Introducing Agents.·Read
OverviewAgentsWorkflowsExecutionDeveloper ToolsSecurityLibrary
Updated Jul 14, 2026

Network

Find open TCP ports on an IP or subnet

Node.js TCP connect scanner for a single IP or CIDR.

JavaScript · MIT license

Agent
Scan an IP or subnet for open portsGrab banners and hostnames alongside portsEmit JSON for downstream nodes

overview

What evilscan does

Point evilscan at one IP or a CIDR and set --port to the ports or ranges to test. Default method is a full TCP connect (--scan=tcpconnect). Cap sockets with --concurrency and stall time with --timeout.

Enrich open ports with --banner, attach hostnames with --reverse, optional --geo for MaxMind location, and keep only wanted states with --status (O open, R refused, T timeout, U unreachable). Choose --display json, xml, or console.

Trickest runs evilscan as a managed Network node: target in, folder and file out. Prefer --display=json when httpx or another prober should consume the live ports next.

source github.com/eviltik/evilscan

use cases

Where evilscan fits

Scan an IP or subnet for open ports

Point evilscan at a single IP or a CIDR range with --port to find which TCP ports answer across a whole segment in one pass.

Grab banners and hostnames alongside ports

Turn on --banner, --reverse, and --geo so every open port arrives with the service banner, a reverse-DNS hostname, and a GeoIP location, not a bare port number.

Emit JSON for downstream nodes

Set --display=json so open ports feed cleanly into an httpx or nuclei stage instead of staying as console text.

Tune throughput for a bounded range

Adjust --concurrency and --timeout to balance speed against accuracy on flaky hosts, and use --status to keep only the port states you care about.

reference

evilscan inputs and flags

14 inputs
NameTypeFlagDescription
ip-address-or-subnetSTRING·IP address or subnet to scan (positional target).
portsSTRING--portPort(s) or ranges to scan, e.g. --port=21,22,23,5900-5902.
scan-methodSTRING--scanScan method: tcpconnect (full connect, default).
statusSTRING--statusPort states to include: T timeout, R refused, O open (default), U unreachable.
concurrencySTRING--concurrencyMaximum number of simultaneous sockets open (default 500).
timeoutSTRING--timeoutMaximum milliseconds before closing a connection (default 2000).
bannerBOOLEAN--bannerGrab and display the service banner for each open port.
result-formatSTRING--displayResult output format: json, xml, or console.

Showing key inputs. evilscan exposes 14 inputs in total.

Full flag reference (14 inputs)
NameTypeFlagDescription
geoipBOOLEAN--geoDisplay a GeoIP location for each result (free MaxMind data).
portsSTRING--portPort(s) or ranges to scan, e.g. --port=21,22,23,5900-5902.
bannerBOOLEAN--bannerGrab and display the service banner for each open port.
statusSTRING--statusPort states to include in results: T timeout, R refused, O open (default), U unreachable.
timeoutSTRING--timeoutMaximum milliseconds before closing a connection (default 2000).
hugescanBOOLEAN--hugescanAllow an IP/port combination count greater than 16,580,355.
progressBOOLEAN--progressDisplay a progress indicator every second.
valid-dnsBOOLEAN--reversevalidOnly display results with a valid reverse DNS, unless ports are specified.
concurrencySTRING--concurrencyMaximum number of simultaneous sockets open (default 500).
scan-methodSTRING--scanScan method: tcpconnect (full connect, default). tcpsyn and udp are listed but not yet implemented.
banner-lengthSTRING--bannerlenNumber of banner bytes to grab (default 512).
result-formatSTRING--displayResult output format: json, xml, or console.
display-dns-lookupBOOLEAN--reverseDisplay the reverse DNS lookup for each host.
ip-address-or-subnetSTRING·IP address or subnet to scan (positional target).

example

Run evilscan

evilscan · command
# TCP connect sweep of a subnet, grab banners, emit JSON
evilscan 198.51.100.0/24 --port=22,80,443,8080 --banner --reverse --display=json
sample output
{"ip":"198.51.100.10","port":22,"status":"open","banner":"SSH-2.0-OpenSSH_8.9p1 Ubuntu"}
{"ip":"198.51.100.10","port":80,"status":"open","banner":"nginx/1.24.0"}
{"ip":"198.51.100.10","port":443,"status":"open","banner":"nginx/1.24.0"}
{"ip":"198.51.100.23","port":22,"status":"open","banner":"SSH-2.0-OpenSSH_9.6"}
{"ip":"198.51.100.23","port":8080,"status":"open","banner":"gunicorn/21.2.0"}
{"ip":"198.51.100.42","port":443,"status":"open","banner":"Apache/2.4.57"}
{"ip":"198.51.100.77","port":22,"status":"open","banner":""}

guidance

Choosing evilscan

Use evilscan for a bounded TCP connect sweep of an IP or subnet when you also want banners, reverse DNS, or GeoIP in one pass. For internet-scale volume, prefer masscan or naabu.

masscan

Asynchronous internet-scale port scanner. Faster on huge ranges; evilscan stays simpler when you want banners and reverse DNS together.

naabu

Fast Go port scanner built for recon pipelines. Sibling for the same open-port discovery role.

faq

evilscan questions

Pass the IP as the positional target and ports with --port, for example evilscan 198.51.100.10 --port=1-1000. On Trickest, set the ip-address-or-subnet and ports inputs.

Yes. Use CIDR as the target, for example evilscan 198.51.100.0/24 --port=22,80,443. For very large IP/port pair counts, --hugescan lifts the default combination cap.

Yes. --banner reads what each open port announces. --bannerlen sets bytes to read (default 512). Pair with --reverse for hostnames and --geo for location tags.

Only tcpconnect (full handshake) is implemented. --scan also lists tcpsyn and udp upstream, but those are not implemented, so leave tcpconnect as the working choice.

masscan is built for huge asynchronous sweeps. evilscan fits bounded ranges where banners, reverse DNS, and GeoIP matter in the same pass. For big fleet scans, use masscan, naabu, or evilscan-loop over a targets file.

related

More Network tools

  1. asnmap

    Map an organization's network ranges from ASN data.

  2. dnsvalidator

    Validate public DNS resolvers against trusted baselines.

  3. fping

    Parallel ICMP echo sweeps for CIDR ranges and host files.

  4. httprobe

    Probe a domain list for working HTTP and HTTPS servers.

  5. httpx

    A fast and multi-purpose HTTP toolkit that runs multiple probers with reliable, high-throughput results.

  6. mapcidr

    Expand, aggregate, and slice CIDR ranges into host lists.

Run evilscan yourself

A subnet feeds evilscan, which sweeps it for open ports and passes the results to httpx so live services land as a queryable output.

Open evilscan in the libraryBuild a workflow with it

Facts on this page come from the live Trickest tool library.