loading
Loading content
loading
Network
evilscan wrapped to TCP-scan a whole targets file.
overview
You have a file of IPs or CIDRs, not one host. evilscan-loop runs the evilscan TCP connect engine against each line so open ports across the set land in one combined result.
Set --port for ports or ranges. Add --banner for service strings, --status to keep open/refused/timeout/unreachable states, --concurrency and --timeout for socket load, and --display for json, xml, or console.
Trickest runs evilscan-loop as a managed Network node after subnet expansion or asset discovery. Write structured output and pass live services to httpx or a vulnerability scanner.
source github.com/eviltik/evilscan
use cases
Point it at a file of IPs and CIDR ranges, set the port list, and let the loop scan every host so you get one combined view of what is listening across the range.
Enable banner grabbing to capture the service strings on open ports, which helps fingerprint software and versions before deeper testing.
Keep results that resolve to a valid reverse DNS name so a noisy scan narrows to hosts that look like real, named infrastructure.
Pass the discovered open services to an HTTP prober or vulnerability scanner so the next stage runs only against ports that answered.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| targets | FILE | · | List of targets (IP addresses or subnets) to scan. |
| ports | STRING | --port | Port(s) to scan, example: --port=21,22,23,5900-5902. |
| scan-method | STRING | --scan | Scan method (tcpconnect full connect, default). |
| status | STRING | --status | Port statuses wanted in results: T (timeout), R (refused), O (open, default), U (unreachable). |
| banner | BOOLEAN | --banner | Display the service banner for open ports. |
| concurrency | STRING | --concurrency | Max number of simultaneous sockets opened (default 500). |
| timeout | STRING | --timeout | Maximum milliseconds before closing the connection (default 2000). |
| result-format | STRING | --display | Display result format (json, xml, console). |
Showing key inputs. evilscan-loop exposes 14 inputs in total.
| Name | Type | Flag | Description |
|---|---|---|---|
| targets | FILE | · | List of targets (IP addresses or subnets) to scan. |
| ports | STRING | --port | Port(s) to scan, for example --port=21,22,23,5900-5902. |
| scan-method | STRING | --scan | Scan method: tcpconnect (full connect, default); tcpsyn and udp are listed but not implemented. |
| status | STRING | --status | Port statuses to keep in results: T (timeout), R (refused), O (open, default), U (unreachable). |
| banner | BOOLEAN | --banner | Display the service banner grabbed on open ports. |
| banner-length | STRING | --bannerlen | Length of banner to grab (default 512). |
| concurrency | STRING | --concurrency | Maximum number of simultaneous sockets opened (default 500). |
| timeout | STRING | --timeout | Maximum milliseconds before closing the connection (default 2000). |
| display-dns-lookup | BOOLEAN | --reverse | Display the DNS reverse lookup for each host. |
| valid-dns | BOOLEAN | --reversevalid | Only show results with a valid reverse DNS, unless ports are specified. |
| geoip | BOOLEAN | --geo | Display MaxMind geoip data for each host (free database). |
| result-format | STRING | --display | Result format to print: json, xml, or console. |
| progress | BOOLEAN | --progress | Print a progress indicator every second. |
| hugescan | BOOLEAN | --hugescan | Allow an IP/port combination count greater than 16,580,355. |
example
# loop evilscan over every IP or subnet in the file, banners onwhile read target; do evilscan "$target" --port=22,80,443,3389,8080 --banner --status=Odone < targets.txt198.51.100.7 22 open SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.6198.51.100.7 80 open Server: nginx/1.24.0198.51.100.12 443 open198.51.100.24 3389 open198.51.100.41 8080 open Server: gunicorn/21.2.0203.0.113.9 22 open SSH-2.0-OpenSSH_9.6p1203.0.113.9 25 open 220 mail.example.com ESMTP Postfix203.0.113.18 443 openguidance
Reach for evilscan-loop when targets already live in a file and you want a TCP sweep with optional banners and reverse DNS. For internet-scale rate, use masscan. For richer service detection, pair naabu with nmap.
Asynchronous scanner for internet-scale speed. evilscan-loop adds per-host banner and reverse-DNS detail on a targets file.
Fast Go port scanner that pairs cleanly with nmap. Modern alternative for the same discovery step.
Quick port discovery that hands ports to nmap. Faster sweep, less built-in banner and geoip detail.
faq
related
Map an organization's network ranges from ASN data.
Validate public DNS resolvers against trusted baselines.
Parallel ICMP echo sweeps for CIDR ranges and host files.
Probe a domain list for working HTTP and HTTPS servers.
A fast and multi-purpose HTTP toolkit that runs multiple probers with reliable, high-throughput results.
Expand, aggregate, and slice CIDR ranges into host lists.
A file of subnets feeds evilscan-loop, which TCP-scans every host and writes the open ports and banners as a queryable output.
Facts on this page come from the live Trickest tool library.