JF⚡can - Super fast port scanning & service discovery using Masscan and Nmap. Scan large networks with Masscan and use Nmap's scripting abilities to discover information about services. Generate report.

Overview

logo GitHub GitHub release (latest by date) Rating Code style: black

Description

Killing features

  • Perform a large-scale scans using Nmap! Allows you to use Masscan to scan targets and execute Nmap on detected ports with custom settings. Nmap on steroids. *
  • Scans targets in variety of formats, including domain names!
  • Results can be produced in domain:port format.
  • It works in stdin/stdout mode, allowing you to stream results to/from other tools.
  • Auto-adjusts a packet rate for masscan so you don't have to (disable it by --disable-auto-rate).
  • Produces a standard Nmap XML report.
  • Fully supports IPv6.
  • Supports scope control, only targets defined in scope will be scanned.

The JFScan (Just Fu*king Scan) is a wrapper around a super-fast port scanner Masscan. It's designed to simplify work when scanning for open ports on targets in a variety of formats. The JFScan accepts a target in the following forms: URL, domain, or IP (including CIDR). You can specify a file with targets using argument or use stdin.

The JFScan also allows you to output only the results and chain it with other tools like Nuclei. The domain:port output of JFScan is crucial if you want to discover vulnerabilities in web applications as the virtual host decides which content will be served.

Finally, it can scan discovered ports with Nmap. You can also define custom options and use Nmap's amazing scripting capabilities.

nmap usage2

JFScans logic of input & output processing:

diagram

Usage

usage: jfscan [-h] [--targets TARGETS] (-p PORTS | --top-ports TOP_PORTS | --yummy-ports) [--resolvers RESOLVERS] [--enable-ipv6] [--scope SCOPE] [-r MAX_RATE] [--wait WAIT] [--disable-auto-rate] [-i INTERFACE] [--source-ip SOURCE_IP]
              [--router-ip ROUTER_IP] [--router-mac ROUTER_MAC] [--router-mac-ipv6 ROUTER_MAC_IPV6] [-oi] [-od] [-o OUTPUT] [-q | -v] [--nmap] [--nmap-options NMAP_OPTIONS] [--nmap-threads NMAP_THREADS] [--nmap-output NMAP_OUTPUT] [--version]
              [target]

JFScan - Just Fu*king Scan

optional arguments:
  -h, --help            show this help message and exit
  -p PORTS, --ports PORTS
                        ports, can be a range or port list: 0-65535 or 22,80,100-500,...
  --top-ports TOP_PORTS
                        scan only N of the top ports, e. g., --top-ports 1000
  --yummy-ports         scan only for the most yummy ports
  -q, --quite           output only results
  -v, --verbose         verbose output

  --nmap                run nmap on discovered ports
  --nmap-options NMAP_OPTIONS
                        nmap arguments, e. g., --nmap-options='-sV' or --nmap-options='-sV --script ssh-auth-methods'
  --nmap-threads NMAP_THREADS
                        number of nmaps to run concurrently, default 8
  --nmap-output NMAP_OUTPUT
                        output results from nmap to specified file in standard XML format (same as nmap option -oX)

  target                a target or targets separated by a comma, accepted form is: domain name, IPv4, IPv6, URL
  --targets TARGETS     file with targets, accepted form is: domain name, IPv4, IPv6, URL

  -oi, --only-ips       output only IP adresses, default: all resources
  -od, --only-domains   output only domains, default: all resources
  -o OUTPUT, --output OUTPUT
                        output masscan's results to specified file

  --resolvers RESOLVERS
                        custom resolvers separated by a comma, e. g., 8.8.8.8,1.1.1.1
  --enable-ipv6         enable IPv6 support, otherwise all IPv6 addresses will be ignored in the scanning process
  --scope SCOPE         file path with IP adresses and CIDRs to control scope, expected format: IPv6, IPv4, IPv6 CIDR, IPv4 CIDR
  -r MAX_RATE, --max-rate MAX_RATE
                        max kpps rate for the masscan
  --wait WAIT           a number of seconds to wait for packets to arrive (when scanning large networks), option for the masscan
  --disable-auto-rate   disable rate adjustment mechanism for masscan (more false positives/negatives)
  -i INTERFACE, --interface INTERFACE
                        interface for masscan and nmap to use
  --source-ip SOURCE_IP
                        IP address of your interface for the masscan
  --router-ip ROUTER_IP
                        IP address of your router for the masscan
  --router-mac ROUTER_MAC
                        MAC address of your router for the masscan
  --router-mac-ipv6 ROUTER_MAC_IPV6
                        MAC address of your IPv6 router for the masscan

  --version             show program's version number and exit

Please follow installation instructions before running. Do not run the JFScan under a root, it's not needed since we set a special permissions on the masscan binary.

Example

Scan targets for only for ports 80 and 443 with rate of 10 kpps:

$ jfscan -p 80,443 --targets targets.txt -r 10000

Scan targets for top 1000 ports :

$ jfscan --top-ports 1000 1.1.1.1/24

You can also specify targets on stdin and pipe it to nuclei:

$ cat targets.txt | jfscan --top-ports 1000 -q | httpx -silent | nuclei

Or as positional parameter:

$ jfscan --top-ports 1000 1.1.1.1/24 -q | httpx -silent | nuclei

Or everything at once, the JFScan just does not care and scans all the targets specified:

$ echo target1 | jfscan --top-ports 1000 target2 --targets targets.txt -q | httpx -silent | nuclei

Utilize nmap to gather more info about discovered services:

$ cat targets.txt | jfscan -p 0-65535 --nmap --nmap-options="-sV --scripts ssh-auth-methods"

The targets.txt can contain targets in the following forms (IPv6 similarly):

http://domain.com/
domain.com
1.2.3.4
1.2.3.0/24
1.1.1.1-1.1.1.30

Installation

  1. Before installation, make sure you have the latest version of Masscan installed (tested version is 1.3.2).

First, install a libpcap-dev (Debian based distro) or libcap-devel (Centos based distro):

sudo apt install libpcap-dev

Next, clone the official repository and install:

sudo apt-get --assume-yes install git make gcc
git clone https://github.com/robertdavidgraham/masscan
cd masscan
make
sudo make install
  1. The Masscan requires root permissions to run. Since running binaries under root is not good idea, we will set a CAP_NET_RAW capability to the binary:
sudo setcap CAP_NET_RAW+ep /usr/bin/masscan
  1. For installation of JFscan a python3 and pip3 is required.
sudo apt install python3 python3-pip
  1. Install JFScan:
$ git clone https://github.com/nullt3r/jfscan.git
$ cd jfscan
$ pip3 install .

If you can't run the jfscan directly from command line you should check if $HOME/.local/bin is in your path.

Add the following line to your ~/.zshrc or ~/.bashrc:

export PATH="$HOME/.local/bin:$PATH"

License

Read file LICENSE.

Disclaimer

I am not responsible for any damages. You are responsible for your own actions. Attacking targets without prior mutual consent is illegal.


* When scanning smaller network ranges, you can just use nmap directly, there is no need to use JFScan. You can reach up to 70% of the speed of JFScan using the following options:

nmap -Pn -n -v yourTargetNetwork/26 -p- --min-parallelism 64 --min-rate 20000 --min-hostgroup 64 --randomize-hosts -sS -sV

As always, expect some false positivies/negatives.

Comments
  • -i flag not working under VPN environment

    -i flag not working under VPN environment

    Hi, i'm playing hackthebox.eu and i need to do port scanning with specific utun4 interface which is openvpn config given by them to scan local machine. But it doesn't work as expected rather than running masscan itself.

    Scanning with jfscan image

    Scanning with masscan image

    bug 
    opened by meichengg 7
  • The flag `--nmap-options='-sV'` crashes the tool.

    The flag `--nmap-options='-sV'` crashes the tool.

    The tool crashes when --nmap-options flag is used. I'm using Python 3.10 and latest nmap, masscan from github.

    /scripts/jfscan# jfscan --top-ports 1000 --nmap --nmap-options='-sV' 123.123.123.0/24
    usage: jfscan [-h] [--targets TARGETS] (-p PORTS | --top-ports TOP_PORTS | --yummy-ports) [--resolvers RESOLVERS] [--enable-ipv6] [--scope SCOPE] [-r MAX_RATE] [--wait WAIT] [--disable-auto-rate] [-i INTERFACE]
                  [--source-ip SOURCE_IP] [--router-ip ROUTER_IP] [--router-mac ROUTER_MAC] [--router-mac-ipv6 ROUTER_MAC_IPV6] [-oi] [-od] [-o OUTPUT] [-q | -v] [--nmap] [--nmap-options NMAP_OPTIONS]
                  [--nmap-threads NMAP_THREADS] [--nmap-output NMAP_OUTPUT] [--version]
                  [target]
    jfscan: error: incorrect nmap options: 
    Segmentation fault
    
    /scripts/jfscan# 
    
    opened by its0x08 4
  • Error instalation

    Error instalation

    Hello,

    when I'm installing (pip3 install . ) fail, I have this error:

    Building wheels for collected packages: jfscan
      Building wheel for jfscan (setup.py) ... error
      error: subprocess-exited-with-error
      
      × python setup.py bdist_wheel did not run successfully.
      │ exit code: 1
      ╰─> [10 lines of output]
          running bdist_wheel
          running build
          running build_py
          /usr/local/lib/python3.9/dist-packages/setuptools/command/install.py:34: SetuptoolsDeprecationWarning: setup.py install is deprecated. Use build and pip and other standards-based tools.
            warnings.warn(
          installing to build/bdist.linux-x86_64/wheel
          running install
          running install_lib
          creating build/bdist.linux-x86_64/wheel
          error: could not create 'build/bdist.linux-x86_64/wheel': Permission denied
          [end of output]
      
      note: This error originates from a subprocess, and is likely not a problem with pip.
      ERROR: Failed building wheel for jfscan
      Running setup.py clean for jfscan
    Failed to build jfscan
    
    

    I have installed all dependencies and the versión of jfscan is 1.3.1 and my version of SO is Debian 5.16.18-1

    A greeting and thanks

    question 
    opened by tXambe 3
  • Show found ports while scanning

    Show found ports while scanning

    Hi, i would like to see found ports while on scanning instead of waiting masscan finishs its progress. Is there any workaround?

    For example, after getting many active ports, i want to cancel the progress and get the ports had been found.

    image

    enhancement 
    opened by meichengg 2
  • Ability to check for firewalls

    Ability to check for firewalls

    I sometimes face with firewalls on some specific servers or IP ranges. For example, when i scan a range /22, only a few IPs behind a firewall, they detect the packets that masscan sends and shows that all 65535 ports are open, is there any way to detect or skip if which IP is actual behind a firewall like my situation? Thanks.

    image

    opened by meichengg 1
Releases(1.6.2)
Owner
Redteamer & pentester, working for corporates. Breaks stuff most of the time.
Some files casually made by @AneekBiswas

Python-Tools All Pyhthon Files are created and managed by @AneekBiswas Modules needed to be downloaded 1.CLI bagels.py random guess.py random text-tow

1 Feb 23, 2022
Nautobot is a Network Source of Truth and Network Automation Platform.

Nautobot is a Network Source of Truth and Network Automation Platform. Nautobot was initially developed as a fork of NetBox (v2.10.4). Nautobot runs as a web application atop the Django Python framew

Nautobot 549 Dec 31, 2022
EchoDNS - Analyze your DNS traffic super easy, shows all requested DNS traffic

EchoDNS - Analyze your DNS traffic super easy, shows all requested DNS traffic

Oli Zimmermann 1 Jan 11, 2022
A light-weight open-source project CLI utility for showing services running on ports in a host

Portable Port Scanner (ppscanner) Portable Port Scanner (ppscanner) is a light-weight open-source CLI utility that leverages on nmap to make quick and

1 Oct 30, 2021
Network Engineer's Unified Realtime Automation Library

NEURAL is the premiere CLI jockey replacement full stack web/app/database network automation application, providing a "no-code" web app for network engineers developed by a network engineer!

Brett M Spunt 3 Aug 15, 2022
Way find out if DNS is down or your instance

DNS-PING Way to find out if DNS is down or your instance Problem: At times it happens that DNS provider services of a website URL is down and so to re

Giten Mitra 4 Nov 18, 2022
Monitoring plugin to check network interfaces with Icinga, Nagios and other compatible monitoring solutions

check_network_interface - Monitor network interfaces This is a monitoring plugin for Icinga, Nagios and other compatible monitoring solutions to check

DinoTools 3 Nov 15, 2022
Timeouts for popular Python packages

Python Timeouts An unresponsive service can be worse than a down one. It can tie up your entire system if not handled properly. All network requests s

Andrew Kane 11 Nov 22, 2022
Simple client for the Sirah Matisse Commander TCP server.

Simple client for the Sirah Matisse Commander TCP server.

Nelson Darkwah Oppong 1 Nov 02, 2021
A benchmark for stateful fuzzing of network protocols

A benchmark for stateful fuzzing of network protocols

3 Apr 25, 2022
TLD records archive. Revisiting the original TLDR project by mandatoryprogrammer, on the hunt for more root nameserver changes.

tldr A(nother) continuously updated historical TLD records archive. This repository is updated approximately every three hours with the results from D

Chris Partridge 11 Dec 14, 2022
A TCP Chatroom built with python and TCP/IP sockets, consisting of a server and multiple clients which can connect with the server and chat with each other.

A TCP Chatroom built with python and TCP/IP sockets, consisting of a server and multiple clients which can connect with the server and chat with each other. It also provides an Admin role with featur

3 May 22, 2022
A network address manipulation library for Python

netaddr A system-independent network address manipulation library for Python 2.7 and 3.5+. (Python 2.7 and 3.5 support is deprecated). Provides suppor

711 Jan 05, 2023
An automatic web reconnaissance tool written in python3.

WebRecon is an automatic web reconnaissance tool written in python3. Provides a command line interaction similar to msfconsole. The Exasmple.py file is provided, and you can write your own scripts yo

prophet 1 Feb 06, 2022
PySocks lets you send traffic through SOCKS proxy servers.

PySocks lets you send traffic through SOCKS proxy servers. It is a modern fork of SocksiPy with bug fixes and extra features. Acts as a drop-i

1.1k Dec 07, 2022
A python 3 library which helps in using nmap port scanner.

A python 3 library which helps in using nmap port scanner. This is done by converting each nmap command into a callable python3 method or function. System administrators can now automatic nmap scans

Nmmapper 179 Dec 19, 2022
A Python script that alerts via SMS when a stock is reaching an inflection point

TradeAlert Not sure what this will ultimately become, but for now, its a Python script that alerts via SMS when a stock is reaching an inflection poin

3 Feb 22, 2022
A database-based CDN node supporting PostgreSQL and MongoDB backends.

A simple to use database-based deployable CDN node for hobbyist developers who wish to have their own CDN!

Vish M 10 Nov 19, 2022
Socket Based Backdoor and Listener

The Project is mainly based on Sockets , File Handling and subprocess library for Creating backdoors For Hacking into one's Computer (Any OS-Platform Service) and listening on your computer and waiti

Shivansh Mehta 3 May 31, 2021
A simple tcpdump sidecar injector to demonstrate Kubernetes's Mutating Webhook

k8s-tcpdump-webhook A simple tcpdump sidecar injector to demonstrate Kubernetes's Mutating Webhook Build and Deploy Build docker image; docker build -

Bilal Ünal 2 Sep 01, 2022