# shadow1ng/fscan

一款内网综合扫描工具，方便一键自动化、全方位漏扫扫描。(An intranet comprehensive scanning tool, enabling one-click automated, all-round vulnerability scanning)

Repository: https://github.com/shadow1ng/fscan
Canonical: https://ross.abutalabs.com/products/fscan
Language: Go
License: MIT
License Family: permissive
Topics: fscan, scanner, scanning, sec, security-tools, security
Last push: 2026-08-25T20:43:51+00:00

## Health v2 (maintenance only)
Score: 95/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 99, release rhythm 87, longevity 100
- inputs: {"age_days": 2119, "days_push": 8, "days_rel": 8, "gap_med": 46, "n_releases_24m": 4}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 14450, forks 1938 (observed 2026-08-28T04:11:07.041013+00:00)

## What it is
Fscan is a comprehensive intranet scanning tool written in Go that automates host discovery, port scanning, service identification, weak-password brute forcing, and vulnerability detection in one command. It also includes exploitation modules (e.g., Redis RCE, MS17-010), local information-gathering and persistence helpers, and a Go SDK for embedding into agents or security platforms.

## Use cases
- scan an internal network for live hosts and open ports
- detect weak passwords on SSH, RDP, SMB, MySQL, Redis and other services
- check for MS17-010 (EternalBlue) and SMBGhost vulnerabilities
- find unauthorized-access exposures on Redis, MongoDB, Memcached, Elasticsearch
- fingerprint web servers, CMS, middleware, WAF and CDN during a pentest
- run one-click automated vulnerability scanning across a C-class subnet
- embed scanning capabilities into a security platform via a Go SDK

## When to choose
- you need a single all-in-one binary for internal network reconnaissance and vuln scanning
- you want automated brute forcing plus POC-based vulnerability checks in one run
- you are doing authorized red-team or pentest work on Windows/Linux mixed intranets
- you need a Go SDK to integrate scanning into your own tooling

## When to avoid
- you need stealthy, low-and-slow scanning that evades IDS/IPS
- you require a GUI-driven enterprise vulnerability management product
- you only need external web application scanning rather than intranet assessment
- unauthorized use - it is designed for authorized security testing only

## Facets
- artifact type: cli-tool
- maturity: active
- function: security, penetration-testing, vulnerability-scanning, cli, networking
- domain: security, penetration-testing, networking, developer-tools
- platform: windows, go, cross-platform, cli
- tags: intranet-scanner, vulnerability-scanner, brute-force, poc-scanning, service-discovery, port-scanner, red-team, post-exploitation, command-line, linux, macos

## Member repositories
- shadow1ng/fscan (main) score 95

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:11:07.041013+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T17:12:33.337589+00:00, confidence not recorded.
  - readme: https://github.com/shadow1ng/fscan (fetched 2026-08-28T04:11:07.041013+00:00, sha d847e47fd33f)
- Data as of 2026-08-30T08:39:29.467469+00:00.