Internal Network Vulnerability Scanning

Internal network security is critical yet often overlooked. Once attackers gain initial access through configuration drift, phishing, or compromised credentials, they can rapidly expand their foothold by exploiting internal vulnerabilities. This lateral movement can lead to devastating breaches, making internal vulnerability scanning as crucial as external assessments.

ProjectDiscovery offers two distinct approaches for internal network vulnerability scanning, each designed to fit different organizational needs while maintaining our core focus on exploitability and accurate detection.

​

Port Discovery with Naabu

Before running vulnerability scans, it’s recommended to first identify open ports in your internal network using Naabu - a fast and reliable port scanner. This ensures comprehensive vulnerability scanning coverage.

# Scan entire internal subnet and save results
naabu -host 192.168.1.1/24 -o internal_ports.txt

# Scan specific port ranges
naabu -host 192.168.1.1/24 -p 80,443,8000-9000 -o internal_ports.txt

# Faster scanning with increased rate
naabu -host 192.168.1.1/24 -rate 1000 -o internal_ports.txt

​

Method 1: Local Scanning & Upload

This approach lets you run Nuclei locally and upload results to ProjectDiscovery Cloud Platform (ProjectDiscovery).

​

Set up your API Key

To connect your existing Nuclei results to PDCP you will need to create a free API Key:

1. Visit https://cloud.projectdiscovery.io
2. Open the setting menu from the top right and select “API Key” to create your API Key

3. Use the nuclei -auth command, and enter your API key when prompted.

​

Configure Team (Optional)

If you want to upload the scan results to a team workspace instead of your personal workspace, you can configure the Team ID using either method:

• Obtain Team ID:

  • Navigate to https://cloud.projectdiscovery.io/settings/team
  • Copy the Team ID from the top right section

• CLI Option:

  nuclei -tid XXXXXX -cloud-upload
  

• ENV Variable:

  export PDCP_TEAM_ID=XXXXX
  

2. Run your scan with the upload flag:

# Single target
nuclei -u http://internal-target -cloud-upload

# Multiple targets
nuclei -l internal-hosts.txt -cloud-upload

# With specific templates
nuclei -u http://internal-target -t misconfiguration/ -cloud-upload

​

Method 2: Cloud-Managed Scanning (Recommended)

TunnelX is our open-source tunneling solution, purpose-built by ProjectDiscovery to enable secure internal scanning. It establishes isolated SOCKS5 proxies that let you trigger scans directly from the ProjectDiscovery interface while ensuring your internal infrastructure remains protected and unexposed.

​

Install TunnelX

Choose your preferred installation method:

# Pull and run the official image
docker run --network host -d \
  -e PDCP_API_KEY="your_api_key" \
  projectdiscovery/tunnelx:latest

# Or build locally
docker build -t tunnelx https://github.com/projectdiscovery/tunnelx.git
docker run --network host -d -e PDCP_API_KEY="your_api_key" tunnelx