# grayddq/GScan

本程序旨在为安全应急响应人员对Linux主机排查时提供便利，实现主机侧Checklist的自动全面化检测，根据检测结果自动数据聚合，进行黑客攻击路径溯源。

Repository: https://github.com/grayddq/GScan
Canonical: https://ross.abutalabs.com/products/gscan
Language: Python
License Family: other
Topics: security, security-scanning, security-tools, vulnerability-scanning, auditing, security-audit
Last push: 2022-08-07T01:38:34+00:00

## Health v2 (maintenance only)
Score: 23/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 0, release rhythm 8, longevity 100
- inputs: {"age_days": 2725, "days_push": 1488, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_license
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 2826, forks 624 (observed 2026-08-28T04:07:24.171722+00:00)

## What it is
GScan is a Python-based CLI security tool that automates comprehensive Linux host security checks for incident response. It scans for backdoors, rootkits, webshells, suspicious processes, network connections, and account issues, then aggregates results to trace attacker paths.

## Use cases
- automate linux host security checklist during incident response
- detect backdoors and rootkits on a compromised server
- scan for webshell files on a linux host
- trace hacker attack paths from aggregated scan results
- check for suspicious processes and reverse shells
- audit user accounts, sudoers, and ssh keys for compromise
- schedule periodic security scans of a linux server

## When to choose
- you need a fast automated triage of a possibly compromised CentOS linux host
- you want a single tool covering files, processes, network, backdoors, accounts, and logs
- you are a security responder doing host-side checklist verification

## When to avoid
- you need to audit non-CentOS distributions, which are untested and may give unreliable results
- you need a maintained tool with active development or a license
- you need network-wide or containerized environment scanning rather than single-host checks

## Facets
- artifact type: cli-tool
- maturity: maintenance
- function: security, vulnerability-scanning, developer-tools
- domain: security
- platform: python, cli
- tags: incident-response, host-detection, rootkit-detection, backdoor-detection, webshell-scanning, linux-security-audit, checklist-automation, command-line, devops, linux

## Member repositories
- grayddq/GScan (main) score 23

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:07:24.171722+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T07:38:13.668701+00:00, confidence not recorded.
  - readme: https://github.com/grayddq/GScan (fetched 2026-08-28T04:07:24.171722+00:00, sha 639f0d573a4f)
- Data as of 2026-08-30T08:39:29.467469+00:00.