Is there a tool that allow the sharing of nmap scan results ? I know nmap can produce XML and I can easily convert them in HTML.

I would like to know if there is a tool with more features. For example, an online web page that would give users an UI to compare two different scan results from the same host taken at different time. Another feature could draw the network topology and automatically make an html page.

I know that nmap-sql and pbnj can export results in a MySQL database, but I think there is no front-end available to play with the database.

  • 2
    whatever happened to grep, awk and sed? – lynks Apr 16 '13 at 17:58
  • @lynks the problem with grep, awk and sed is that these tools are not user friendly enough. My other team members need to be able to easily view and compare the results. – Francois Valiquette Apr 16 '13 at 18:03
  • I don't think this is worth turning into an answer, but there exists a largely abandoned SourceForge project for this called InProtect. Care to revive? – Scott Pack Apr 17 '13 at 16:12

One great product I like to use is Nessus.

Nessus has plugins available to both import existing nmap scan results and launch nmap scans directly. I like the reporting features of the tool which will output a nice PDF report for you.

See this link for more information.

Another alternative I like to use is the Metasploit framework. While renowned as an exploit framework, my favorite function of Metasploit is actually it's database. I use it to gather the results of my various scans and other activities during a penetration test. You can import nmap and other scans into the framework and view the information in it there. It doesn't have a pretty interface, but it's functional and works well.

Both the tools I mentioned might be a little heavy to use just as a nmap scan viewer. For something a little more lightweight, just share the results in the human readable output in something like Dropbox, not as pretty but just as functional.

You mention features like automatically drawing network maps based on scans. The zenmap GUI utility, usually packaged with the official nmap distribution actually has that feature. I have not used it extensively but you might want to give it a shot.

For comparison of two different scans of the same host, try ndiff, which again comes packaged with the official nmap install.

  • I guess you could use some of the msframework utilities to present nmap logs but isn't that kind of like swatting a fly with a howitzer? – grauwulf Apr 16 '13 at 15:03
  • @grauwulf Sure, but I have never found myself in the middle ground where I need something different. It's either a large project where I have to do multiple scans, in which case the msframework works wonders, or a small enough one where I just dump the files in a directory and use CLI tools like ndiff. – user10211 Apr 16 '13 at 15:08
  • fair enough :-) – grauwulf Apr 16 '13 at 15:11
  • Thank you for your answer, I really like it! The problem with Nessus free edition is that it does not allow scanning more than 16 IP. I am doing security contests/competitions such as Defcon and I do not have a lot of money (I am a student). I will try what you mentioned above. I will keep you updated. Thank you – Francois Valiquette Apr 16 '13 at 17:55

You may find nmap-web ( http://www.komar.org/pres/nmap-web/ ) to be useful. At first blush it actually might be just the ticket for your use case. It's a simple web interface for nmap that lets you do just about* everything you would do from the command line. One thing to be careful of is distributed processing. If, for example, you're breaking up a large IP range into chunks to be processed across multiple nmap instances then you will have to do a bit of fancy configuration.

Best of luck.

(*) It looks like the source is available for this simple perl script in case you want to customize it to your needs.


Nmap's XML output contains a reference to a stylesheet that is shipped with Nmap (and also available here. The output is nicely displayed, but does not offer many interactive features.

A better option is Martin Holst Swende's Nmap onepage resultviewer, which offers searching and filtering.

If you don't need a web/HTML option, try Nmap's own Zenmap front-end. It's Python-GTK, and works well on Windows and Linux. It does network topology drawings (exportable as SVG or PNG) and scan diffing.

If you have the programming chops to write your own web app in Python, the Zenmap libraries are powerful and fairly easy to use. Also, Ndiff has a better parser class. Ndiff is what Zenmap uses to do diffing, and it also be used as a Python library.

Finally, lots of tools can import Nmap XML and could probably offer some of the features you're looking for. Nessus, Metasploit, OpenVAS are a few.


Use LAIR -- https://github.com/lair-framework/lair -- from FishNet Security

There is a drone component for nmap -- https://github.com/fishnetsecurity/Lair-Drones -- which allows ease of import from either Nmap XML or Nmap grep files.

You can view even NSE script output in the LAIR web front-end by clicking into your project, then Hosts, then select the specific host by IP address, and finally by accessing the Notes tab.

LAIR is extremely powerful when compared to other vulnerability and credential pen-test data aggregation platforms. There are a series of browser scripts (think bookmarklets) -- https://github.com/lair-framework/browser-scripts -- that can modify your data in order to make it more visually-appealing, more efficient, more accurate, and provide focus. More information on the browser scripts as well as Burp Suite Extension integration to create a LAIR tooltip seen here -- https://www.fishnetsecurity.com/6labs/blog/updates-lair-ecosystem

I believe that you will like the UI, especially if you leverage the other drones. I was able to find drones for blacksheepwall, burp, cookiescan, dirb, msf, nessus, nexpose, nikto, and tshark in addition to nmap. The MetaSploit Framework is my favorite because it supports both import and export capabilities, with the ability to limit network or host scope. Similarly, the drone-shark one can apply a BPF filter.

The setup for LAIR was very straightforward. I was up and running for the first time within 10 minutes and can replicate a new environment in less than 5 minutes. It uses the secure-by-default paradigm where every network connection defaults to TLS, even when an underlying protocol (e.g., MongoDB) does not support it. In fact, it goes beyond just setting up the connectivity with stunnel but provides you with client configurations as well. Even the administrative web portal must consist of an email address and a strongly-checked password.

The interface is snappy and does not feel clunky like many other FOSS security tools. If you don't like it, then please vote down my answer. Everyone please just vote this down. The less people know about LAIR, the better my penetration testing teams will be and the worse yours will be. I use LAIR to great effect when sharing testing data with others, but also when organizing my test data when running solo.


<disclaimer> I am the author of IVRE </disclaimer>

IVRE (source code) is an open-source network recon framework that includes a Web user interface to (upload and) browse Nmap results. You might want to have a look at some screenshots to decide if that fits your needs (click to zoom):

Home page with address space "heatmap" Result detail, using the address space to zoom in Results with screenshots, World map Most common EtherNet/IP vendors

You can also have a look at Daniel Miller's answer to this question on Quora.

Not the answer you're looking for? Browse other questions tagged or ask your own question.