I think you should do the scans remotely and without credentials. That is how an attack would be carried out in the real world. As far as software there are lots of things that you can use, you...