CyberStrikeAI/tools/fscan.yaml

name: "fscan"
command: "fscan"
enabled: false
short_description: "内网综合扫描工具，支持存活探测、端口扫描、服务识别、爆破、POC检测"
description: |
  Fscan是一款内网综合扫描工具，支持主机发现、端口扫描、服务识别、

  密码爆破、Web指纹识别和漏洞POC检测。

  **主要功能：**
  - 主机存活探测（ICMP/TCP/Ping）
  - 端口扫描（默认1000常用端口）
  - 服务版本识别与指纹匹配
  - 弱口令暴力破解（SSH/SMB/Mysql/Redis等）
  - Web应用漏洞POC扫描
  - DNS探测与域名枚举
  - Redis未授权利用（写入/WebShell/反弹Shell）
  - 持久化后门生成（Linux ELF / Windows PE）

  **使用场景：**
  - 内网资产快速梳理
  - 弱口令批量检测
  - 常见服务漏洞验证
  - 渗透测试信息收集
  - 红队内网横向
parameters:
  - name: "target"
    type: "string"
    description: "目标主机：IP地址、IP段（如192.168.1.0/24）、IP文件或域名"
    required: true
    flag: "-h"
    format: "flag"
  - name: "ports"
    type: "string"
    description: |
      扫描端口列表，逗号分隔。默认覆盖1000个常用端口。
      示例: "22,80,443,3306,6379" 或 "1-1000"
    required: false
    flag: "-p"
    format: "flag"
    default: "21,22,23,25,53,80,81,88,110,111,135,139,143,161,389,443,445,465,502,512,513,514,515,548,554,587,623,636,873,902,993,995,1080,1099,1194,1433,1434,1521,1522,1525,1723,1883,2049,2121,2181,2200,2222,2375,2376,2379,2380,3000,3128,3268,3269,3306,3389,3690,4369,4444,4848,5000,5005,5044,5060,5432,5601,5631,5632,5671,5672,5900,5984,5985,5986,6000,6379,6380,6443,6666,6667,7001,7002,7474,7687,8000,8005,8008,8009,8080,8081,8086,8088,8089,8090,8161,8180,8443,8500,8834,8848,8880,8888,9000,9001,9042,9080,9090,9092,9093,9160,9200,9300,9418,9443,9999,10000,10051,10250,10255,11211,15672,22222,26379,27017,27018,50000,50070,50075,61613,61614,61616"
  - name: "mode"
    type: "string"
    description: |
      扫描模式：
      - all：全功能扫描（默认）
      - icmp：仅存活探测
      - 或指定插件名称（如 ssh, smb, mysql, redis 等）
    required: false
    flag: "-m"
    format: "flag"
    default: "all"
  - name: "output_file"
    type: "string"
    description: "结果输出文件路径（默认 result.txt）"
    required: false
    flag: "-o"
    format: "flag"
    default: "result.txt"
  - name: "output_format"
    type: "string"
    description: "输出格式：txt（默认）, json, csv"
    required: false
    flag: "-f"
    format: "flag"
    default: "txt"
  - name: "threads"
    type: "int"
    description: "端口扫描线程数"
    required: false
    flag: "-t"
    format: "flag"
    default: 600
  - name: "module_threads"
    type: "int"
    description: "模块并发线程数"
    required: false
    flag: "-mt"
    format: "flag"
    default: 20
  - name: "poc_num"
    type: "int"
    description: "POC扫描并发数"
    required: false
    flag: "-num"
    format: "flag"
    default: 20
  - name: "timeout"
    type: "int"
    description: "端口扫描超时时间（秒）"
    required: false
    flag: "-time"
    format: "flag"
    default: 3
  - name: "web_timeout"
    type: "int"
    description: "Web请求超时时间（秒）"
    required: false
    flag: "-wt"
    format: "flag"
    default: 5
  - name: "global_timeout"
    type: "int"
    description: "全局超时时间（秒）"
    required: false
    flag: "-gt"
    format: "flag"
    default: 180
  - name: "url"
    type: "string"
    description: "目标URL（用于Web扫描模式）"
    required: false
    flag: "-u"
    format: "flag"
  - name: "proxy"
    type: "string"
    description: "HTTP代理地址（如: http://127.0.0.1:8080）"
    required: false
    flag: "-proxy"
    format: "flag"
  - name: "socks5"
    type: "string"
    description: "SOCKS5代理地址（如: 127.0.0.1:1080）"
    required: false
    flag: "-socks5"
    format: "flag"
  - name: "cookie"
    type: "string"
    description: "HTTP Cookie值"
    required: false
    flag: "-cookie"
    format: "flag"
  - name: "domain"
    type: "string"
    description: "目标域名"
    required: false
    flag: "-domain"
    format: "flag"
  - name: "username"
    type: "string"
    description: "暴力破解用户名"
    required: false
    flag: "-user"
    format: "flag"
  - name: "password"
    type: "string"
    description: "暴力破解密码"
    required: false
    flag: "-pwd"
    format: "flag"
  - name: "user_file"
    type: "string"
    description: "用户名字典文件路径"
    required: false
    flag: "-userf"
    format: "flag"
  - name: "pass_file"
    type: "string"
    description: "密码字典文件路径"
    required: false
    flag: "-pwdf"
    format: "flag"
  - name: "host_file"
    type: "string"
    description: "目标主机文件路径（每行一个IP）"
    required: false
    flag: "-hf"
    format: "flag"
  - name: "port_file"
    type: "string"
    description: "自定义端口文件路径"
    required: false
    flag: "-pf"
    format: "flag"
  - name: "url_file"
    type: "string"
    description: "目标URL文件路径"
    required: false
    flag: "-uf"
    format: "flag"
  - name: "pocname"
    type: "string"
    description: "指定POC名称进行单点扫描"
    required: false
    flag: "-pocname"
    format: "flag"
  - name: "pocpath"
    type: "string"
    description: "自定义POC脚本路径"
    required: false
    flag: "-pocpath"
    format: "flag"
  - name: "iface"
    type: "string"
    description: "指定本地网卡IP地址（VPN场景使用）"
    required: false
    flag: "-iface"
    format: "flag"
  - name: "exclude_host"
    type: "string"
    description: "排除的主机IP"
    required: false
    flag: "-eh"
    format: "flag"
  - name: "exclude_port"
    type: "string"
    description: "排除的端口"
    required: false
    flag: "-ep"
    format: "flag"
  - name: "retry"
    type: "int"
    description: "最大重试次数"
    required: false
    flag: "-retry"
    format: "flag"
    default: 3
  - name: "rate_limit"
    type: "int"
    description: "每分钟最大发包次数（0表示不限制）"
    required: false
    flag: "-rate"
    format: "flag"
  - name: "max_redirect"
    type: "int"
    description: "HTTP最大重定向次数"
    required: false
    flag: "-max-redirect"
    format: "flag"
    default: 10
  - name: "lang"
    type: "string"
    description: "输出语言：zh（默认中文）, en（英文）"
    required: false
    flag: "-lang"
    format: "flag"
    default: "zh"
  - name: "log_level"
    type: "string"
    description: "日志级别（默认 base,info,success）"
    required: false
    flag: "-log"
    format: "flag"
    default: "base,info,success"
  - name: "reverse_shell"
    type: "string"
    description: "反弹Shell目标地址:端口（如: 192.168.1.100:4444）"
    required: false
    flag: "-rsh"
    format: "flag"
  - name: "sshkey_file"
    type: "string"
    description: "SSH私钥文件路径"
    required: false
    flag: "-sshkey"
    format: "flag"
  - name: "download_url"
    type: "string"
    description: "要下载的文件URL"
    required: false
    flag: "-download-url"
    format: "flag"
  - name: "download_path"
    type: "string"
    description: "下载文件保存路径"
    required: false
    flag: "-download-path"
    format: "flag"
  - name: "additional_args"
    type: "string"
    description: |
      额外的fscan参数。用于传递未在参数列表中定义的fscan选项。

      **示例值：**
      - "-nobr -nopoc" （禁用爆破和POC，仅做端口扫描）
      - "-ao" （仅进行存活探测）
      - "-silent -nocolor" （静默无颜色输出）
      - "-debug" （开启调试模式）
      - "-full" （全量POC扫描）
      - "-no" （禁用结果保存）
      - "-dns" （启用DNS日志记录）

      **注意事项：**
      - 多个参数用空格分隔
      - 确保参数格式正确，避免命令注入
      - 此参数会直接追加到命令末尾
    required: false
    format: "positional"