Introducing Agents.·Read
OverviewAgentsWorkflowsExecutionDeveloper ToolsSecurityLibrary
Updated Jul 14, 2026

Network

Sweep a file of IPs and subnets for open ports

evilscan wrapped to TCP-scan a whole targets file.

Agent
Scan a list of subnets for open portsGrab banners on live servicesFilter to only reverse-DNS hosts

overview

What evilscan-loop does

You have a file of IPs or CIDRs, not one host. evilscan-loop runs the evilscan TCP connect engine against each line so open ports across the set land in one combined result.

Set --port for ports or ranges. Add --banner for service strings, --status to keep open/refused/timeout/unreachable states, --concurrency and --timeout for socket load, and --display for json, xml, or console.

Trickest runs evilscan-loop as a managed Network node after subnet expansion or asset discovery. Write structured output and pass live services to httpx or a vulnerability scanner.

source github.com/eviltik/evilscan

use cases

Where evilscan-loop fits

Scan a list of subnets for open ports

Point it at a file of IPs and CIDR ranges, set the port list, and let the loop scan every host so you get one combined view of what is listening across the range.

Grab banners on live services

Enable banner grabbing to capture the service strings on open ports, which helps fingerprint software and versions before deeper testing.

Filter to only reverse-DNS hosts

Keep results that resolve to a valid reverse DNS name so a noisy scan narrows to hosts that look like real, named infrastructure.

Feed open ports into a scanner

Pass the discovered open services to an HTTP prober or vulnerability scanner so the next stage runs only against ports that answered.

reference

evilscan-loop inputs and flags

14 inputs
NameTypeFlagDescription
targetsFILE·List of targets (IP addresses or subnets) to scan.
portsSTRING--portPort(s) to scan, example: --port=21,22,23,5900-5902.
scan-methodSTRING--scanScan method (tcpconnect full connect, default).
statusSTRING--statusPort statuses wanted in results: T (timeout), R (refused), O (open, default), U (unreachable).
bannerBOOLEAN--bannerDisplay the service banner for open ports.
concurrencySTRING--concurrencyMax number of simultaneous sockets opened (default 500).
timeoutSTRING--timeoutMaximum milliseconds before closing the connection (default 2000).
result-formatSTRING--displayDisplay result format (json, xml, console).

Showing key inputs. evilscan-loop exposes 14 inputs in total.

Full flag reference (14 inputs)
NameTypeFlagDescription
targetsFILE·List of targets (IP addresses or subnets) to scan.
portsSTRING--portPort(s) to scan, for example --port=21,22,23,5900-5902.
scan-methodSTRING--scanScan method: tcpconnect (full connect, default); tcpsyn and udp are listed but not implemented.
statusSTRING--statusPort statuses to keep in results: T (timeout), R (refused), O (open, default), U (unreachable).
bannerBOOLEAN--bannerDisplay the service banner grabbed on open ports.
banner-lengthSTRING--bannerlenLength of banner to grab (default 512).
concurrencySTRING--concurrencyMaximum number of simultaneous sockets opened (default 500).
timeoutSTRING--timeoutMaximum milliseconds before closing the connection (default 2000).
display-dns-lookupBOOLEAN--reverseDisplay the DNS reverse lookup for each host.
valid-dnsBOOLEAN--reversevalidOnly show results with a valid reverse DNS, unless ports are specified.
geoipBOOLEAN--geoDisplay MaxMind geoip data for each host (free database).
result-formatSTRING--displayResult format to print: json, xml, or console.
progressBOOLEAN--progressPrint a progress indicator every second.
hugescanBOOLEAN--hugescanAllow an IP/port combination count greater than 16,580,355.

example

Run evilscan-loop

evilscan-loop · command
# loop evilscan over every IP or subnet in the file, banners onwhile read target; do  evilscan "$target" --port=22,80,443,3389,8080 --banner --status=Odone < targets.txt
sample output
198.51.100.7 22 open SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.6198.51.100.7 80 open Server: nginx/1.24.0198.51.100.12 443 open198.51.100.24 3389 open198.51.100.41 8080 open Server: gunicorn/21.2.0203.0.113.9 22 open SSH-2.0-OpenSSH_9.6p1203.0.113.9 25 open 220 mail.example.com ESMTP Postfix203.0.113.18 443 open

guidance

Choosing evilscan-loop

Reach for evilscan-loop when targets already live in a file and you want a TCP sweep with optional banners and reverse DNS. For internet-scale rate, use masscan. For richer service detection, pair naabu with nmap.

masscan

Asynchronous scanner for internet-scale speed. evilscan-loop adds per-host banner and reverse-DNS detail on a targets file.

naabu

Fast Go port scanner that pairs cleanly with nmap. Modern alternative for the same discovery step.

rustscan

Quick port discovery that hands ports to nmap. Faster sweep, less built-in banner and geoip detail.

faq

evilscan-loop questions

Put one IP or CIDR per line in the targets file and set --port. The loop runs a full TCP connect against each entry and reports which ports answered.

related

More Network tools

  1. asnmap

    Map an organization's network ranges from ASN data.

  2. dnsvalidator

    Validate public DNS resolvers against trusted baselines.

  3. fping

    Parallel ICMP echo sweeps for CIDR ranges and host files.

  4. httprobe

    Probe a domain list for working HTTP and HTTPS servers.

  5. httpx

    A fast and multi-purpose HTTP toolkit that runs multiple probers with reliable, high-throughput results.

  6. mapcidr

    Expand, aggregate, and slice CIDR ranges into host lists.

Run evilscan-loop yourself

A file of subnets feeds evilscan-loop, which TCP-scans every host and writes the open ports and banners as a queryable output.

Run evilscan-loop in TrickestBrowse the library

Facts on this page come from the live Trickest tool library.