UNICORNSCAN(1)

okay so bestie, welcome to UNICORNSCAN(1) — the Network Tools manual page for unicornscan. No cap, this tool has main character energy and the docs are a whole vibe. 💖🦄

🌸 NAME 🌸

unicornscan Version 0.4.6b is a asynchronous network stimulus delivery/response recoring tool.

Yes, the original says recoring — I am keeping it exactly, bestie, because facts are facts. 💅

✨ SYNOPSIS ✨

Here's the whole invocation vibe, exactly as given:

unicornscan [-b, --broken-crc layer] [-B, --source-port port] [-d, --delay-type type] [-D, --no-defpayload ] [-e, --enable-module modules] [-E, --proc-errors ] [-F, --try-frags ] [-G, --payload-group group] [-h, --help ] [-H, --do-dns ] [-i, --interface interface] [-I, --immediate ] [-j, --ignore-seq ignore] [-l, --logfile file] [-L, --packet-timeoutdelay] [-m, --mode mode] [-M, --module-dir directory] [-p, --ports string] [-P, --pcap-filter filter] [-q, --covertness covertness] [-Q, --quiet ] [-r, --pps rate] [-R, --repeats repeats] [-s, --source-addr address] [-S, --no-shuffle ] [-t, --ip-ttl TTL] [-T, --ip-tos TOS] [-w, --safefile file] [-W, --fingerprint fingerprint] [-v, --verbose ] [-V, --version ] [-z, --sniff ] [-Z, --drone-type type] target list

Tiny heads-up: the synopsis uses -q, --covertness covertness, while the OPTIONS list further down uses -c, --covertness Level. I'm not reconciling them, bestie — both stay exactly as the page has them. 💅

🦋 DESCRIPTION 🦋

The original page has:

unicornscan: ...

and honestly that's it. The description is serving mysterious empty-group-chat energy, so I'm not going to invent features. Moving on, periodt. 💀

💅 OPTIONS 💅

• -b, --broken-crc Layer — Break the CRC sums on the layers you list. N and T are valid, and both may be used without a separator, so NT means both the Network and Transport layers are getting invalid checksums. Chaotic? yes. On purpose? also yes. 💅
• -B, --source-port Port — Source port for sent packets. Numeric -1 means use a random source port (that's the default situation), and other valid settings are 0 to 65535. Normally this option will not be used, but sometimes it is useful to say scan from port 53 into a network. 🎀
• -d, --delay-type Type — Specify the timer used for pps calculations. The default is variable and will try to use something appropriate for the rate you have selected. Note: if available, the tsc timer and the gtod timer are very CPU intensive. If you require unicornscan to not monopolize your system while running, consider using the sleep timer, normally 3. It has been observed that the tsc timer and gtod timer are required for high packet rates, but this is highly system dependent and should be tested on each hardware/platform combination. The tsc timer may not be available on every cpu. The sleep timer module is not recommended for scans where utmost accuracy is required. 😭
• -D, --no-defpayload — Do not use default payloads when one cannot be found. Simple, clean, no notes. ✨
• -e, --enable-module List — A comma separated list of modules to activate. Note: payload modules do not require explicit activation, since they are enabled by default. An example would be pgsqldb,foomod. 🧚
• -E, --proc-errors — Enable processing of errors such as icmp error messages and reset+ack messages (for example). If this option is set, you will see responses that may or may not indicate the presence of a firewall, or other otherwise missed information. Lowkey useful, highkey a little cursed. 🔥
• -F, --try-frags — It is likely that this option doesn't work. Don't bother using it until it is fixed. That's not me being mean, that's the manual being real with you. 💀
• -G, --payload-group Group — Activate payloads only from this numeric payload group. The default payload group is 1.
• -h, --help — If you don't know what this means, perhaps you should consider not using this program. The sass is built in, bestie. 😭
• -H, --do-dns — Resolve dns hostnames before and after the scan (but not during, as that would likely cause superfluous spurious responses during the scan, especially if udp scanning). The hosts that will be resolved are, in order of resolution: the low and high addresses of the range, and finally each host address that replied with something that would be visible depending on other scan options. This option is not recommended for use during scans where utmost accuracy is required. 🦋
• -i, --interface Interface — String representation of the interface to use, overriding automatic detection.
• -I, --immediate — Display results immediately as they are found in a sort of meta report format (read: terse). This option is not recommended for use during scans where the utmost accuracy is required. ⭐
• -j, --ignore-seq Type — A string representing the intended sequence ignorance level. This affects tcp header validity checking, normally used to filter noise from the scan. If, for example, you wish to see reset packets with an ack+seq that is not set or perhaps intended for something else, appropriate use of this option would be R. A is normally used for more exotic tcp scanning. Normally the R option is associated with reset scanning. 🌀
• -l, --logfile File — Path to a file where flat text will be dumped that normally would go to the user's terminal. A limitation of this option currently is that it only logs the output of the Main thread and not the sender and receiver. 🙈
• -L, --packet-timeout Seconds — Numeric value representing the number of seconds to wait before declaring the scan over. For connect scans, sometimes this option can be adjusted to get more accurate results, or if scanning a high-latency target network; for example. ⏳
• -m, --mode Mode — String representation of the desired scanning mode. Correct usage includes U, T, A and sf for Udp scanning, Tcp scanning, Arp scanning, and Tcp Connect scanning respectively. 👑
• -M, --module-dir Directory — Path to a directory containing shared object modules for unicornscan to search.
• -p, --ports Ports — A global list of ports to scan. Can be overridden in the target specification on a per target basis.
• -P, --pcap-filter Filter — A pcap filter string to add to the listener's default pcap filter (that will be associated with the scan mode being used).
• -c, --covertness Level — Numeric option that currently does nothing, except look cool. And honestly? Looking cool is a full-time job. 💅
• -Q, --quiet — This option is intended to make unicornscan play the quiet game. If you are unfamiliar with its rules, consult with someone else who finds you irritating. The manual said what it said. 💀
• -r, --pps Rate — This is arguably the most important option: a numeric option containing the desired packets per second for the sender to use. Choosing a rate too high will cause your scan results to be incomplete. Choosing a rate too low will likely make you feel as though you are using nmap. 🔥
• -R, --repeats Times — The number of times to completely repeat the sender's workload. This option is intended to improve accuracy during critical scans, or with scans going over a highly unreliable network. 🫶
• -s, --source-addr Address — The address to use to override the listener's default interface's address. Using this option often necessitates using the helper program fantaip(1) to make sure the replies are routed back to the interface the listener has open. 🌈
• -S, --no-shuffle — .. — that's literally the whole description in the original. Mysterious icon energy, no cap. 🕵️
• -t, --ip-ttl Number — .. — the original gives us nothing else here, so I'm not making up details. 🫥
• -T, --ip-tos Number — .. — same mysterious vibe, bestie. The page says .. and that's the whole tea. 🍵
• -w, --savefile File — .. — the original leaves this one as .., so I'm leaving it exactly there. 🙈
• -W, --fingerprint Type — .. — no extra lore in the original. Just those two little dots. ✨
• -v, --verbose — .. — that's all the source gives us, bestie. No invented details. 💜
• -V, --version — .. — same situation: the original just says ... 🎀
• -z, --sniff — .. — mysterious, iconic, not elaborated on in the original. 🦋
• -Z, --drone-type Type — .. — the .. is doing a lot of work here, and I refuse to make up more. 💅

🍓 EXAMPLES 🍓

Here's the example exactly as the page lays it out:

unicornscan -msf -s 5.4.3.2 -r 340 -Iv -epgsqldb
www.domain.tld/21:80,8080,443,81

This runs unicornscan in connect mode with an apparent (to the target) source address of 5.4.3.2 at a rate of 340 packets per second. Results will be displayed as they are found with -I, and the output will be verbose with -v. The module pgsqldb will be activated with -epgsqldb, and the target of this scan will be the /21 network that host www.domain.tld belongs to, making attempts to connect to port 80, 8080, 443 and 81. ✨

🎀 FILES 🎀

• unicorn.conf — The file containing the default configuration options for usage.
• modules.conf — The default file for module parameters.
• oui.txt — Contains the MAC prefix to vendor mapping used in Ethernet scanning.
• payloads.conf — The default file for tcp and udp payloads.
• ports.txt — The protocol/port number to name mapping.

🦋 SEE ALSO 🦋

fantaip(1) unicfgtst(1) unicycle(1) unibrow(1) unicorn.conf(5)

💌 REPORTING BUGS 💌

Report Bugs to osace-users@lists.sourceforge.net

👑 COPYRIGHT 👑

(C)2004 Jack Louis jack@rapturesecurity.org This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Okay that's the whole manual page, bestie 🫶 — source/version: Network Tools, date 03/30/05, page UNICORNSCAN(1). Bye 💖