[Security Tool Vol. 1] Kscan — High-Performance Golang Security Scanner

Introduction#

This security-tools series selects useful, approachable open-source tools and provides quick practical guides. Use this tool only with explicit authorization or in a lab environment. Unauthorized security testing may violate the law; use it at your own risk.

TL;DR#

Kscan is a lightweight security scanner written in Go. It supports port scanning, fingerprinting, automated brute force, and subnet discovery, with CSV/JSON output. It is suitable for rapid asset discovery and weak-password auditing (authorized scenarios only).

About Kscan#

Kscan is a Golang scanner focused on high concurrency and lightweight operation. Common uses include asset discovery, HTTP fingerprinting, external-service liveness checks, and automated password testing based on hydra. Results can be exported as CSV/JSON for delivery or further processing.

Feature Overview#

• Port scanning (single port / range / Top N)
• Fingerprinting (HTTP banner / service fingerprint)
• Live-subnet discovery (--spy)
• Automated brute force (hydra integration, multiple protocols)
• CSV / JSON output

Quick Installation (Example)#

Assumes that Go is already installed.

1
git clone https://github.com/lcvvvv/kscan.git
2
cd kscan
3
go build -o kscan ./cmd/kscan
4
# Or use the release binary provided by the author.

Command Reference#

Common options and brief explanations are listed below:

1
usage: kscan [-h,--help,--fofa-syntax] (-t,--target,-f,--fofa,--spy) [options]
2

3
Common options:
4
  -t, --target    target: single IP, range, URL, or file (file:/path)
5
  -f, --fofa      obtain targets from FOFA (requires FOFA_EMAIL and FOFA_KEY)
6
  --spy           subnet-discovery mode (automatically discover internal subnets)
7
  -p, --port      port or port range, default Top400
8
  -o, --output    save results to a file (CSV supported)
9
  -oJ             save results as JSON
10
  --proxy         use a proxy (socks5|socks4|http|https)://IP:Port
11
  --threads       thread count, default 100, maximum 2048
12
  --timeout       timeout in seconds
13
  --hydra         enable automated brute force (with --hydra-user/--hydra-pass)
14
  -Pn             skip smart liveness detection (slower but more exhaustive)
15
  -sV             full-probe open ports (may affect performance; use carefully)

hydra options:

1
  --hydra-user    username (supports file:username.txt)
2
  --hydra-pass    password (supports file:password.txt)
3
  --hydra-update  append a custom wordlist to the default list
4
  --hydra-mod     limit the brute-force module, e.g. rdp, ssh, ftp

Common Examples (Recommended Forms with Explanations)#

Asset mapping (all ports, save results as CSV):

1
kscan -t targets.txt -p 1-65535 -o output.csv

Credential testing (use a custom wordlist and append it to the default list):

1
kscan -t targets.txt -p 1-65535 --hydra --hydra-user file:user.txt --hydra-pass file:pass.txt --hydra-update -o output.csv

Subnet reachability discovery (automatically probe standard Class A/B/C private ranges):

1
kscan --spy all -o output.csv

Fast high-concurrency discovery:

1
kscan -t 198.51.100.0/24 -p 80,443 --threads 500 -oJ output.json

Usage Recommendations and Performance Tuning#

• Concurrency and resources: high concurrency (--threads) greatly improves speed but consumes more bandwidth and target/local resources. Increase it gradually while monitoring CPU and network; use the maximum carefully.
• Timeouts: increase --timeout for unstable networks to avoid misclassifying live hosts.
• Avoid false positives: test --check against a small number of targets first, observe responses, then run it in bulk.
• Brute-force strategy: test weak passwords only within an authorized scope. Control the rate and limit the module with --hydra-mod to avoid alerts or account lockouts.
• Result processing: export JSON and combine it with tools such as ELK or Pandas for aggregation and visualization.

Frequently Asked Questions (FAQ)#

Q: How do I scan only common ports? A: Use --top, for example --top 100 to scan the top 100 common ports.

Q: How do I disable CDN detection? A: Add -Dn (disabling it may affect the efficiency of large-scale scans).

Q: How can I improve web-fingerprint accuracy? A: Use -sV for full probing. It significantly slows scanning, so use it for in-depth confirmation.

Risk and Compliance Reminder#

Use Kscan’s port-scanning and brute-force features only with explicit authorization. Scanning or attacking unauthorized targets may be illegal. This site accepts no responsibility for unlawful use.

Conclusion#

Kscan is a lightweight and efficient asset-discovery tool for rapid mapping and weak-password auditing in authorized environments. With suitable wordlists, rate limits, and post-processing tools (CSV/JSON), it can produce a deliverable asset inventory and alert list quickly.