Continuous monitoring is key. Running Nmap once a month isn't enough; you need to know immediately if a developer accidentally exposes an RDP port to the web.
The python-nmap Library
Instead of dealing with bash text-parsing (which can be a nightmare), I use the python-nmap library. It allows you to run scans directly from Python and returns the results in a clean JSON/dictionary format.
import nmap
import requests
def scan_and_alert(target):
nm = nmap.PortScanner()
nm.scan(target, '1-1024', '-sS')
for host in nm.all_hosts():
for proto in nm[host].all_protocols():
ports = nm[host][proto].keys()
for port in ports:
state = nm[host][proto][port]['state']
if state == 'open':
send_slack_alert(f"Alert: Port {port} is OPEN on {host}")
def send_slack_alert(message):
webhook_url = 'https://hooks.slack.com/services/YOUR/WEBHOOK/URL'
requests.post(webhook_url, json={'text': message})
scan_and_alert('192.168.1.0/24')Putting it in a Cron Job
I simply run this script on a lightweight Raspberry Pi inside my network via a cron job set to execute every hour. If anything changes, my phone buzzes via Slack before an attacker even has time to scan it!