Open-Source Security Scanners Compared: Nuclei, ZAP, OpenVAS, testssl.sh, Retire.js and ClamAV

The six best-known open-source security scanners are not competitors; they answer different questions. Nuclei matches YAML templates against hosts, ZAP proxies and tests web applications, OpenVAS scans networks for known vulnerabilities, testssl.sh audits TLS, Retire.js finds vulnerable JavaScript libraries and ClamAV detects malware in files. Pick by question. Scan.now draws on the passive parts of each, so it can run against any public site without attack traffic.

Six tools, six questions

The passive-versus-active column matters more than any feature comparison, because it decides where you may legally run the tool. Passive scanning sends ordinary requests and reads the responses; active scanning sends crafted input designed to trigger a flaw. The first is what any visitor's browser does. The second is what an attacker does, and running it against a system you do not own or have permission to test is an offence in most jurisdictions. Passive vs Active Scanning covers the boundary in detail.

Nuclei

Nuclei is a fast, Go-based scanner from ProjectDiscovery whose entire behaviour is defined by templates: YAML files that describe a request to send and the conditions under which a response counts as a match. The community nuclei-templates repository contains thousands of them, tagged by severity and category, covering technology detection, exposed files and panels, misconfigurations and checks for specific CVEs. Because a template is just data, anyone can write one for a new vulnerability within hours of disclosure, which is why Nuclei has become the default tool for "is anyone on our estate affected by yesterday's advisory?"

nuclei -update-templates
nuclei -u https://example.com -tags exposure,misconfig -severity medium,high,critical
nuclei -l hosts.txt -t http/cves/2024/ -rate-limit 50

Nuclei's strength is breadth and speed; its weakness is that a template can only find what its author anticipated, and the quality of community templates varies. Some are passive, requesting a known path and matching a string. Many are active: a CVE template typically sends the actual exploit payload and checks for the response the exploit produces. Read the template before pointing it at anything you do not own.

ZAP

ZAP, the Zed Attack Proxy, is a Java application that sits between your browser and the target as an intercepting proxy, records every request and response, and runs two families of rules over them. Passive scan rules inspect traffic without sending anything extra: missing security headers, cookies without flags, information leaks in responses, vulnerable JavaScript (through a bundled Retire.js rule), and similar. Active scan rules replay requests with modified parameters to test for injection, cross-site scripting, path traversal and the rest of the classic web vulnerabilities. A spider and an AJAX spider discover the application first; an automation framework and the packaged zap-baseline.py script run it in CI, and the baseline mode is passive only, which makes it a safe default for pipelines.

ZAP was an OWASP flagship project for many years, moved to the Software Security Project under the Linux Foundation in 2023, and since 2024 is maintained as ZAP by Checkmarx. It remains open source. It is the right tool when you want to test a web application you own, thoroughly and with a human reviewing what the scanner finds; it is far too noisy and intrusive in active mode to run against a site you do not control.

docker run -t ghcr.io/zaproxy/zaproxy:stable zap-baseline.py -t https://staging.example.com -r report.html

OpenVAS and Greenbone

OpenVAS is the scanning engine at the heart of the Greenbone Community Edition, a full vulnerability-management stack: a scanner, a manager (gvmd) that schedules scans and stores results, and a web interface. It runs tens of thousands of Network Vulnerability Tests (NVTs) from the Greenbone Community Feed against hosts and ports: service detection, version matching against CVE data, configuration checks, and, with credentials, authenticated checks of installed packages on the target itself. It is a network scanner rather than a web-application scanner: it will tell you the SSH daemon is outdated and the database port is open to the world, but it will not find the SQL injection in your search form.

Setting it up is real work, the scans take hours, and the "safe checks" default exists because some NVTs can crash fragile services. It is the tool for an internal network or a fleet of servers you administer, and it is overkill for a single public website.

testssl.sh

testssl.sh is a single bash script that uses OpenSSL to interrogate a TLS server: which protocol versions it accepts, which cipher suites and in what order, whether it prefers the client's or its own order, certificate details and chain validity, HSTS and other headers, and a battery of named vulnerabilities including Heartbleed, ROBOT, POODLE, BEAST, SWEET32, LOGJAM, DROWN and CCS injection. It needs nothing installed beyond bash and OpenSSL and it produces a readable, colour-coded report or machine-readable JSON.

./testssl.sh --severity MEDIUM --htmlfile report.html example.com
./testssl.sh -p -s -h example.com     # protocols, standard ciphers, header checks only

Most of what it does is observation: it starts handshakes with specific parameters and notes what the server agrees to. The named vulnerability checks send unusual handshake messages to see how the server responds, and a couple, such as the Heartbleed test, are safe by design but still send something a normal client never would. For a server you administer, run everything; for anyone else's, the protocol and cipher enumeration is unambiguously fine and the vulnerability tests are a courtesy you should ask about first. The findings map onto the transport checks explained in SSL and TLS Explained.

Retire.js

Retire.js does one thing: it identifies JavaScript libraries and their versions, in files on disk or on a loaded page, and matches them against a JSON repository of known vulnerabilities with CVE references and the version that fixed each. It ships as a command-line tool for build pipelines, as a browser extension, and as plugins inside ZAP and Burp Suite.

npm install -g retire
retire --path ./public/assets --outputformat json --outputpath retire.json

Its detection is by file contents, filenames and version strings, so a renamed or bundled library may be missed and a patched fork with an old version number will be flagged. Those are the same limits as any version-based detection, and Retire.js is still the most reliable public source for the question "does this page ship a library with a published CVE?" The fixes it points at are described in Outdated JavaScript Libraries.

ClamAV

ClamAV is the open-source antivirus engine maintained by Cisco Talos. It matches files against signature databases (main.cvd, daily.cvd and bytecode.cvd), updated by the freshclam tool, and runs either as a one-shot command (clamscan) or as a daemon (clamd) that mail gateways, file servers and web upload handlers query over a socket. It unpacks archives, parses Office documents and PDFs to scan what is inside, and applies bytecode signatures that can express more than a fixed byte pattern.

freshclam
clamscan -r --infected --exclude-dir='^/sys' /srv/uploads
clamdscan --fdpass suspicious.pdf

It is strong on known malware and on the mass-mailed families that signatures cover well; it is weaker on novel or heavily obfuscated samples, which is why serious deployments layer heuristics and structural analysis on top. It is the only tool in this list that examines files rather than servers, and it belongs here because the question it answers, "is this file safe?", is the one people ask most often. ClamAV Explained covers its verdicts and gaps in detail.

How Scan.now relates to these tools

Scan.now is not a wrapper around any of them, and it is not an active scanner. Its checks borrow the detection logic that each of these tools applies in observational mode, and it stops where they would start sending payloads.

• The header, cookie and content checks of the website scanner correspond to ZAP's passive scan rules: read the response a normal request gets and evaluate it.
• The exposed-file checks work the way a passive Nuclei exposure template does: request a known path such as /.git/HEAD, match the response fingerprint, report. There are no CVE-exploitation templates and no fuzzing.
• The TLS checks enumerate protocol versions and cipher families the way testssl.sh's protocol and cipher modes do, by offering handshakes and recording what the server accepts. They do not run the named-vulnerability probes.
• The JavaScript library scanner uses the Retire.js vulnerability database for its matching, reported under JavaScript library with known vulnerabilities.
• The file scanner applies signature matching alongside structural checks for macros, PDF actions, archive bombs and disguised executables, and analyses files in memory without storing them.

What that means in practice: Scan.now can be pointed at any public website because it behaves like a careful visitor, and the trade-off is that it cannot prove an injection flaw or a server-side CVE, only surface the conditions that make one likely. Nothing it does brute-forces, exploits or sends attack input. For a site you own, the right sequence is a passive scan to fix the cheap, certain problems first, then an authorised ZAP or Nuclei active scan against a staging copy for the rest. The vulnerability scanning overview and the website security hub place both steps in context.

Our position on tool choice is simple. Learn ZAP if you build web applications; learn Nuclei if you run many hosts and need to answer advisory questions quickly; run testssl.sh and Retire.js in your pipeline because they are free, fast and never harmful; run ClamAV wherever files arrive from strangers; and reach for OpenVAS only when you have a network to manage and the time to manage it.