scan

Documentation

Index

• func DialSCTP(ip string, port uint16) (net.Conn, error)
• func ResolveTargets(targets []plugins.Target, config Config) []plugins.Target
• func SCTPScan(ctx context.Context, targets []plugins.Target, config Config) ([]plugins.Service, error)
• func ScanTargets(ctx context.Context, targets []plugins.Target, config Config) ([]plugins.Service, error)
• func UDPScan(ctx context.Context, targets []plugins.Target, config Config) ([]plugins.Service, error)
• type Config
  • func (c *Config) DialTCP(target plugins.Target) (net.Conn, error)
  • func (c *Config) DialTLS(target plugins.Target) (net.Conn, error)
  • func (c *Config) DialUDP(target plugins.Target) (net.Conn, error)
  • func (c *Config) SCTPScanTarget(target plugins.Target) (*plugins.Service, error)
  • func (c *Config) SimpleScanTarget(target plugins.Target) ([]*plugins.Service, error)
  • func (c *Config) UDPScanTarget(target plugins.Target) (*plugins.Service, error)
• type HostLimiter
  • func NewHostLimiter(maxPerHost int) *HostLimiter
  • func (h *HostLimiter) Acquire(ctx context.Context, hostIP string) (func(), error)
  • func (h *HostLimiter) ActiveCount(hostIP string) int
• type ProgressCallback
• type ProxyDialer
  • func NewProxyDialer(config Config) (*ProxyDialer, error)
  • func (pd *ProxyDialer) DialContext(ctx context.Context, network, addr string) (net.Conn, error)
  • func (pd *ProxyDialer) DialTCP(host string, port uint16) (net.Conn, error)
  • func (pd *ProxyDialer) DialTLS(host string, port uint16, tlsConfig *tls.Config) (net.Conn, error)
  • func (pd *ProxyDialer) DialUDP(host string, port uint16) (net.Conn, error)
  • func (pd *ProxyDialer) GetHTTPTransport(tlsConfig *tls.Config) *http.Transport
• type ScanPool
  • func NewScanPool(config Config) *ScanPool
  • func (p *ScanPool) Run(ctx context.Context, targets []plugins.Target, fn scanFunc) ([]plugins.Service, error)
  • func (p *ScanPool) WithProgress(cb ProgressCallback) *ScanPool

Functions

func DialSCTP

func DialSCTP(ip string, port uint16) (net.Conn, error)

DialSCTP establishes an SCTP connection to the target. Linux-only: uses kernel SCTP via ishidawataru/sctp library.

func ResolveTargets

func ResolveTargets(targets []plugins.Target, config Config) []plugins.Target

ResolveTargets expands targets based on the DNSOrder strategy. For socks5h:// proxy scheme, always uses proxy-side DNS resolution.

func SCTPScan

func SCTPScan(ctx context.Context, targets []plugins.Target, config Config) ([]plugins.Service, error)

TODO: integrate SCTP/UDP scan paths with worker pool. Currently sequential because: 1. Different return types (*Service vs []*Service) need separate scanFunc adapters 2. Different transport semantics (kernel SCTP, connectionless UDP) 3. Rarely used at scale — primary parallelism benefit is TCP fingerprinting SCTPScan performs SCTP scanning on all targets.

func ScanTargets

func ScanTargets(ctx context.Context, targets []plugins.Target, config Config) ([]plugins.Service, error)

ScanTargets fingerprints service(s) running given a list of targets.

func UDPScan

func UDPScan(ctx context.Context, targets []plugins.Target, config Config) ([]plugins.Service, error)

UDPScan performs UDP scanning on all targets.

Types

type Config

type Config struct {
	// UDP scan
	UDP bool

	// SCTP scan (Linux only, falls back to error on other platforms)
	SCTP bool

	FastMode bool

	// The timeout specifies how long certain tasks should wait during the scanning process.
	// This may include the timeouts set on the handshake process and the time to wait for a response to return.
	DefaultTimeout time.Duration

	// Prints logging messages to stderr
	Verbose bool

	// Number of concurrent scan workers. Values <= 0 are treated as 1 (sequential).
	// The CLI defaults this to 50 via --workers.
	Workers int

	// Max concurrent connections per host IP (0 = unlimited)
	MaxHostConn int

	// Max scans per second globally (0 = unlimited)
	RateLimit float64

	// Proxy URL string (e.g. socks5://127.0.0.1:1080)
	Proxy string

	// ProxyAuth string for socks5 proxy authentication (username:password)
	ProxyAuth string

	// DNSOrder controls DNS resolution (p, l, lp, pl)
	DNSOrder string

	// Enable security misconfiguration detection
	Misconfigs bool

	// Enable deep probing (admin paths, login detection)
	Deep bool

	OnProgress ProgressCallback
}

func (*Config) DialTCP

func (c *Config) DialTCP(target plugins.Target) (net.Conn, error)

func (*Config) DialTLS

func (c *Config) DialTLS(target plugins.Target) (net.Conn, error)

func (*Config) DialUDP

func (c *Config) DialUDP(target plugins.Target) (net.Conn, error)

func (*Config) SCTPScanTarget

func (c *Config) SCTPScanTarget(target plugins.Target) (*plugins.Service, error)

SCTPScanTarget performs SCTP scanning of the target. On Linux: Full SCTP features via kernel module. On other platforms: Returns error (SCTP not supported).

func (*Config) SimpleScanTarget

func (c *Config) SimpleScanTarget(target plugins.Target) ([]*plugins.Service, error)

func (*Config) UDPScanTarget

func (c *Config) UDPScanTarget(target plugins.Target) (*plugins.Service, error)

UDP Scan of the target

type HostLimiter

type HostLimiter struct {
	// contains filtered or unexported fields
}

HostLimiter enforces per-host concurrency limits for scan connections.

func NewHostLimiter

func NewHostLimiter(maxPerHost int) *HostLimiter

NewHostLimiter creates a new HostLimiter with the given per-host limit.

func (*HostLimiter) Acquire

func (h *HostLimiter) Acquire(ctx context.Context, hostIP string) (func(), error)

Acquire blocks until a connection slot is available for hostIP or ctx is cancelled. Returns a release function that must be called when the connection is complete.

func (*HostLimiter) ActiveCount

func (h *HostLimiter) ActiveCount(hostIP string) int

ActiveCount returns the number of active connections to hostIP. Returns 0 if the host has never been used.

type ProgressCallback

type ProgressCallback func(target plugins.Target, results []plugins.Service, completedCount int64)

ProgressCallback is called after each target is scanned. Parameters: completed target, results for that target, total completed count. The callback is invoked from worker goroutines so it must be thread-safe.

type ProxyDialer

type ProxyDialer struct {
	// contains filtered or unexported fields
}

ProxyDialer centralizes proxy dialing logic to eliminate code duplication between DialTCP, DialTLS, and DialUDP methods.

func NewProxyDialer

func NewProxyDialer(config Config) (*ProxyDialer, error)

NewProxyDialer creates a ProxyDialer from a Config. Returns error for invalid proxy URLs or unsupported schemes.

func (*ProxyDialer) DialContext

func (pd *ProxyDialer) DialContext(ctx context.Context, network, addr string) (net.Conn, error)

DialContext performs context-aware dialing through the proxy.

func (*ProxyDialer) DialTCP

func (pd *ProxyDialer) DialTCP(host string, port uint16) (net.Conn, error)

DialTCP dials a TCP connection through the proxy. Handles DNS fallback based on dnsOrder configuration.

func (*ProxyDialer) DialTLS

func (pd *ProxyDialer) DialTLS(host string, port uint16, tlsConfig *tls.Config) (net.Conn, error)

DialTLS dials a TLS connection through the proxy. Wraps the TCP connection with TLS after connecting through proxy.

func (*ProxyDialer) DialUDP

func (pd *ProxyDialer) DialUDP(host string, port uint16) (net.Conn, error)

DialUDP dials a UDP connection through the proxy.

HTTP/HTTPS proxies cannot relay UDP (they only tunnel TCP via CONNECT), so this requires a socks5/socks5h proxy. Unlike DialTCP/DialTLS, this does not go through golang.org/x/net/proxy: that package's SOCKS5 client only implements the CONNECT command and rejects any non-TCP network before ever contacting the proxy (see golang.org/x/net/internal/socks.validateTarget), so it can never succeed here regardless of what the proxy supports. dialSOCKS5UDP performs the UDP ASSOCIATE handshake directly instead.

func (*ProxyDialer) GetHTTPTransport

func (pd *ProxyDialer) GetHTTPTransport(tlsConfig *tls.Config) *http.Transport

GetHTTPTransport returns an http.Transport configured to use the proxy. This is useful for HTTP clients that need to route through the proxy.

type ScanPool

type ScanPool struct {
	// contains filtered or unexported fields
}

ScanPool manages a pool of workers that concurrently scan targets.

func NewScanPool

func NewScanPool(config Config) *ScanPool

NewScanPool constructs a ScanPool from the provided Config.

func (*ScanPool) Run

func (p *ScanPool) Run(ctx context.Context, targets []plugins.Target, fn scanFunc) ([]plugins.Service, error)

Run distributes targets across workers, collects results, and returns all discovered services. It returns immediately with nil, nil if targets is empty.

func (*ScanPool) WithProgress

func (p *ScanPool) WithProgress(cb ProgressCallback) *ScanPool

WithProgress sets a callback to be invoked after each target is scanned. The callback is invoked from worker goroutines so it must be thread-safe.