grayddq/GScan

Health v2 · maintenance only

Flags: no_license

Adoption not part of the score

2826 stars · 624 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

GScan is a Python-based CLI security tool that automates comprehensive Linux host security checks for incident response. It scans for backdoors, rootkits, webshells, suspicious processes, network connections, and account issues, then aggregates results to trace attacker paths.

Use cases

• automate linux host security checklist during incident response
• detect backdoors and rootkits on a compromised server
• scan for webshell files on a linux host
• trace hacker attack paths from aggregated scan results
• check for suspicious processes and reverse shells
• audit user accounts, sudoers, and ssh keys for compromise
• schedule periodic security scans of a linux server

When to choose

• you need a fast automated triage of a possibly compromised CentOS linux host
• you want a single tool covering files, processes, network, backdoors, accounts, and logs
• you are a security responder doing host-side checklist verification

When to avoid

• you need to audit non-CentOS distributions, which are untested and may give unreliable results
• you need a maintained tool with active development or a license
• you need network-wide or containerized environment scanning rather than single-host checks

Facets

cli-tool · maturity maintenance

security vulnerability-scanning developer-tools security python cli incident-response host-detection rootkit-detection backdoor-detection webshell-scanning linux-security-audit checklist-automation command-line devops linux

Member repositories

For agents

markdown · JSON · MCP: product_card(name="grayddq/GScan")