[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71GM45C8PWHAVMW6QN2PHT8":3,"skill-same:01M71GM45C8PWHAVMW6QN2PHT8":111},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":41,"linkOnly":42,"markdownContent":43,"markdownBody":44,"frontMatter":45,"refName":46,"commitSha":47,"skillDirectory":48,"forksCount":14,"repositoryHtmlUrl":49,"repositoryHomepageUrl":6,"ownerHtmlUrl":50,"ownerBlogUrl":6,"ownerDescription":51,"updatedAt":52,"install":53,"resources":66},"01M71GM45C8PWHAVMW6QN2PHT8","agentless-SKILL.md",null,">\n  Configure and execute agentless vulnerability scanning using network protocols, cloud snapshot analysis, and API-based discovery to assess systems without installing endpoint agents.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fvulnerabilities\u002Fscanning\u002Fagentless\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40],"skill md","agentless SKILL md","endpoint","execute","vulnerability scanning","cloud","network","snapshot","systems","scanning","api","vulnerability","analysis","configure","assess","discovery","protocols","2026-11-10 10:12:30",false,"---\nname: agentless-SKILL.md\ndescription: \">\\n  Configure and execute agentless vulnerability scanning using network\\\n  \\ protocols, cloud snapshot analysis, and API-based discovery to assess systems\\\n  \\ without installing endpoint agents.\"\n---\n# Performing Agentless Vulnerability Scanning\n\n## Overview\nAgentless vulnerability scanning assesses systems for security weaknesses without requiring endpoint agent installation. This approach leverages existing network protocols (SSH for Linux, WMI for Windows), cloud provider APIs for snapshot-based analysis, and authenticated remote checks. Modern cloud platforms like Microsoft Defender for Cloud, Wiz, Datadog, and Tenable perform out-of-band analysis by taking disk snapshots and examining OS configurations and installed packages offline. The open-source tool Vuls provides agentless scanning based on NVD and OVAL data for Linux\u002FFreeBSD systems. This skill covers configuring agentless scans across on-premises, cloud, and containerized environments.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing agentless vulnerability scanning\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n- SSH key-based authentication configured on Linux\u002FUnix targets\n- WMI\u002FWinRM access on Windows targets with appropriate credentials\n- Cloud provider API credentials (AWS IAM, Azure RBAC, GCP IAM)\n- Network access from scanner to target systems on required ports\n- Service account with read-only access to target system configurations\n- Python 3.8+ for custom scanning automation\n\n## Core Concepts\n\n### Agentless vs Agent-Based Scanning\n\n| Aspect | Agentless | Agent-Based |\n|--------|-----------|-------------|\n| Deployment | No software installation needed | Agent install on every endpoint |\n| Network dependency | Requires network connectivity | Works offline with cloud sync |\n| Performance impact | Minimal on target systems | Light continuous overhead |\n| Coverage depth | Depends on protocol\u002Fcredentials | Deep local access |\n| Cloud snapshot analysis | Native capability | Not applicable |\n| Ideal for | Cloud VMs, IoT, legacy systems, OT | Managed endpoints, laptops |\n\n### Agentless Scanning Methods\n\n| Method | Protocol | Target OS | Port | Use Case |\n|--------|----------|-----------|------|----------|\n| SSH Remote Commands | SSH | Linux\u002FUnix | 22 | Package enumeration, config audit |\n| WMI Remote Query | WMI\u002FDCOM | Windows | 135, 445 | Hotfix enumeration, registry checks |\n| WinRM PowerShell | WS-Man | Windows | 5985\u002F5986 | Remote command execution |\n| SNMP Community | SNMP v2c\u002Fv3 | Network devices | 161 | Device fingerprinting, firmware check |\n| Cloud Snapshot | Provider API | Cloud VMs | N\u002FA | Disk image analysis |\n| Container Registry | HTTPS | Container images | 443 | Image vulnerability scanning |\n| API-Based | REST\u002FHTTPS | SaaS\u002FCloud | 443 | Configuration assessment |\n\n### Cloud Snapshot Analysis Flow\n```\n1. Scanner requests disk snapshot via cloud API\n2. Cloud provider creates snapshot of VM root + data disks\n3. Scanner mounts snapshot in isolated analysis environment\n4. Scanner examines OS packages, configurations, file system\n5. Snapshot is deleted after analysis (no persistent copies)\n6. Results sent to central management console\n```\n\n## Workflow\n\n### Step 1: SSH-Based Agentless Scanning (Linux)\n\n```bash\n# Create dedicated scan SSH key pair\nssh-keygen -t ed25519 -f \u002Fopt\u002Fscanner\u002F.ssh\u002Fscan_key -N \"\" \\\n  -C \"vuln-scanner@security.local\"\n\n# Deploy public key to targets via Ansible\n# ansible-playbook deploy_scan_key.yml\n\n# Test connectivity to target\nssh -i \u002Fopt\u002Fscanner\u002F.ssh\u002Fscan_key -o ConnectTimeout=10 \\\n  scanner@target-host \"cat \u002Fetc\u002Fos-release && dpkg -l 2>\u002Fdev\u002Fnull || rpm -qa\"\n```\n\n```python\nimport paramiko\nimport json\n\nclass AgentlessLinuxScanner:\n    \"\"\"SSH-based agentless vulnerability scanner for Linux systems.\"\"\"\n\n    def __init__(self, key_path):\n        self.key_path = key_path\n\n    def connect(self, hostname, username=\"scanner\", port=22):\n        \"\"\"Establish SSH connection to target.\"\"\"\n        client = paramiko.SSHClient()\n        client.set_missing_host_key_policy(paramiko.AutoAddPolicy())\n        key = paramiko.Ed25519Key.from_private_key_file(self.key_path)\n        client.connect(hostname, port=port, username=username, pkey=key,\n                       timeout=30, banner_timeout=30)\n        return client\n\n    def get_os_info(self, client):\n        \"\"\"Detect OS type and version.\"\"\"\n        _, stdout, _ = client.exec_command(\"cat \u002Fetc\u002Fos-release\", timeout=10)\n        os_release = stdout.read().decode()\n        info = {}\n        for line in os_release.strip().split(\"\\n\"):\n            if \"=\" in line:\n                key, val = line.split(\"=\", 1)\n                info[key] = val.strip('\"')\n        return info\n\n    def get_installed_packages(self, client):\n        \"\"\"Enumerate installed packages.\"\"\"\n        # Try dpkg (Debian\u002FUbuntu)\n        _, stdout, _ = client.exec_command(\n            \"dpkg-query -W -f='${Package}|${Version}|${Architecture}\\\\n'\",\n            timeout=30\n        )\n        output = stdout.read().decode().strip()\n        if output:\n            packages = []\n            for line in output.split(\"\\n\"):\n                parts = line.split(\"|\")\n                if len(parts) >= 2:\n                    packages.append({\n                        \"name\": parts[0],\n                        \"version\": parts[1],\n                        \"arch\": parts[2] if len(parts) > 2 else \"\",\n                        \"manager\": \"dpkg\"\n                    })\n            return packages\n\n        # Try rpm (RHEL\u002FCentOS\u002FFedora)\n        _, stdout, _ = client.exec_command(\n            \"rpm -qa --queryformat '%{NAME}|%{VERSION}-%{RELEASE}|%{ARCH}\\\\n'\",\n            timeout=30\n        )\n        output = stdout.read().decode().strip()\n        packages = []\n        for line in output.split(\"\\n\"):\n            parts = line.split(\"|\")\n            if len(parts) >= 2:\n                packages.append({\n                    \"name\": parts[0],\n                    \"version\": parts[1],\n                    \"arch\": parts[2] if len(parts) > 2 else \"\",\n                    \"manager\": \"rpm\"\n                })\n        return packages\n\n    def check_kernel_version(self, client):\n        \"\"\"Get running kernel version.\"\"\"\n        _, stdout, _ = client.exec_command(\"uname -r\", timeout=10)\n        return stdout.read().decode().strip()\n\n    def check_listening_ports(self, client):\n        \"\"\"Enumerate listening network services.\"\"\"\n        _, stdout, _ = client.exec_command(\n            \"ss -tlnp 2>\u002Fdev\u002Fnull || netstat -tlnp 2>\u002Fdev\u002Fnull\",\n            timeout=10\n        )\n        return stdout.read().decode().strip()\n\n    def scan_host(self, hostname, username=\"scanner\"):\n        \"\"\"Perform full agentless scan of a host.\"\"\"\n        print(f\"[*] Scanning {hostname}...\")\n        client = self.connect(hostname, username)\n\n        result = {\n            \"hostname\": hostname,\n            \"os_info\": self.get_os_info(client),\n            \"kernel\": self.check_kernel_version(client),\n            \"packages\": self.get_installed_packages(client),\n            \"listening_ports\": self.check_listening_ports(client),\n        }\n\n        client.close()\n        print(f\"  [+] Found {len(result['packages'])} packages on {hostname}\")\n        return result\n```\n\n### Step 2: WinRM-Based Agentless Scanning (Windows)\n\n```python\nimport winrm\n\nclass AgentlessWindowsScanner:\n    \"\"\"WinRM-based agentless vulnerability scanner for Windows.\"\"\"\n\n    def __init__(self, username, password, domain=None):\n        self.username = username\n        self.password = password\n        self.domain = domain\n\n    def connect(self, hostname, use_ssl=True):\n        \"\"\"Create WinRM session.\"\"\"\n        port = 5986 if use_ssl else 5985\n        transport = \"ntlm\"\n        user = f\"{self.domain}\\\\{self.username}\" if self.domain else self.username\n        session = winrm.Session(\n            f\"{'https' if use_ssl else 'http'}:\u002F\u002F{hostname}:{port}\u002Fwsman\",\n            auth=(user, self.password),\n            transport=transport,\n            server_cert_validation=\"ignore\"\n        )\n        return session\n\n    def get_installed_hotfixes(self, session):\n        \"\"\"Get installed Windows updates\u002Fhotfixes.\"\"\"\n        cmd = \"Get-HotFix | Select-Object HotFixID,InstalledOn,Description | ConvertTo-Json\"\n        result = session.run_ps(cmd)\n        if result.status_code == 0:\n            return json.loads(result.std_out.decode())\n        return []\n\n    def get_installed_software(self, session):\n        \"\"\"Enumerate installed software from registry.\"\"\"\n        cmd = \"\"\"\n        $paths = @(\n            'HKLM:\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Uninstall\\\\*',\n            'HKLM:\\\\SOFTWARE\\\\WOW6432Node\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Uninstall\\\\*'\n        )\n        Get-ItemProperty $paths -ErrorAction SilentlyContinue |\n            Where-Object {$_.DisplayName} |\n            Select-Object DisplayName, DisplayVersion, Publisher |\n            ConvertTo-Json\n        \"\"\"\n        result = session.run_ps(cmd)\n        if result.status_code == 0:\n            return json.loads(result.std_out.decode())\n        return []\n\n    def get_os_info(self, session):\n        \"\"\"Get Windows OS details.\"\"\"\n        cmd = \"Get-CimInstance Win32_OperatingSystem | Select-Object Caption,Version,BuildNumber,OSArchitecture | ConvertTo-Json\"\n        result = session.run_ps(cmd)\n        if result.status_code == 0:\n            return json.loads(result.std_out.decode())\n        return {}\n\n    def scan_host(self, hostname):\n        \"\"\"Perform full agentless scan of Windows host.\"\"\"\n        print(f\"[*] Scanning {hostname} via WinRM...\")\n        session = self.connect(hostname)\n\n        result = {\n            \"hostname\": hostname,\n            \"os_info\": self.get_os_info(session),\n            \"hotfixes\": self.get_installed_hotfixes(session),\n            \"software\": self.get_installed_software(session),\n        }\n\n        print(f\"  [+] Found {len(result['hotfixes'])} hotfixes, \"\n              f\"{len(result['software'])} software entries\")\n        return result\n```\n\n### Step 3: Cloud Snapshot Scanning (AWS)\n\n```python\nimport boto3\nimport time\n\nclass AWSSnapshotScanner:\n    \"\"\"AWS EC2 agentless snapshot-based vulnerability scanner.\"\"\"\n\n    def __init__(self, region=\"us-east-1\"):\n        self.ec2 = boto3.client(\"ec2\", region_name=region)\n\n    def create_snapshot(self, volume_id, description=\"Security scan snapshot\"):\n        \"\"\"Create EBS snapshot for analysis.\"\"\"\n        snapshot = self.ec2.create_snapshot(\n            VolumeId=volume_id,\n            Description=description,\n            TagSpecifications=[{\n                \"ResourceType\": \"snapshot\",\n                \"Tags\": [\n                    {\"Key\": \"Purpose\", \"Value\": \"VulnScan\"},\n                    {\"Key\": \"AutoDelete\", \"Value\": \"true\"},\n                ]\n            }]\n        )\n        snapshot_id = snapshot[\"SnapshotId\"]\n        print(f\"  [*] Creating snapshot {snapshot_id} from {volume_id}...\")\n\n        waiter = self.ec2.get_waiter(\"snapshot_completed\")\n        waiter.wait(SnapshotIds=[snapshot_id])\n        print(f\"  [+] Snapshot {snapshot_id} ready\")\n        return snapshot_id\n\n    def delete_snapshot(self, snapshot_id):\n        \"\"\"Clean up snapshot after analysis.\"\"\"\n        self.ec2.delete_snapshot(SnapshotId=snapshot_id)\n        print(f\"  [+] Deleted snapshot {snapshot_id}\")\n\n    def scan_instance(self, instance_id):\n        \"\"\"Scan an EC2 instance via snapshot analysis.\"\"\"\n        print(f\"[*] Agentless scan of instance {instance_id}\")\n\n        instance = self.ec2.describe_instances(\n            InstanceIds=[instance_id]\n        )[\"Reservations\"][0][\"Instances\"][0]\n\n        root_volume = None\n        for bdm in instance.get(\"BlockDeviceMappings\", []):\n            if bdm[\"DeviceName\"] == instance.get(\"RootDeviceName\"):\n                root_volume = bdm[\"Ebs\"][\"VolumeId\"]\n                break\n\n        if not root_volume:\n            print(\"  [!] No root volume found\")\n            return None\n\n        snapshot_id = self.create_snapshot(root_volume)\n        try:\n            # Analysis would be performed here\n            # Mount snapshot, examine packages, check configs\n            result = {\n                \"instance_id\": instance_id,\n                \"snapshot_id\": snapshot_id,\n                \"root_volume\": root_volume,\n                \"platform\": instance.get(\"Platform\", \"linux\"),\n                \"state\": instance[\"State\"][\"Name\"],\n            }\n            return result\n        finally:\n            self.delete_snapshot(snapshot_id)\n```\n\n### Step 4: Vuls Open-Source Agentless Scanner\n\n```toml\n# \u002Fetc\u002Fvuls\u002Fconfig.toml - Vuls configuration for agentless scanning\n\n[servers]\n\n[servers.web-server-01]\nhost = \"192.168.1.10\"\nport = \"22\"\nuser = \"vuls\"\nkeyPath = \"\u002Fopt\u002Fvuls\u002F.ssh\u002Fscan_key\"\nscanMode = [\"fast\"]\n\n[servers.db-server-01]\nhost = \"192.168.1.20\"\nport = \"22\"\nuser = \"vuls\"\nkeyPath = \"\u002Fopt\u002Fvuls\u002F.ssh\u002Fscan_key\"\nscanMode = [\"fast-root\"]\n[servers.db-server-01.optional]\n  [servers.db-server-01.optional.sudo]\n    password = \"\"\n\n[servers.container-host-01]\nhost = \"192.168.1.30\"\nport = \"22\"\nuser = \"vuls\"\nkeyPath = \"\u002Fopt\u002Fvuls\u002F.ssh\u002Fscan_key\"\nscanMode = [\"fast\"]\ncontainersIncluded = [\"${running}\"]\n```\n\n```bash\n# Run Vuls agentless scan\nvuls scan\n\n# Generate report\nvuls report -format-json -to-localfile\n\n# View results\nvuls tui\n```\n\n## Best Practices\n1. Use SSH key-based authentication instead of passwords for Linux scanning\n2. Create dedicated service accounts with minimal read-only privileges for scanning\n3. Always clean up cloud snapshots after analysis to avoid storage costs and data exposure\n4. Combine agentless scanning with agent-based for comprehensive coverage\n5. Schedule scans during low-activity periods to minimize any performance impact\n6. Rotate scanning credentials regularly and store in a secrets vault\n7. Test scanner connectivity before scheduling production scans\n8. Use SNMPv3 with authentication and encryption for network device scanning\n\n## Common Pitfalls\n- Using shared credentials across multiple environments without proper segmentation\n- Not cleaning up temporary snapshots in cloud environments\n- Assuming agentless scanning has zero performance impact (network and CPU are used)\n- Missing WinRM\u002FSSH firewall rules causing scan failures on new deployments\n- Not accounting for SSH host key changes causing authentication failures\n- Scanning OT\u002FICS devices with protocols they cannot safely handle\n\n## Related Skills\n- implementing-rapid7-insightvm-for-scanning\n- implementing-wazuh-for-vulnerability-detection\n- deploying-osquery-for-endpoint-monitoring\n- performing-remediation-validation-scanning\n\n\n---\n\n## CyberSecSuite Integration\n\n```bash\n# Open a case before starting investigation\nmcp__cybersec__case_open --title \"agentless\" --type investigation\n\n# Persist findings to PostgreSQL\nmcp__cybersec__add_finding --title \"...\" --severity high --description \"...\"\n\n# Log IOCs\nmcp__cybersec__add_ioc --type domain --value \"...\" --confidence 0.9\n\n# Map to MITRE\nmcp__cybersec__suggest_mitre --description \"...\"\n```\n\n**Agent:** `@cybersec-agent` → delegates to appropriate specialist\n","# Performing Agentless Vulnerability Scanning\n\n## Overview\nAgentless vulnerability scanning assesses systems for security weaknesses without requiring endpoint agent installation. This approach leverages existing network protocols (SSH for Linux, WMI for Windows), cloud provider APIs for snapshot-based analysis, and authenticated remote checks. Modern cloud platforms like Microsoft Defender for Cloud, Wiz, Datadog, and Tenable perform out-of-band analysis by taking disk snapshots and examining OS configurations and installed packages offline. The open-source tool Vuls provides agentless scanning based on NVD and OVAL data for Linux\u002FFreeBSD systems. This skill covers configuring agentless scans across on-premises, cloud, and containerized environments.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing agentless vulnerability scanning\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n- SSH key-based authentication configured on Linux\u002FUnix targets\n- WMI\u002FWinRM access on Windows targets with appropriate credentials\n- Cloud provider API credentials (AWS IAM, Azure RBAC, GCP IAM)\n- Network access from scanner to target systems on required ports\n- Service account with read-only access to target system configurations\n- Python 3.8+ for custom scanning automation\n\n## Core Concepts\n\n### Agentless vs Agent-Based Scanning\n\n| Aspect | Agentless | Agent-Based |\n|--------|-----------|-------------|\n| Deployment | No software installation needed | Agent install on every endpoint |\n| Network dependency | Requires network connectivity | Works offline with cloud sync |\n| Performance impact | Minimal on target systems | Light continuous overhead |\n| Coverage depth | Depends on protocol\u002Fcredentials | Deep local access |\n| Cloud snapshot analysis | Native capability | Not applicable |\n| Ideal for | Cloud VMs, IoT, legacy systems, OT | Managed endpoints, laptops |\n\n### Agentless Scanning Methods\n\n| Method | Protocol | Target OS | Port | Use Case |\n|--------|----------|-----------|------|----------|\n| SSH Remote Commands | SSH | Linux\u002FUnix | 22 | Package enumeration, config audit |\n| WMI Remote Query | WMI\u002FDCOM | Windows | 135, 445 | Hotfix enumeration, registry checks |\n| WinRM PowerShell | WS-Man | Windows | 5985\u002F5986 | Remote command execution |\n| SNMP Community | SNMP v2c\u002Fv3 | Network devices | 161 | Device fingerprinting, firmware check |\n| Cloud Snapshot | Provider API | Cloud VMs | N\u002FA | Disk image analysis |\n| Container Registry | HTTPS | Container images | 443 | Image vulnerability scanning |\n| API-Based | REST\u002FHTTPS | SaaS\u002FCloud | 443 | Configuration assessment |\n\n### Cloud Snapshot Analysis Flow\n```\n1. Scanner requests disk snapshot via cloud API\n2. Cloud provider creates snapshot of VM root + data disks\n3. Scanner mounts snapshot in isolated analysis environment\n4. Scanner examines OS packages, configurations, file system\n5. Snapshot is deleted after analysis (no persistent copies)\n6. Results sent to central management console\n```\n\n## Workflow\n\n### Step 1: SSH-Based Agentless Scanning (Linux)\n\n```bash\n# Create dedicated scan SSH key pair\nssh-keygen -t ed25519 -f \u002Fopt\u002Fscanner\u002F.ssh\u002Fscan_key -N \"\" \\\n  -C \"vuln-scanner@security.local\"\n\n# Deploy public key to targets via Ansible\n# ansible-playbook deploy_scan_key.yml\n\n# Test connectivity to target\nssh -i \u002Fopt\u002Fscanner\u002F.ssh\u002Fscan_key -o ConnectTimeout=10 \\\n  scanner@target-host \"cat \u002Fetc\u002Fos-release && dpkg -l 2>\u002Fdev\u002Fnull || rpm -qa\"\n```\n\n```python\nimport paramiko\nimport json\n\nclass AgentlessLinuxScanner:\n    \"\"\"SSH-based agentless vulnerability scanner for Linux systems.\"\"\"\n\n    def __init__(self, key_path):\n        self.key_path = key_path\n\n    def connect(self, hostname, username=\"scanner\", port=22):\n        \"\"\"Establish SSH connection to target.\"\"\"\n        client = paramiko.SSHClient()\n        client.set_missing_host_key_policy(paramiko.AutoAddPolicy())\n        key = paramiko.Ed25519Key.from_private_key_file(self.key_path)\n        client.connect(hostname, port=port, username=username, pkey=key,\n                       timeout=30, banner_timeout=30)\n        return client\n\n    def get_os_info(self, client):\n        \"\"\"Detect OS type and version.\"\"\"\n        _, stdout, _ = client.exec_command(\"cat \u002Fetc\u002Fos-release\", timeout=10)\n        os_release = stdout.read().decode()\n        info = {}\n        for line in os_release.strip().split(\"\\n\"):\n            if \"=\" in line:\n                key, val = line.split(\"=\", 1)\n                info[key] = val.strip('\"')\n        return info\n\n    def get_installed_packages(self, client):\n        \"\"\"Enumerate installed packages.\"\"\"\n        # Try dpkg (Debian\u002FUbuntu)\n        _, stdout, _ = client.exec_command(\n            \"dpkg-query -W -f='${Package}|${Version}|${Architecture}\\\\n'\",\n            timeout=30\n        )\n        output = stdout.read().decode().strip()\n        if output:\n            packages = []\n            for line in output.split(\"\\n\"):\n                parts = line.split(\"|\")\n                if len(parts) >= 2:\n                    packages.append({\n                        \"name\": parts[0],\n                        \"version\": parts[1],\n                        \"arch\": parts[2] if len(parts) > 2 else \"\",\n                        \"manager\": \"dpkg\"\n                    })\n            return packages\n\n        # Try rpm (RHEL\u002FCentOS\u002FFedora)\n        _, stdout, _ = client.exec_command(\n            \"rpm -qa --queryformat '%{NAME}|%{VERSION}-%{RELEASE}|%{ARCH}\\\\n'\",\n            timeout=30\n        )\n        output = stdout.read().decode().strip()\n        packages = []\n        for line in output.split(\"\\n\"):\n            parts = line.split(\"|\")\n            if len(parts) >= 2:\n                packages.append({\n                    \"name\": parts[0],\n                    \"version\": parts[1],\n                    \"arch\": parts[2] if len(parts) > 2 else \"\",\n                    \"manager\": \"rpm\"\n                })\n        return packages\n\n    def check_kernel_version(self, client):\n        \"\"\"Get running kernel version.\"\"\"\n        _, stdout, _ = client.exec_command(\"uname -r\", timeout=10)\n        return stdout.read().decode().strip()\n\n    def check_listening_ports(self, client):\n        \"\"\"Enumerate listening network services.\"\"\"\n        _, stdout, _ = client.exec_command(\n            \"ss -tlnp 2>\u002Fdev\u002Fnull || netstat -tlnp 2>\u002Fdev\u002Fnull\",\n            timeout=10\n        )\n        return stdout.read().decode().strip()\n\n    def scan_host(self, hostname, username=\"scanner\"):\n        \"\"\"Perform full agentless scan of a host.\"\"\"\n        print(f\"[*] Scanning {hostname}...\")\n        client = self.connect(hostname, username)\n\n        result = {\n            \"hostname\": hostname,\n            \"os_info\": self.get_os_info(client),\n            \"kernel\": self.check_kernel_version(client),\n            \"packages\": self.get_installed_packages(client),\n            \"listening_ports\": self.check_listening_ports(client),\n        }\n\n        client.close()\n        print(f\"  [+] Found {len(result['packages'])} packages on {hostname}\")\n        return result\n```\n\n### Step 2: WinRM-Based Agentless Scanning (Windows)\n\n```python\nimport winrm\n\nclass AgentlessWindowsScanner:\n    \"\"\"WinRM-based agentless vulnerability scanner for Windows.\"\"\"\n\n    def __init__(self, username, password, domain=None):\n        self.username = username\n        self.password = password\n        self.domain = domain\n\n    def connect(self, hostname, use_ssl=True):\n        \"\"\"Create WinRM session.\"\"\"\n        port = 5986 if use_ssl else 5985\n        transport = \"ntlm\"\n        user = f\"{self.domain}\\\\{self.username}\" if self.domain else self.username\n        session = winrm.Session(\n            f\"{'https' if use_ssl else 'http'}:\u002F\u002F{hostname}:{port}\u002Fwsman\",\n            auth=(user, self.password),\n            transport=transport,\n            server_cert_validation=\"ignore\"\n        )\n        return session\n\n    def get_installed_hotfixes(self, session):\n        \"\"\"Get installed Windows updates\u002Fhotfixes.\"\"\"\n        cmd = \"Get-HotFix | Select-Object HotFixID,InstalledOn,Description | ConvertTo-Json\"\n        result = session.run_ps(cmd)\n        if result.status_code == 0:\n            return json.loads(result.std_out.decode())\n        return []\n\n    def get_installed_software(self, session):\n        \"\"\"Enumerate installed software from registry.\"\"\"\n        cmd = \"\"\"\n        $paths = @(\n            'HKLM:\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Uninstall\\\\*',\n            'HKLM:\\\\SOFTWARE\\\\WOW6432Node\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Uninstall\\\\*'\n        )\n        Get-ItemProperty $paths -ErrorAction SilentlyContinue |\n            Where-Object {$_.DisplayName} |\n            Select-Object DisplayName, DisplayVersion, Publisher |\n            ConvertTo-Json\n        \"\"\"\n        result = session.run_ps(cmd)\n        if result.status_code == 0:\n            return json.loads(result.std_out.decode())\n        return []\n\n    def get_os_info(self, session):\n        \"\"\"Get Windows OS details.\"\"\"\n        cmd = \"Get-CimInstance Win32_OperatingSystem | Select-Object Caption,Version,BuildNumber,OSArchitecture | ConvertTo-Json\"\n        result = session.run_ps(cmd)\n        if result.status_code == 0:\n            return json.loads(result.std_out.decode())\n        return {}\n\n    def scan_host(self, hostname):\n        \"\"\"Perform full agentless scan of Windows host.\"\"\"\n        print(f\"[*] Scanning {hostname} via WinRM...\")\n        session = self.connect(hostname)\n\n        result = {\n            \"hostname\": hostname,\n            \"os_info\": self.get_os_info(session),\n            \"hotfixes\": self.get_installed_hotfixes(session),\n            \"software\": self.get_installed_software(session),\n        }\n\n        print(f\"  [+] Found {len(result['hotfixes'])} hotfixes, \"\n              f\"{len(result['software'])} software entries\")\n        return result\n```\n\n### Step 3: Cloud Snapshot Scanning (AWS)\n\n```python\nimport boto3\nimport time\n\nclass AWSSnapshotScanner:\n    \"\"\"AWS EC2 agentless snapshot-based vulnerability scanner.\"\"\"\n\n    def __init__(self, region=\"us-east-1\"):\n        self.ec2 = boto3.client(\"ec2\", region_name=region)\n\n    def create_snapshot(self, volume_id, description=\"Security scan snapshot\"):\n        \"\"\"Create EBS snapshot for analysis.\"\"\"\n        snapshot = self.ec2.create_snapshot(\n            VolumeId=volume_id,\n            Description=description,\n            TagSpecifications=[{\n                \"ResourceType\": \"snapshot\",\n                \"Tags\": [\n                    {\"Key\": \"Purpose\", \"Value\": \"VulnScan\"},\n                    {\"Key\": \"AutoDelete\", \"Value\": \"true\"},\n                ]\n            }]\n        )\n        snapshot_id = snapshot[\"SnapshotId\"]\n        print(f\"  [*] Creating snapshot {snapshot_id} from {volume_id}...\")\n\n        waiter = self.ec2.get_waiter(\"snapshot_completed\")\n        waiter.wait(SnapshotIds=[snapshot_id])\n        print(f\"  [+] Snapshot {snapshot_id} ready\")\n        return snapshot_id\n\n    def delete_snapshot(self, snapshot_id):\n        \"\"\"Clean up snapshot after analysis.\"\"\"\n        self.ec2.delete_snapshot(SnapshotId=snapshot_id)\n        print(f\"  [+] Deleted snapshot {snapshot_id}\")\n\n    def scan_instance(self, instance_id):\n        \"\"\"Scan an EC2 instance via snapshot analysis.\"\"\"\n        print(f\"[*] Agentless scan of instance {instance_id}\")\n\n        instance = self.ec2.describe_instances(\n            InstanceIds=[instance_id]\n        )[\"Reservations\"][0][\"Instances\"][0]\n\n        root_volume = None\n        for bdm in instance.get(\"BlockDeviceMappings\", []):\n            if bdm[\"DeviceName\"] == instance.get(\"RootDeviceName\"):\n                root_volume = bdm[\"Ebs\"][\"VolumeId\"]\n                break\n\n        if not root_volume:\n            print(\"  [!] No root volume found\")\n            return None\n\n        snapshot_id = self.create_snapshot(root_volume)\n        try:\n            # Analysis would be performed here\n            # Mount snapshot, examine packages, check configs\n            result = {\n                \"instance_id\": instance_id,\n                \"snapshot_id\": snapshot_id,\n                \"root_volume\": root_volume,\n                \"platform\": instance.get(\"Platform\", \"linux\"),\n                \"state\": instance[\"State\"][\"Name\"],\n            }\n            return result\n        finally:\n            self.delete_snapshot(snapshot_id)\n```\n\n### Step 4: Vuls Open-Source Agentless Scanner\n\n```toml\n# \u002Fetc\u002Fvuls\u002Fconfig.toml - Vuls configuration for agentless scanning\n\n[servers]\n\n[servers.web-server-01]\nhost = \"192.168.1.10\"\nport = \"22\"\nuser = \"vuls\"\nkeyPath = \"\u002Fopt\u002Fvuls\u002F.ssh\u002Fscan_key\"\nscanMode = [\"fast\"]\n\n[servers.db-server-01]\nhost = \"192.168.1.20\"\nport = \"22\"\nuser = \"vuls\"\nkeyPath = \"\u002Fopt\u002Fvuls\u002F.ssh\u002Fscan_key\"\nscanMode = [\"fast-root\"]\n[servers.db-server-01.optional]\n  [servers.db-server-01.optional.sudo]\n    password = \"\"\n\n[servers.container-host-01]\nhost = \"192.168.1.30\"\nport = \"22\"\nuser = \"vuls\"\nkeyPath = \"\u002Fopt\u002Fvuls\u002F.ssh\u002Fscan_key\"\nscanMode = [\"fast\"]\ncontainersIncluded = [\"${running}\"]\n```\n\n```bash\n# Run Vuls agentless scan\nvuls scan\n\n# Generate report\nvuls report -format-json -to-localfile\n\n# View results\nvuls tui\n```\n\n## Best Practices\n1. Use SSH key-based authentication instead of passwords for Linux scanning\n2. Create dedicated service accounts with minimal read-only privileges for scanning\n3. Always clean up cloud snapshots after analysis to avoid storage costs and data exposure\n4. Combine agentless scanning with agent-based for comprehensive coverage\n5. Schedule scans during low-activity periods to minimize any performance impact\n6. Rotate scanning credentials regularly and store in a secrets vault\n7. Test scanner connectivity before scheduling production scans\n8. Use SNMPv3 with authentication and encryption for network device scanning\n\n## Common Pitfalls\n- Using shared credentials across multiple environments without proper segmentation\n- Not cleaning up temporary snapshots in cloud environments\n- Assuming agentless scanning has zero performance impact (network and CPU are used)\n- Missing WinRM\u002FSSH firewall rules causing scan failures on new deployments\n- Not accounting for SSH host key changes causing authentication failures\n- Scanning OT\u002FICS devices with protocols they cannot safely handle\n\n## Related Skills\n- implementing-rapid7-insightvm-for-scanning\n- implementing-wazuh-for-vulnerability-detection\n- deploying-osquery-for-endpoint-monitoring\n- performing-remediation-validation-scanning\n\n\n---\n\n## CyberSecSuite Integration\n\n```bash\n# Open a case before starting investigation\nmcp__cybersec__case_open --title \"agentless\" --type investigation\n\n# Persist findings to PostgreSQL\nmcp__cybersec__add_finding --title \"...\" --severity high --description \"...\"\n\n# Log IOCs\nmcp__cybersec__add_ioc --type domain --value \"...\" --confidence 0.9\n\n# Map to MITRE\nmcp__cybersec__suggest_mitre --description \"...\"\n```\n\n**Agent:** `@cybersec-agent` → delegates to appropriate specialist\n",{"name":5,"description":7},"main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fvulnerabilities\u002Fscanning\u002Fagentless","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":54,"prompt":64,"zipAvailable":65},[55,58,61],{"tool":56,"command":57},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill agentless-SKILL.md",{"tool":59,"command":60},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill agentless-SKILL.md",{"tool":62,"command":63},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill agentless-SKILL.md","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fvulnerabilities\u002Fscanning\u002Fagentless\u002FSKILL.md",true,[67,73,77,83,87,90,94,98,104,107],{"path":68,"resourceType":69,"resourceTypeDesc":70,"sizeBytes":71,"sourceHtmlUrl":72},"assets\u002Findex.json","ASSET","资产文件",84,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fvulnerabilities\u002Fscanning\u002Fagentless\u002Fassets\u002Findex.json",{"path":74,"resourceType":69,"resourceTypeDesc":70,"sizeBytes":75,"sourceHtmlUrl":76},"assets\u002Ftemplate.md",993,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fvulnerabilities\u002Fscanning\u002Fagentless\u002Fassets\u002Ftemplate.md",{"path":78,"resourceType":79,"resourceTypeDesc":80,"sizeBytes":81,"sourceHtmlUrl":82},"index.json","REFERENCE","参考文档",1492,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fvulnerabilities\u002Fscanning\u002Fagentless\u002Findex.json",{"path":84,"resourceType":79,"resourceTypeDesc":80,"sizeBytes":85,"sourceHtmlUrl":86},"references\u002Fapi-reference.md",3050,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fvulnerabilities\u002Fscanning\u002Fagentless\u002Freferences\u002Fapi-reference.md",{"path":88,"resourceType":79,"resourceTypeDesc":80,"sizeBytes":71,"sourceHtmlUrl":89},"references\u002Findex.json","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fvulnerabilities\u002Fscanning\u002Fagentless\u002Freferences\u002Findex.json",{"path":91,"resourceType":79,"resourceTypeDesc":80,"sizeBytes":92,"sourceHtmlUrl":93},"references\u002Fstandards.md",1260,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fvulnerabilities\u002Fscanning\u002Fagentless\u002Freferences\u002Fstandards.md",{"path":95,"resourceType":79,"resourceTypeDesc":80,"sizeBytes":96,"sourceHtmlUrl":97},"references\u002Fworkflows.md",2664,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fvulnerabilities\u002Fscanning\u002Fagentless\u002Freferences\u002Fworkflows.md",{"path":99,"resourceType":100,"resourceTypeDesc":101,"sizeBytes":102,"sourceHtmlUrl":103},"scripts\u002Fagent.py","SCRIPT","脚本",6754,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fvulnerabilities\u002Fscanning\u002Fagentless\u002Fscripts\u002Fagent.py",{"path":105,"resourceType":100,"resourceTypeDesc":101,"sizeBytes":71,"sourceHtmlUrl":106},"scripts\u002Findex.json","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fvulnerabilities\u002Fscanning\u002Fagentless\u002Fscripts\u002Findex.json",{"path":108,"resourceType":100,"resourceTypeDesc":101,"sizeBytes":109,"sourceHtmlUrl":110},"scripts\u002Fprocess.py",7739,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fvulnerabilities\u002Fscanning\u002Fagentless\u002Fscripts\u002Fprocess.py",[112,138,160,182,204,219],{"skillNo":113,"name":114,"nameZh":6,"description":115,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":116,"categories":117,"keywords":118,"publishedAt":41},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137],"services","detect","services wmi persistence detect","wmi","persistence","de","cm","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","cybersecurity","process-forensics",{"skillNo":139,"name":140,"nameZh":6,"description":141,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":142,"categories":143,"keywords":144,"publishedAt":41},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[145,119,146,122,147,148,149,136,150,36,151,152,153,154,124,155,156,157,158,159],"exploit","services wmi exec exploit","exec","remote","traffic","Bash","team","across","crackmapexec","native","command","lateral movement","read","lateral-movement","Impacket",{"skillNo":161,"name":162,"nameZh":6,"description":163,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":164,"categories":165,"keywords":166,"publishedAt":41},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[167,168,169,170,171,172,136,150,173,36,174,175,124,157,176,177,178,179,180,181],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper","sonnet",{"skillNo":183,"name":184,"nameZh":6,"description":185,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":186,"categories":187,"keywords":188,"publishedAt":41},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[120,189,190,191,192,193,194,125,195,136,137,196,197,198,199,200,201,202,203,124],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":205,"name":206,"nameZh":6,"description":207,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":208,"categories":209,"keywords":210,"publishedAt":41},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[211,212,120,213,191,193,214,125,215,195,136,137,36,34,216,217,218,203,124,126],"thread","processes thread injection detect","injection","memory","process-injection","apc-injection","thread-injection","nt-api",{"skillNo":220,"name":221,"nameZh":6,"description":222,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":223,"categories":224,"keywords":225,"publishedAt":41},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[226,120,191,227,214,125,228,229,136,137,230,231,232,233,234,235,124,126,236,237],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]