hktalent/scan4all
Scan4all
scan4all is an all-in-one vulnerability scanner that orchestrates parallel network reconnaissance, service cracking, and exploit execution across a wide range of protocols. It combines port discovery, web fingerprinting, password cracking, and a plugin-based database of over 15,000 proof-of-concept exploits into a single automated pipeline, with results streamed to Elasticsearch for structured querying and analysis.
The tool distinguishes itself through its multi-engine orchestration, coordinating tools like nmap, naabu, and nuclei under one pipeline to avoid redundant work and share results. It manages a concurrent service cracking pool that attempts password brute-forcing across 23 protocols in parallel, while a protocol-aware fuzzing engine generates malformed payloads for 146 network protocols. The system also integrates with Metasploit for automated exploitation workflows and supports reverse shell operations for post-compromise access.
Additional capabilities include subdomain enumeration through a chained pipeline of subfinder and ksubdomain, web cache vulnerability detection for HTTP request smuggling and cache poisoning, and web endpoint fuzzing to uncover hidden resources. The project provides a comprehensive security assessment surface that combines network discovery, credential testing, and vulnerability scanning in a single tool.
Features
- Vulnerability Scanning - Combines port discovery, web fingerprinting, password cracking, and thousands of PoC exploits into a single automated pipeline.
- Multi-Protocol Brute Forcers - Attempts credential cracking across 23 network protocols using custom or built-in dictionaries.
- Port Scanning - Discovers open ports across 146 protocols using 90,000 detection rules and integrated engines like nmap and naabu.
- PoC-Based Scanners - Runs thousands of proof-of-concept exploits against targets to identify known security weaknesses.
- Security Tool Orchestrators - Coordinates nmap, naabu, and nuclei under a single pipeline to avoid redundant work and share results.
- Web Application Fingerprinters - Matches HTTP responses against a 7,000-entry rule set to identify frameworks, CMS, and server software in real time.
- Service Cracking Pools - Manages a concurrent worker pool that cracks passwords across 23 protocols in parallel.
- Exploit Plugin Databases - Loads over 15,000 proof-of-concept exploits as pluggable modules that can be individually updated.
- Subdomain Enumeration - Chains subfinder and ksubdomain in a producer-consumer pattern to discover subdomains for vulnerability scanning.
- Web Cache Poisoning - Checks for HTTP request smuggling and cache poisoning flaws that can compromise web caching infrastructure.
- Elasticsearch Exporters - Serialises all scan findings into structured JSON and pushes them to Elasticsearch for indexing.
- Metasploit Shell Integrations - Links scan results with Metasploit to automate exploitation workflows using tmux for session management.
- Protocol Fuzzing - Generates malformed payloads for 146 network protocols using a grammar-based rule set to discover unexpected behavior.
- Streaming Port Mappings - Feeds discovered open ports directly into service-specific crackers and fingerprinters without waiting for a full scan.
- Reverse Shells - Establishes reverse shell connections during engagements using a multi-target web netcat utility.
- Subdomain Discoveries - Discovers subdomains through dictionary brute-forcing and tool chaining to map additional entry points.
- Web Application Fuzzing - Tests web application endpoints with fuzzing techniques to uncover hidden resources and potential vulnerabilities.
- Vulnerability Scanners - Vulnerability scanner.
- Reconnaissance and Dorking - Execute large-scale vulnerability scanning and password cracking.
Star history
How this analysis was created: This summary and feature list are AI-generated from collected project material and can contain mistakes. Stars, license and language are imported from GitHub. Inclusion does not mean that we have tested or audited this project. Check the source documentation for any feature you depend on. Learn more on our About page.
