Performing Agentless Vulnerability Scanning

Overview

Agentless vulnerability scanning assesses systems for security weaknesses without requiring endpoint agent installation. This approach leverages existing network protocols (SSH for Linux, WMI for Windows), cloud provider APIs for snapshot-based analysis, and authenticated remote checks. Modern cloud platforms like Microsoft Defender for Cloud, Wiz, Datadog, and Tenable perform out-of-band analysis by taking disk snapshots and examining OS configurations and installed packages offline. The open-source tool Vuls provides agentless scanning based on NVD and OVAL data for Linux/FreeBSD systems. This skill covers configuring agentless scans across on-premises, cloud, and containerized environments.

When to Use

• When conducting security assessments that involve performing agentless vulnerability scanning
• When following incident response procedures for related security events
• When performing scheduled security testing or auditing activities
• When validating security controls through hands-on testing

Prerequisites

• SSH key-based authentication configured on Linux/Unix targets
• WMI/WinRM access on Windows targets with appropriate credentials
• Cloud provider API credentials (AWS IAM, Azure RBAC, GCP IAM)
• Network access from scanner to target systems on required ports
• Service account with read-only access to target system configurations
• Python 3.8+ for custom scanning automation

Core Concepts

Agentless vs Agent-Based Scanning

Agentless Scanning Methods

Cloud Snapshot Analysis Flow

1. Scanner requests disk snapshot via cloud API
2. Cloud provider creates snapshot of VM root + data disks
3. Scanner mounts snapshot in isolated analysis environment
4. Scanner examines OS packages, configurations, file system
5. Snapshot is deleted after analysis (no persistent copies)
6. Results sent to central management console

Workflow

Step 1: SSH-Based Agentless Scanning (Linux)

# Create dedicated scan SSH key pair
ssh-keygen -t ed25519 -f /opt/scanner/.ssh/scan_key -N "" \
  -C "vuln-scanner@security.local"

# Deploy public key to targets via Ansible
# ansible-playbook deploy_scan_key.yml

# Test connectivity to target
ssh -i /opt/scanner/.ssh/scan_key -o ConnectTimeout=10 \
  scanner@target-host "cat /etc/os-release && dpkg -l 2>/dev/null || rpm -qa"

import paramiko
import json

class AgentlessLinuxScanner:
    """SSH-based agentless vulnerability scanner for Linux systems."""

    def __init__(self, key_path):
        self.key_path = key_path

    def connect(self, hostname, username="scanner", port=22):
        """Establish SSH connection to target."""
        client = paramiko.SSHClient()
        client.set_missing_host_key_policy(paramiko.AutoAddPolicy())
        key = paramiko.Ed25519Key.from_private_key_file(self.key_path)
        client.connect(hostname, port=port, username=username, pkey=key,
                       timeout=30, banner_timeout=30)
        return client

    def get_os_info(self, client):
        """Detect OS type and version."""
        _, stdout, _ = client.exec_command("cat /etc/os-release", timeout=10)
        os_release = stdout.read().decode()
        info = {}

…