Skills Guide

Fscan Network Scanner

VerifiedCaution

Use fscan for network scanning and security assessment. Supports NDJSON structured output suitable for AI agent pipeline consumption.

Download and use
Sby Skills Guide Bot
SecurityAdvanced
7/22/2026
Claude Code
#network-scanning#vulnerability-scanning#penetration-testing#ndjson#reconnaissance

Recommended for

Claude Code

Automated summary

This skill drives the fscan network scanner to discover live hosts, open ports, services and vulnerabilities, emitting NDJSON that an agent can parse directly.

Strengths

  • `-silent` mode emits clean NDJSON lines, so output can be piped straight into jq without human-oriented log noise.
  • A single tool covers host discovery, port scanning, service fingerprinting, vulnerability checks (MS17-010, unauthenticated Redis) and weak-credential testing.
  • The parameter reference is thorough: thread counts, timeouts, host/port exclusions, SOCKS5 and HTTP proxies, plus credential and dictionary options.
  • A plugin table maps each service to its default port, making it easy to target specific checks with `-m`.

Limitations

  • This is an offensive security tool and the skill states no authorization boundary or legal safeguard, so scoping the engagement is left entirely to the user.
  • The NDJSON schema table is cut off at the end of the document, leaving part of the output field set undocumented.
  • Defaults are aggressive (600 threads, `all` mode), which can be noisy or disruptive against production networks.
When to use it

Reach for it during an authorized infrastructure audit: mapping a subnet, inventorying exposed services, or checking for weak passwords.

When not to use it

Avoid it on hosts or networks you lack explicit written permission to test, or when the scan must stay stealthy.

Security analysis

Caution
Quality score90/100

The skill uses a powerful network security tool through Bash. While fscan is a legitimate tool for authorized security assessments, its capabilities include brute-force attacks and vulnerability detection, which can be intrusive or illegal without proper authorization. It does not contain destructive or exfiltrating instructions, but the dual-use nature and lack of guardrails warrant a caution rating.

Findings
  • •Instructs use of fscan, a network scanning and vulnerability assessment tool capable of active probing, brute-force credential attacks, and detection of exploitable vulnerabilities.
  • •Requires execution via Bash, which can run arbitrary commands if the skill is misused or if target input is maliciously crafted.
  • •No explicit authorization or scope-of-use disclaimer is included, which could lead to unauthorized scanning of systems.
How this analysis is made

Examples

Subnet sweep
Scan 192.168.1.0/24 with fscan in silent mode and give me a list of every live host with its open ports and identified services.
Pull vulnerabilities from NDJSON
Run fscan against 10.0.0.0/24 with SSH and MySQL weak-password checks enabled, then use jq to extract every entry where type is VULN and summarize them by service.
Web fingerprinting
Use fscan to grab web titles and fingerprints for 172.16.0.0/24 on ports 80, 443 and 8080, then show me a table of URLs grouped by page title.

name: fscan-agent description: 使用 fscan 进行网络扫描和安全评估。当用户要求扫描网段、探测主机存活、发现开放端口、识别服务、检测漏洞或弱口令时使用。支持 NDJSON 结构化输出，适合 AI agent 管道消费。 argument-hint: <目标IP/网段> [附加参数] allowed-tools: Bash, Read, Agent

Fscan AI Agent Skill

工具概述

Fscan 是一款内网综合扫描工具，功能包括：

  • 主机存活探测（ICMP / TCP）
  • 端口扫描与服务识别
  • 漏洞检测（MS17-010、Redis 未授权等）
  • 弱口令爆破（SSH、SMB、MySQL、MSSQL、FTP、RDP 等）
  • Web 指纹识别与 POC 扫描
  • NetBIOS / SMB 信息收集
  • 本地信息收集（杀软检测、系统信息等）

二进制路径：当前项目编译产物 fscan_cli，或系统 PATH 中的 fscan。

调用格式

# AI agent 标准用法：NDJSON 输出，无人类日志干扰
fscan -h <目标> -silent [其他参数]

# 解析输出
fscan -h 192.168.1.0/24 -silent | jq 'select(.type=="VULN")'

核心参数

目标指定

| 参数 | 说明 | 示例 | |------|------|------| | -h | 目标主机（IP / CIDR / 范围） | -h 192.168.1.0/24 -h 10.0.0.1-10.0.0.100 | | -hf | 从文件读取目标 | -hf targets.txt | | -p | 指定端口（逗号/范围） | -p 22,80,443,445,3306 -p 1-1000 | | -ep | 排除端口 | -ep 25,110 | | -eh | 排除主机 | -eh 192.168.1.1 | | -u | 指定 URL（Web 扫描） | -u https://example.com | | -uf | URL 文件 | -uf urls.txt |

扫描控制

| 参数 | 说明 | 默认值 | |------|------|--------| | -m | 扫描模式 | all | | -t | 端口扫描线程数 | 600 | | -mt | 模块线程数 | 20 | | -time | 连接超时（秒） | 3 | | -gt | 全局超时（秒） | 180 | | -np | 跳过存活检测 | false | | -ntp | 禁用 TCP 补充探测 | false | | -ao | 仅存活检测 | false | | -nobr | 禁用暴力破解 | false | | -full | 全量 POC 扫描 | false | | -max-retries | 最大重试次数 | 1 |

认证

| 参数 | 说明 | |------|------| | -user | 用户名 | | -pwd | 密码 | | -usera | 追加用户名 | | -pwda | 追加密码，支持逗号或空格分隔多个值 | | -userf | 用户名字典文件 | | -pwdf | 密码字典文件 | | -domain | 域名（SMB/WMI） | | -sshkey | SSH 私钥文件 | | -hash / -hashf | NTLM Hash / Hash 文件 |

代理

| 参数 | 说明 | |------|------| | -socks5 | SOCKS5 代理 (127.0.0.1:1080) | | -proxy | HTTP 代理 (http://127.0.0.1:8080) | | -iface | 指定本地网卡 IP（VPN 场景） |

输出

| 参数 | 说明 | |------|------| | -silent | 静默模式：stdout 仅输出 NDJSON | | -o | 输出文件路径（默认 result.txt） | | -f | 输出格式：txt / json / csv | | -no | 禁用文件保存 | | -debug | 调试模式：日志写入 fscan_debug.log | | -log | 日志级别（debug / info / base / error） |

扫描模式 -m 的取值

| 值 | 说明 | |------|------| | all | 全部扫描（默认） | | icmp | 仅 ICMP 存活检测 | | 插件名 | 仅运行指定插件（如 ssh、smb、ms17010、webtitle） |

服务插件列表

| 插件 | 默认端口 | 功能 | |------|----------|------| | ftp | 21 | FTP 弱口令 | | ssh | 22 | SSH 弱口令 | | telnet | 23 | Telnet 弱口令 | | smtp | 25 | SMTP 弱口令 | | findnet | 135 | RPC 网络信息发现（NetInfo） | | netbios | 139 | NetBIOS 信息收集 | | smb | 445 | SMB 弱口令 | | ms17010 | 445 | MS17-010 永恒之蓝检测 | | ldap | 389 | LDAP 弱口令 | | mssql | 1433 | MSSQL 弱口令 | | oracle | 1521 | Oracle 弱口令 | | mysql | 3306 | MySQL 弱口令 | | rdp | 3389 | RDP 弱口令 + 系统信息 | | postgresql | 5432 | PostgreSQL 弱口令 | | vnc | 5900 | VNC 弱口令 | | redis | 6379 | Redis 未授权 + 弱口令 | | elasticsearch | 9200 | ES 未授权 | | mongodb | 27017 | MongoDB 未授权 + 弱口令 | | memcached | 11211 | Memcached 未授权 | | kafka | 9092 | Kafka 未授权 | | activemq | 61616 | ActiveMQ 弱口令 | | rabbitmq | 5672 | RabbitMQ 弱口令 | | cassandra | 9042 | Cassandra 弱口令 | | neo4j | 7687 | Neo4j 弱口令 | | rsync | 873 | Rsync 未授权 | | webtitle | 80/443 | Web 标题 + 指纹识别 | | webpoc | 80/443 | Web 漏洞 POC |

本地插件（-local）

fscan -local avdetect    # 杀软检测
fscan -local systeminfo  # 系统信息收集
fscan -local envinfo     # 环境变量信息
fscan -local dcinfo      # 域控信息
fscan -local fileinfo    # 敏感文件搜索

NDJSON 输出 Schema（-silent 模式）

每行一个 JSON 对象，所有字段定义：

| 字段 | 类型 | 出现条件 | 说明 | |------|------|----------|------| | type | string | 必有 | HOST / PORT / SERVICE / VULN | | target | string | 必有 | 原始目标 host 或 host:port | | status | string | 必有 | 状态描述 | | host | string | 必有 | IP 地址 | | port | int | PORT/SERVICE/VULN | 端口号 | | service | string | SERVICE/VULN | 服务名（ssh, smb, http 等） | | protocol | string | HOST/SERVICE | 协议（ICMP, TCP, http, https） | | banner | string | SERVICE | 服务 Banner | | title | string | SERVICE (web) | 网页标题 | | url | string | SERVICE (web) | 完整 URL | | vulnerability | string | VULN | 漏洞名称 | | username | string | VULN (弱口令) | 用户名 | | password | string | VULN (弱口令) | 密码 | | plugin | string | SERVICE/VULN | 产生结果的插件名 | | version | string | SERVICE | 服务版本号 | | os | string | SERVICE | 操作系统信息 |

输出示例

{"type":"HOST","target":"192.168.1.5","status":"alive","host":"192.168.1.5","protocol":"ICMP"}
{"type":"PORT","target":"192.168.1.5","status":"open","host":"192.168.1.5","port":22}
{"type":"PORT","target":"192.168.1.5","status":"open","host":"192.168.1.5","port":445}
{"type":"SERVICE","target":"192.168.1.5:22","status":"identified","host":"192.168.1.5","port":22,"service":"ssh","banner":"SSH-2.0-OpenSSH_8.9p1","version":"8.9p1","plugin":"portscan"}
{"type":"SERVICE","target":"192.168.1.5:80","status":"web","host":"192.168.1.5","port":80,"service":"http","protocol":"http","url":"http://192.168.1.5:80","title":"Welcome","plugin":"webtitle"}
{"type":"VULN","target":"192.168.1.5:445","status":"MS17-010 (Windows Server 2012 R2 Standard 9600)","host":"192.168.1.5","port":445,"vulnerability":"MS17-010","service":"smb","plugin":"ms17010"}
{"type":"VULN","target":"192.168.1.5:22","status":"weak_credential: root:123456","host":"192.168.1.5","port":22,"service":"ssh","username":"root","password":"123456","plugin":"ssh"}
{"type":"VULN","target":"192.168.1.5:6379","status":"Redis unauthorized","host":"192.168.1.5","port":6379,"vulnerability":"Redis unauthorized access","service":"redis","plugin":"redis"}

结果产出顺序

  1. HOST — 存活探测阶段
  2. PORT — 端口扫描阶段（与 SERVICE 可能交错）
  3. SERVICE — 服务识别阶段
  4. VULN — 漏洞/弱口令检测阶段

同一 host:port 可产生多条结果（PORT + SERVICE + VULN）。

常用场景参数组合

全网段快速扫描

fscan -h 192.168.1.0/24 -silent

跳过存活检测直接扫端口（目标明确时）

fscan -h 192.168.1.0/24 -silent -np

指定端口精确扫描

fscan -h 10.0.0.0/24 -silent -p 22,80,443,445,3389,3306,6379

仅存活探测

fscan -h 172.16.0.0/16 -silent -m icmp

低速隐蔽扫描

fscan -h 192.168.1.0/24 -silent -t 30 -time 5

通过 SOCKS5 代理扫描内网

fscan -h 10.0.0.0/24 -silent -socks5 127.0.0.1:1080

仅做弱口令检测

fscan -h 192.168.1.10 -silent -m ssh -user root -pwdf /path/to/passwords.txt

Web 目标扫描

fscan -u https://target.com -silent -full

多目标文件批量扫描

fscan -hf targets.txt -silent -o results.json -f json

带调试日志的排障扫描

# NDJSON 到 stdout，debug 日志到文件，互不干扰
fscan -h 192.168.1.0/24 -silent -debug
# 事后查看：cat fscan_debug.log

AI Agent 结果处理

Python 管道消费

import json, subprocess

proc = subprocess.Popen(
    ["fscan", "-h", "192.168.1.0/24", "-silent"],
    stdout=subprocess.PIPE, text=True
)

hosts, services, vulns = [], [], []
for line in proc.stdout:
    r = json.loads(line)
    if r["type"] == "HOST":
        hosts.append(r["host"])
    elif r["type"] == "SERVICE":
        services.append(r)
    elif r["type"] == "VULN":
        vulns.append(r)

proc.wait()

jq 过滤

# 提取所有弱口令
fscan -h 10.0.0.0/24 -silent | jq -r 'select(.username != null) | "\(.host):\(.port) \(.service) \(.username):\(.password)"'

# 提取所有漏洞
fscan -h 10.0.0.0/24 -silent | jq -r 'select(.type=="VULN") | "\(.host):\(.port) \(.vulnerability)"'

# 提取 Web 服务
fscan -h 10.0.0.0/24 -silent | jq -r 'select(.url != null) | "\(.url) \(.title)"'

# 统计开放端口
fscan -h 10.0.0.0/24 -silent | jq -r 'select(.type=="PORT") | .port' | sort -n | uniq -c | sort -rn

注意事项

  • -silent 抑制所有人类可读日志，stdout 仅输出 NDJSON
  • 空字段不出现在 JSON 中（omitempty）
  • 进程退出码 0 正常完成，非 0 表示参数错误或初始化失败
  • -silent 和 -debug 可同时使用，互不干扰
  • SOCKS5 代理下 fscan 信任协议层连接结果，不做额外深度验证
  • 扫描大网段时线程数会自动调整，资源耗尽时自适应降级
  • 默认超时 3 秒，防火墙 drop 的端口会静默超时，不计入失败率

From the file to a first result

The download contains exactly the content displayed on this page. This copy may differ from the latest version in the source repository.

View the source and supporting files

This download contains SKILL.md only. Any scripts, references, templates and dependencies are not included. Get the required files from the source, preserving their directory structure, before continuing.

1. Download the file

Download SKILL.md

From the root of a test project, save the file as .skill-downloads/fscan-network-scanner-mrwaka7t/SKILL.md, or use the command below. This folder is for inspecting the skill before installation.

Command for macOS/Linux or WSL: requires a POSIX shell and curl. On Windows without WSL, use the download button and create the folder manually.

mkdir -p '.skill-downloads/fscan-network-scanner-mrwaka7t' && curl --fail --show-error --location 'https://skills-guides.com/api/skills/fscan-network-scanner-mrwaka7t/download' --output '.skill-downloads/fscan-network-scanner-mrwaka7t/SKILL.md.part' && mv '.skill-downloads/fscan-network-scanner-mrwaka7t/SKILL.md.part' '.skill-downloads/fscan-network-scanner-mrwaka7t/SKILL.md'

2. Check prerequisites

Read SKILL.md before using it. If it references scripts or external services, inspect them and prepare the required access in your test environment.

Tools declared by the author (check availability in your agent): Bash, Read, Agent

No recognized prerequisites section in this file. This does not mean it is self-contained: libraries, tools and access requirements may be mentioned elsewhere in the content or source repository.

The platforms on this page are catalog indications. The paths below follow tool documentation; they do not prove this skill has been run in those tools. No minimum tool version is confirmed for this listing.

3. Load the skill

After inspection, copy the complete folder into your project using one of the commands below, then open a new tool session. The command stops if a folder with the same name already exists: compare the files before replacing it.

Claude Code
test -f '.skill-downloads/fscan-network-scanner-mrwaka7t/SKILL.md' && test -s '.skill-downloads/fscan-network-scanner-mrwaka7t/SKILL.md' && mkdir -p '.claude/skills' && test ! -e '.claude/skills/fscan-agent' && cp -R '.skill-downloads/fscan-network-scanner-mrwaka7t' '.claude/skills/fscan-agent'

OpenSkills

OpenSkills must already be installed. The local install/read procedure is checked with OpenSkills 1.5.0, which requires Node.js ≥ 20.6.0. Catalog slugs are not resolved automatically.

Official OpenSkills installation
openskills install './.skill-downloads/fscan-network-scanner-mrwaka7t'

openskills read 'fscan-network-scanner-mrwaka7t'

Reading should display the installed file content and its base directory. It does not run the skill or install its dependencies.

For an agent that reads AGENTS.md, then sync the index. This command changes AGENTS.md: review the diff before using it.

openskills sync

Manual method or another tool: attach SKILL.md to a conversation, or open it in an agent that can read files. Include any required supporting resources. No universal folder is recognized by every tool.

4. Try a first task

Use a short, synthetic input: an API endpoint, a small document or an interface brief. In a new conversation, attach the file or give the agent its path, then adapt this request:

Read .skill-downloads/fscan-network-scanner-mrwaka7t/SKILL.md and apply its instructions to this example: [describe a test input]. Identify any missing files, dependencies or access. Produce the result requested by the skill without inventing data or running unreviewed scripts.

Expected result: output matching the skill instructions, or a precise list of missing prerequisites. A read confirmation alone does not validate a first use. If an external resource is unavailable, that path remains untested.

Related skills

DeFi AMM Security

Security

Security checklist for Solidity AMM contracts, liquidity pools, and swap flows. Covers reentrancy, donation attacks, oracle manipulation, slippage, and integer math.

Claude CodeCursorCodexadvancedSafe 243,989
Skills Guide Bot

Semgrep Rule Creator

Security

Creates custom Semgrep rules for detecting security vulnerabilities, bug patterns, and code patterns. Includes test-first methodology, taint mode support, and validation steps. Helps when building targeted static analysis detections.

Claude CodeintermediateSafe 21,468
Skills Guide Bot

Dev Toolbar Review Guide

Security

Safety rules for the dev toolbar, PostHog client, and feature flags. Use when reviewing changes to dev-tools and related files, covering environment guards, override cookies, and SSE stream safety.

Claude CodeCursorCodexintermediateSafe 108,624
Skills Guide Bot