• GRC's "ShieldsUP!"
• IPFingerPrints' "Network Port Checker & Scanner Tool"
• Hacker Target's "Online Firewall Test for Work or Home"
• Fortinet's "Test Your Metal" (browser fetches bad files from server, see if firewall or AV etc stops it)
• Router Security's "Test Your Router" (lots of links to sites and services)
• Is My Port Open?
• SpeedGuide
• SpeedGuide UPnP


• Is your router's administration UI accessible from the public internet ? It shouldn't be; only a LAN address such as 192.168.0.1/login should work (VPN probably has to be off).
  
  But when I used Doileak.com to get my network's public IP address, then accessed MYPUBLICIPADDRESS/login, I got my router's login page.
  
  To make sure my router wasn't fooling me, I asked a couple of friends to access MYPUBLICIPADDRESS/login from their networks. Both of them got "unreachable". So I think my router WAS fooling me.

If you decide to perform a scan from the Internet you may want to give your ISP a heads-up to avoid any trouble.

I run scans on my home IP from a Linode account [virtual Linux box on a cloud service]. Any VPS that doesn't filter your outbound traffic should work (just make sure it doesn't violate your TOS).

First run a full scan against your home IP address. Expect to find only the ports you know you have explicitly opened open. Expect everything else to be "filtered".

Then verify that it is your home router that is performing the filtering and not your ISP. To do this, open a port on your router and rerun the scan. Expect that the port you have opened is detected as open by your scanner. If you find that you still see this port as filtered, then your ISP may be blocking that port. If so, this isn't necessarily a problem, but it means that the previous test didn't test your router, it tested the network connection to your router. Don't forget to disable the port when you're done.

If you want to test your router in isolation, and your router isn't built in to the modem, then you can test it as follows:

1. Disconnect the router from your modem. (Where "modem" is whatever device connects from your LAN to your ISP's network.)
   
   
2. Connect a second computer to the WAN port on the router. Configure this computer with a static IP address that is independent of the LAN addresses used by your router.
   
   
3. You may need to turn on a DHCP server on the second computer so that the router's WAN interface gets an IP address as usual.
   
   
4. Perform the scans described above from the second computer.
   
   

nmap -F 192.168.0.1

# increase verbosity level, aggressive scan, no ping / skip discovery,
# open ports, show reason it's open, probe for service version info,
# use default script, do all ports, address 192.168.0.1
nmap -v -A -Pn --open --reason -sV -sC -p 1-65535 192.168.0.1

# increase verbosity level, no ping / skip discovery,
# open ports, UDP scan, max delay 50ms between probes,
# no retries, do all ports, address 192.168.0.1
sudo nmap -v -Pn --open -sU --max-scan-delay 50ms --max-retries 0 -p 1-65535 192.168.0.1

ftp -v 192.168.0.1
ssh -v admin@192.168.0.1
ssh -v root@192.168.0.1
ssh -v Root@192.168.0.1
telnet 192.168.0.1

# not sure these are right, I have IPv6 disabled so I can't test them !

# IPv6, increase verbosity level, aggressive scan, no ping / skip discovery,
# open ports, show reason it's open, no DNS resolution, probe for service version info,
# use default script, do all ports, address ::1
nmap -6 -v -A -Pn --open --reason -n -sV -sC -p 1-65535 ::1

# IPv6, increase verbosity level, no ping / skip discovery,
# open ports, UDP scan, max delay 50ms between probes,
# no retries, no DNS resolution, do all ports, address ::1
sudo nmap -6 -v -Pn --open -sU --max-scan-delay 50ms --max-retries 0 -n -p 1-65535 ::1

• Fing
• Network Analyzer
• Network Scanner from First Row
• PingTools Network Utilities
• Priya James's "Converting Your Android Smartphone into Penetration Testing Device" (root the phone and use NMAP, Bettercap, Setoolkit)
• Vamsi Krishna's "5 of the Best Hacking Apps on Android"
• dSploit (InfoSec Institute's "Transforming your Android Phone into a Network Pentesting Device") (free trial)

• OpenVAS (article1, article2)
  But I tried to install OpenVAS 9 on my normal Mint desktop and failed; see OpenVAS section of Bug-Bounty page.
  
  
• Nmap (but definitely start with the Zenmap GUI front-end for it).
  Hacker Target's "Nmap Tutorial"
  Unixmen's "Scan Your Home Network With Nmap"
  You could do a scan with nmap every month or two, save the results, use ndiff to compare them to see if anything has changed.
  
  
• netdiscover (Linux).
  Let "sudo netdiscover" run for a good long time; sometimes it finds things outside 192.168.n.n.
  Try with and without VPN running.
  
  
• arping
  
  

• threat9's "routersploit" (Linux or OSX)
  
  Null Byte's "Seize Control of a Router with RouterSploit "
  Kevin Mark's "RouterSploit Framework"
  
  I installed RouterSploit on Linux Mint 19.1 in 2/2019:

  
  
  sudo apt update
  sudo apt install python3-pip
  sudo apt install python3-setuptools
  
  cd ~
  git clone https://github.com/threat9/routersploit
  cd routersploit
  sudo python3 -m pip install -r requirements.txt
  
  cd ~/routersploit
  python3 rsf.py
  # see "rsf >" prompt
  
  show all
  
  use scanners/autopwn
  # get "rsf (Autopwn) >" prompt
  show options
  # I'm on a machine on the LAN, testing router from LAN side
  set target 19.168.0.1
  set threads 1
  
  run
  # takes a surprisingly long time to check each vuln
  # it's taking 15 to 60 seconds per vuln
  # it starts with a few generic SSL/TLS vulns
  # it's checking vulns for all router brands
  # most "not vulnerable"; a few "Could not be verified"
  # testing doesn't slow down normal traffic through router
  # it also checked some vulns for webcams
  # took more than 1 hour to check vulns
  
  # then it started checking for default credentials
  # checking about 12 items took about 5 minutes
  
  # no vulns or default creds found
  
  # if it finds a vulnerability, choose that exploit
  use exploits/routers/whatever
  show options
  set target 19.168.0.1
  check
  # if you want to exploit
  run
  

  
  
  
• Router Scan (Windows)
  
  
• Flan Scan
  Runs nmap and then looks up known vulnerabilities for your services.
  "The only way to install Flan Scan is by using a Docker container or in Kubernetes."
  Nadin El-Yabroudi's "Introducing Flan Scan: Cloudflare's Lightweight Network Vulnerability Scanner"
  SecurityTrails' "Flan Scan - The New Vulnerability Scanner from Cloudflare"
  
  
• SPARTA.
  Mostly for testing a web-app server; most features wasted if you're not running at least a web-server.
  SPARTA
  WonderHowTo's "Discover & Attack Services on Web Apps or Networks with Sparta"
  
  
• Legion.
  A fork of Sparta.
  Linux-only.
  Mostly for testing a web-app server; most features wasted if you're not running at least a web-server.
  Legion
  GoVanguard / legion
  
  
• Osmedeus.
  Mostly for testing a web-app server; most features wasted if you're not running at least a web-server.
  j3ssie / Osmedeus