魔改版内网扫描工具

XScan使用文档

前言

这是一个缝合怪

● go-crack

● fscan 

● zscan 

● kscan

参数说明

__   __      _____\ \ / /     /  ___|\ V /______\ `--.  ___ __ _ _ __/   \______|`--. \/ __/ _` | '_ \/ /^\ \     /\__/ / (_| (_| | | | |\/   \/     \____/ \___\__,_|_| |_|
Version 1.0Design By XTeam
Host is noneUsage of ./Xscan-Mac:-addr strings5|http server addr (default "0.0.0.0:50000")-debugopen debug mode-domain stringrootkit.org-fingerScab Web Finger-h stringIP ADDR: 10.0.0.1,10.0.0.5-10,192.168.1.*,192.168.10.1/24-hf string-hf ip.txt-http-pass stringHttpPassword (default "qax")-http-user stringHttpUsername (default "qax")-httpdir stringhttp directory (default ".")-m string-m portscan|-m ssh|-m all|-m title (default "all")-nopingno ping-o stringScan OutPutFile (default "result.txt")-p stringPorts: 22,443|1-65535|3389 (default "21,22,23,80,81,88,135,139,468,443,445,1433,1523,3306,5432,7001,8001,8000,8080,8089,9200,11211,27017,1080,1214,13306,5000,5222,5900,5938,5984,6000,6379,7000,7070,8888,8088,8090,8222,8443,8545,8686,9000,9180,9200,9418,9999,10000,11115,8448,8484,8848,10183,15778,19313,8008,8009,8890,8891")-pass stringcrack password-passfile stringpassword file-pingusing ping replace icmp-poc string-poc weblogic,shiro-pocscanproxy string-proxy http://127.0.0.1:8080-pocthread intpoc rate (default 20)-proxy stringvulnscan proxy-redisfile string-redisfile id_rsa.pub-redisshell string-redisshell 192.168.1.1:6666-shiroScan Shiro-skipportscanSkip Port Scan-Scan Web Title-socks5-pass stringSocks5Password (default "qax")-socks5-user stringSocks5Username (default "qax")-sshcmd stringexec ssh cmd-t intThread nums (default 20)-timeout intscan timeout (default 10)-urlfile stringurl list-user stringcrack username-userfile stringusername file-vulnscanScan for web vulnerabilities(True|False)-webtimeout intwebscan timeout (default 20)-xscan string XScan Start password!

快速上手

默认扫描 

指纹+shiro+漏扫

./xscan -h 192.168.123.22/24,192.168.123.1-255,192.168.122.1-192.168.123.254 -finger -vulnscan -shiro -xscan 360 -t 100
./xscan -hf ip.txt -finger -vulnscan -xscan 360 -t 100

指定密码

./xscan -h 192.168.123.22/24,192.168.123.1-255,192.168.122.1-192.168.123.254 -finger -vulnscan -xscan 360 -t 100 -user admin,root -pass 123456,root
./xscan -h 192.168.123.22/24,192.168.123.1-255,192.168.122.1-192.168.123.254 -finger -vulnscan -xscan 360 -t 100 -userfile user.txt -passfile pass.txt

指定模块

./xscan -h 192.168.123.22/24,192.168.123.1-255,192.168.122.1-192.168.123.254 -finger -vulnscan -xscan 360 -t 100 -m Web

-m参数指定模块只能选择一个,默认All

All 所有模块All InWeb 核心功能，可以扫描title和指纹以及shiroMS17010 SSHSMBMSSQLMYSQLFINDNET REDISServerScanurlscan

Spy模块

进入大内网以后,支持探测指定网段存活(ping .1和.255)

./xscan -h 192.168.123.22/24,192.168.123.1-255,192.168.122.1-192.168.123.254 -finger -vulnscan -xscan 360 -t 100 -m Spy

Socks5模块

./Xscan-Mac -m socks5 ./Xscan-Mac -m socks5 -addr 0.0.0.0:6666 默认密码 qax qax

HTTP模块

./Xscan-Mac -m http -addr 0.0.0.0:6666默认密码 qax qax