1. Project Overview

Kscan is a pure Go-developed all-round scanner, with port scanning, protocol detection, fingerprint recognition, and brute-force cracking functions. It supports over 1200 protocols, 10,000+ protocol fingerprints, and 2,000+ application fingerprints, as well as 10+ brute-force cracking protocols.

2. Open Source License

Licensed under GPL-3.0

0 Disclaimer (The Author Has Not Participated in XX Actions, Don't Go Back)

• This tool is only intended for legitimate enterprise security construction behavior and personal learning behavior. If you need to test the availability of this tool, please set up a target environment yourself.
• When using this tool for detection, you should ensure that the behavior complies with local laws and regulations and has obtained sufficient authorization. Do not scan unauthorized targets.

If you find the above prohibited behavior, we reserve the right to pursue your legal liability.

If you engage in any illegal behavior during the use of this tool, you shall bear the corresponding consequences yourself, and we shall not bear any legal or joint liability.

Before installing and using this tool, please carefully read, fully understand, and agree to all the terms and conditions.

Unless you have fully read, completely understood, and accepted all the terms and conditions of this agreement, please do not install and use this tool. Your use behavior or any other explicit or implicit indication of acceptance of this agreement shall be deemed as your acceptance of the binding terms and conditions of this agreement.

3. Screenshots

Demonstration

3.1 Port Scanning Mode

3.2 Alive Segment Detection

3.3 Fofa Result Retrieval

3.4 Brute-Force Cracking

3.5 CDN Detection and Geographic Location Identification

4. Feature Overview

Written in Advance

Currently, there are already many tools for asset scanning, fingerprint recognition, and vulnerability detection, and some of them are very good. However, Kscan has many different ideas.

• Kscan hopes to accept multiple input formats without categorizing the scanning objects in advance, such as distinguishing between IP addresses and URL addresses. This will undoubtedly increase the workload for users. All entries can be normally input and recognized. If it is a URL address, the path will be preserved for detection. If it is only an IP:PORT, the protocol will be identified first. Currently, Kscan supports three input methods (-t,--target|-f,--fofa|--spy).
• Kscan does not pursue efficiency by comparing port numbers with common protocols to confirm port protocols, nor does it only detect web assets. In this regard, Kscan attaches more importance to accuracy and comprehensiveness. Only high-accuracy protocol recognition can provide good detection conditions for subsequent application-layer recognition.
• Kscan is not implemented in a modular way to stack simple functions, such as a module to get the title separately, a module to get SMB information separately, and so on, and run independently and output independently. Instead, Kscan outputs asset information based on ports, such as HTTP protocol, which will automatically perform subsequent fingerprint recognition, title acquisition, and so on.

5. Tech Stack

Compilation Manual

Compilation Manual Refer to README.md Document.

4 Start

Kscan currently supports three types of input targets

• -t/--target can add --check parameter, which will only perform fingerprint recognition on the specified target port. Otherwise, it will perform port scanning and fingerprint recognition on the target.

IP address: 114.114.114.114
IP address range: 114.114.114.114-115.115.115.115
URL address: https://www.baidu.com
file address: file:/tmp/target.txt

• --spy can be added with --scan parameter to perform port scanning and fingerprint identification on live C segments, otherwise only detect live network segments

[empty]: detect local machine IP address and scan local machine IP B segment
[all]: scan all private addresses (192.168/172.32/10 etc.)
IP address: scan B segment of specified IP address

• -f/--fofa can be added with --check to verify the liveliness of search results, add --scan parameter to perform port scanning and fingerprint identification on search results, otherwise only return fofa search results

fofa search keyword: return fofa search results directly

5. Usage method

usage: kscan [-h,--help,--fofa-syntax] (-t,--target,-f,--fofa,--touch,--spy) [-p,--port|--top] [-o,--output] [-oJ] [--proxy] [--threads] [--path] [--host] [--timeout] [-Pn] [-Cn] [-sV] [--check] [--encoding] [--hydra] [hydra options] [fofa options]

optional arguments:
  -h, --help     show this help message and exit
  -f, --fofa     get detection objects from fofa, need to configure environment variables: FOFA_EMAIL, FOFA_KEY
  -t, --target   specify the target to be detected:
                  IP address: 114.114.114.114
                  IP address segment: 114.114.114.114/24, not recommended for subnet mask less than 12
                  IP address segment: 114.114.114.114-115.115.115.115
                  URL address: https://www.baidu.com
                  file address: file:/tmp/target.txt
  --spy           subnet detection mode, this mode will automatically detect the internal subnet that can receive parameters:
                  (empty), 192, 10, 172, all, or specify an IP address (will detect the B segment of the specified IP address)
  --check         identify the target address by fingerprint, without performing port scanning
  --scan          scan the target objects provided by --fofa and --spy, and perform port scanning and fingerprint identification
  --touch         get the response package of the specified port, can be used to get the response package and improve the fingerprint library, format: IP:PORT
  -p, --port     scan the specified port, default will scan TOP400, support: 80, 8080, 8088-8090
  -o, --output   save the scanning results to a file
  -oJ             save the scanning results in JSON format to a file
  -Pn          	  do not perform intelligent survival detection when using this parameter, now intelligent survival detection is enabled by default, which improves efficiency
  -Cn             do not display colored output in the console
  -Dn             close CDN recognition function
  -sV             perform full probe detection on all ports, this parameter has a significant impact on efficiency, use with caution!
  --top           scan the top X common ports after filtering, maximum support 1000, default is TOP400
  --proxy         set the proxy (socks5|socks4|https|http)://IP:Port
  --threads       thread parameter, default is 100, maximum value is 2048
  --path          specify the directory to be accessed, only supports a single directory
  --host          specify the Host value for all requests
  --timeout       set the timeout time
  --encoding      set the terminal output encoding, can be specified as: gb2312, utf-8
  --match         search for assets returned by banner, only display if the keyword exists, otherwise do not display
  --hydra         automatic password cracking support protocols: ssh, rdp, ftp, smb, mysql, mssql, oracle, postgresql, mongodb, redis, default will enable all

hydra options:
   --hydra-user   custom hydra password cracking username: username or user1,user2 or file:username.txt
   --hydra-pass   custom hydra password cracking password: password or pass1,pass2 or file:password.txt
                  if the password contains commas, use \, to escape, other symbols do not need to be escaped
   --hydra-update custom username and password mode, if this parameter is carried, it will be added to the default dictionary, otherwise it will replace the default dictionary
   --hydra-mod    specify the automatic password cracking module: rdp or rdp, ssh, smb

fofa options:
   --fofa-syntax  get fofa search syntax explanation
   --fofa-size    set the number of fofa returned entries, default is 100
   --fofa-fix-keyword modify keyword, the {} in this parameter will be replaced by the value of the -f parameter

Functionality is not complex, please explore other features by yourself

Special thanks

• EdgeSecurityTeam
• bufferfly
• EHole (Corner Hole)
• NMAP
• grdp
• fscan
• dismap
• nali