Scanning & Data Import¶
Raven drives its toolchain from the Modules page in the web dashboard (and the equivalent commands in the REPL). You pick a module, set its options in the form, and run it — results are parsed and folded into the engagement DB automatically, so hosts land in Hosts, services in Services, and findings in Findings.
The Pro Docker image bundles the underlying tools (nmap, nuclei, etc.). On the bare binary you supply them yourself (which is why it's Kali-only — see Install & Pair).
Modules¶
Modules are grouped into tabs on the Modules page. The exact set grows over time; the page itself is the authoritative list. As of the current beta:
- Discovery — Host Discovery, Port Scanner (nmap, with quick/balanced/thorough profiles), Fingerprinting, SSL Certificates, WAF Detection, Git Exposure, API Discovery, FTP Enumeration, Screenshots.
- OSINT — Sublist3r, Certificate Transparency, Email Harvesting, Breach Data, Wayback Machine, GitHub Dorking, Shodan Host / Search.
- Scanning — Nuclei Scanner, SSL/TLS Scanner, Email Security (SPF/DMARC/DKIM), DNS Zone Transfer, WHOIS, Typosquatting Detection.
- Exploitation — Directory Brute Force, Default Credentials Testing.
- Internal (internal engagements) — DC Discovery, SMB Signing Check, SMB Enumeration, LDAP Enumeration, Password Spray, AS-REP Roasting, Kerberoasting, Auth Coercion, BloodHound Collection.
- Utility — Custom Command, and other helpers.
Each module exposes its own options in the run form (scan profile, target selection, rate limits, wordlists, and so on) — there's no need to memorize flags.
Raw-socket scans need capabilities
SYN scans and similar need --cap-add=NET_RAW --cap-add=NET_ADMIN on the container (or the equivalent capability on the bare binary). See Troubleshooting.
Importing existing scans¶
If you've already scanned with another tool, import the output from the Import page rather than re-running. Supported formats:
| Source | Format |
|---|---|
| Nmap | XML (-oX output) |
| Nessus | .nessus |
| Burp Suite | XML |
| Masscan | XML / JSON |
| BloodHound | collection ZIP / JSON |
Imported hosts, services, and findings merge into the current engagement and de-duplicate against what's already there.
Jobs¶
Modules run as background jobs. The Jobs page tracks them — active, queued, and completed — with live status and per-job output you can open for troubleshooting. Cancel a running job or re-run a failed one from there. (Remote execution via a jumpbox agent streams its output to the same place — see the Remote Agent section of the Web Dashboard guide.)
Best practices¶
Scan order. Work outward in: passive and low-impact first (fingerprinting, DNS, SSL, OSINT), then safe active scans (Nuclei, port scans), then the invasive checks (default-credential and password-spray modules) once you've confirmed scope and impact.
Reduce noise. Import what you already have and let de-duplication do its job rather than re-scanning. Triage by severity — Critical/High first — and mark false positives so they stop cluttering the view.
Respect the engagement. Use a module's rate-limit options on bandwidth-sensitive networks, and schedule heavy scans for agreed windows. Document what was and wasn't scanned in Notes so the report reflects reality.
Once you've collected data, the AI Analysis advisor can reason over it — suggest next steps, consolidate duplicates, and draft write-ups.