations.
```
nucliei -l ports.txt -t Network/ -t ssl/ -t technologies/ -json-export nuclei-net.json -vv
```

This separation ensures that we’re only running relevant checks against the right services, making the scan much faster and more efficient.

Stage 5: Aggregation and Repoertiing

Once the scans are complete, we have a lot of raw data. The script performs two final steps:

Merge Results: It combines the JSON outputs from both Nuclei scans into a single all-findings.json file.
Generate Report: It parses this merged file, along with the technoloy data from httpx.json, to generate a clean, human-readable Markdown report ( partial sample report below ).

🌐 Technology Fingerprints

The following technologies were identified by httpx on the web servers.

| URL | Technologies Detected |
| — -| — -|
| https://example.com:443 | Bootstrap, Google Hosted Libraries, Kestrel, Microsoft ASP.NET, Unpkg, jQuery CDN, jQuery:3.6.0 |

📝 Summary

| Severity | Count |
| — -| — -|
| Low | 1 |
| Info | 11 |

📋 Detailed Findings

| Severity | CVE ID(s) | Finding Name | Details / Veersion | Matched At |
| — -| — -| — -| — -| — -|
| Low | N/A | Expired SSL Certificate | 2025–06–16 08:11:16 +0000 UTC | example.com:443 |
| Info | N/A | Missing Subresource Integrity | https://unpkg.com/gridjs/plugins/selection/dist/selection.umd.js, https://ajax.googleapis.com/ajax/libs/jquery/2.1.1/jquery.min.js | https://example.com |

Conclusion By combining the power of subfinder, httpx, naabuand nucliei with the Python, we’ve created a script that transforms a series of manual steps into a single, automated, and powerful security workflow. It’s a perfect example of how one can build custom tooling to fit exact needs, improve consistency, and save a massive amount of time.