scanssh(1)

💖 scanssh(1) — the manual page, but make it make sense 💖

okay bestie, welcome to scanssh, from the General Commands Manual section of your local man setup. she's a network scanner and she's iconic. let's get into it 🫶

---

✨ NAME ✨

scanssh — scans the Internet for open proxies and SSH servers

like... she goes out there and finds them. no cap. 🔥

---

🌸 SYNOPSIS 🌸

scanssh [-VIERph] [-s scanners,...] [-n ports,...] [-u socks hosts,...]
        [-e excludefile] addresses...

---

🦋 DESCRIPTION 🦋

ScanSSH scans the given addresses and networks for running services. its whole main character thing is detecting open proxies and Internet services. and for services it recognizes, ScanSSH will go query their version number and show you the results in a list. cute, right? 💅

So the addresses — you can write them as a plain IPv4 address, or as a CIDR-style IP prefix, like ipaddress/masklength. Want ports too? just tack a colon on the end of your address spec. done. ✨

and THEN, plot twist, you can prefix two special commands to the address:

• random(n[,seed])/ — the random command picks random addresses out of the address range you gave it. the args work like this: n is how many addresses to randomly create inside the given network, and seed is a seed for the pseudo random number generator. 🎲
• split(s,e)/ — the split command splits the address range into several unique components. this is the one you use when you wanna scan from a bunch of hosts in parallel. args: e is how many hosts are scanning in parallel, and s is the number of the host this particular scan is running on. 🧚

---

💅 OPTIONS 💅

ngl there's a lot of them. every single one is here, bestie, we are NOT skipping.

• -V — makes scanssh print its version number. flex check. 👑
• -I — does not send a SSH identification string. stay mysterious. 🙈
• -E — exits the program if the file containing the addresses for exclusion can't be found. like, no file, no scan, bye. 💀
• -R — if addresses are generated at random, this flag makes the program ignore excluded addresses from the exclude file. heads up: the default behaviour is to always exclude addresses. so -R is the rebellion flag. 🔥
• -p — says ScanSSH should operate as a proxy detector. this flag sets the default modes and default scanners to detect open proxies. one letter, whole vibe shift. ✨
• -i if — specifies the local interface.
• -h — displays the usage of the program. the classic. 🎀
• -n ports,... — specifies the port numbers to scan. ports are separated by commas. each specified scanner gets run for each port in this list. default is 22. 🌈
• -u socks hosts,... — a list of comma separated host:port pairs of SOCKS proxies that scanssh should use to scan through. tunnel girl summer. 🕳️
• -s scanners — specifies a number of scanners that should be executed for each open port. multiple scanners are separated by commas. the scanners currently supported are:
  • ssh — finds versions for SSH, Web and SMTP servers.
  • socks5 — detects if a SOCKS V5 proxy is running on the port.
  • socks4 — detects if a SOCKS V4 proxy is running on the port.
  • http-proxy — detects a HTTP get proxy.
  • http-connect — detects a HTTP connect proxy.
  • telnet-proxy — detects telnet based proxy servers.
• -e excludefile — specifies the file that contains the addresses to be excluded from the scan. the syntax is the same as for the addresses on the command line. so you write it the same way, no new rules. 💜

📌 okay important: the output from scanssh contains only IP addresses. if you want names instead, you can convert those IP addresses with the logresolve(8) tool included in the Apache webserver. noted. 🫶

---

🔥 EXAMPLES 🔥

this next one scans the class C network 10.0.0.0 - 10.0.0.255 for open proxies:

scanssh -p 10.0.0.0/24

the next command scans for ssh servers on port 22 only:

scanssh -n 22 -s ssh 192.168.0.0/16

and this one here can be used in a parallel scan. two hosts scan the specified networks randomly, and this is the first host:

scanssh 'random(0,rsd)/split(1,2)/(192.168.0.0/16 10.1.0.0/24):22,80'

periodt. copy those exactly, don't get creative with the quotes. 💅

---

💀 BUGS 💀

at the moment, scanssh leaves a one line entry in the log file of the ssh server. it is probably not possible to avoid that. so... yeah. she's loud. she leaves receipts. 😭

---

bestie this whole page is from the Debian build, dated July 17, 2000 — old money, still slaying. go scan something responsibly, ily, bye 💖✨🎀