Being towards death

TscanPlus is a comprehensive network security detection and operation and maintenance tool.
In this article, we will run it directly on the Windows platform. Just double-click the exe file, no installation is required.
Project address: https://github.com/TideSec/TscanPlus/releases Download the corresponding package.

A comprehensive network security detection and operation and maintenance tool, aiming to quickly discover, identify, and detect assets, build a basic asset information library, and assist the security team or security operation and maintenance personnel of Party A in effective reconnaissance and retrieval of assets, and discover vulnerabilities and attack surfaces.

[Main Functions] Port scanning, service identification, URL fingerprint identification, POC verification, weak password guessing, directory scanning, domain detection, network space detection, etc.

[Auxiliary Functions] Encoding and decoding, encryption and decryption, CS online, reverse shell, antivirus query, privilege escalation assistance, common commands, dictionary generation, JAVA encoding, etc.
[Featured Functions]

1. Built-in more than 26,000 fingerprint data, it only takes 8-10 minutes to fingerprint recognition for 10,000 web systems, which should be relatively high in terms of efficiency and fingerprint coverage.

2. In the fingerprint detection results, automatic labeling of more than 130 common CMS and frameworks for red team and CMS associated with POC.

3. It can realize the linkage between fingerprint and POC, automatically associate POC based on fingerprint recognition results, and directly view relevant information of POC data packets.

4. When creating IP port scanning and URL scanning, it can be associated with POC detection, password cracking, directory scanning, and other functions. When matching services or products are discovered, it will automatically trigger password cracking or POC detection.

5. Built-in weak password cracking for 34 common services, which is convenient for administrators to check weak passwords in the intranet. To improve detection efficiency, the username and password dictionaries of each service are optimized and streamlined. The covered services include: SSH, RDP, SMB, MYSQL, SQLServer, Oracle, MongoDB, Redis, PostgreSQL, MemCached, Elasticsearch, FTP, Telnet, WinRM, VNC, SVN, Tomcat, WebLogic, Jboss, Zookeeper, Socks5, SNMP, WMI, LDAP, LDAPS, SMTP, POP3, IMAP, SMTP_SSL, IMAP_SSL, POP3_SSL, RouterOS, WebBasicAuth, Webdav, CobaltStrike, etc.

6. The directory enumeration defaults to the HEAD method, and can be customized for concurrency, timeout, filtering, dictionaries, etc. It comes with the dictionary of DirSearch and can import your own dictionary files. It can also be generated using the built-in dictionary fuzzing tool.

7. Built-in various types of reverse shell commands (85), Win intranet (credential acquisition, privilege maintenance, lateral movement) commands (26 categories), Linux intranet commands (18 categories), download commands (31), MSF generation commands (21), CS bypass antivirus online commands, etc. Code can be automatically generated based on shell type, operating system type, and listener type.

8. Flexible proxy settings, you can set global proxy with one click, or enable proxy function separately for each module, support HTTP(S)/SOCKS5 two types of proxy, support authentication.

9. Fast subdomain detection, domain name can be linked to other sub-functions, can be configured to dock with multiple network space detection platforms after configuring the key, one-click query and deduplication (to be completed).

10. Built-in Windows privilege escalation assistance, antivirus query, shiro decryption (to be completed), encoding and decoding, and other tools.

[Disclaimer & License]

1. This tool is prohibited from unauthorized commercial use and unauthorized commercial use after secondary development.

2. This tool is only for legal and authorized enterprise security construction activities. When using this tool for detection, you should ensure that this behavior complies with local laws and regulations and has obtained sufficient authorization.

3. If you engage in any illegal activities during the use of this tool, you shall bear the corresponding consequences on your own, and we will not assume any legal or joint liability.

4. Before installing and using this tool, please read and fully understand the contents of each clause carefully, and accept all the terms of this agreement. Otherwise, please do not use this tool. Your use of this tool or your express or implied acceptance of this agreement in any other way shall be deemed as you have read and agreed to be bound by this agreement.