Fscan 2.2.0: The Internal Network Scanner That Does the Heavy Lifting for You

You know that feeling when you're inside a network and need to quickly figure out what's there, what's vulnerable, and what you can actually exploit? Manually checking 28 services for weak passwords, probing for MS17-010, and trying to remember the right Redis exploit command is a recipe for burning hours. That's exactly the pain fscan aims to eliminate. It's a comprehensive internal network scanning tool that bundles host discovery, port scanning, service fingerprinting, brute-forcing, vulnerability detection, and exploitation into a single binary—and the 2.2.0 release brings a massive overhaul.

What It Does

Fscan is a one-shot internal network scanner written in Go. You point it at a target (or a range, or a file full of targets) and it handles the full reconnaissance-to-exploitation pipeline without you having to stitch together half a dozen separate tools.

The scanning layer covers the basics: ICMP/Ping host discovery for large B/C segments, TCP full-connect port scanning across 133 common ports (with grouped presets like web, db, service, or all), service fingerprinting for 20+ protocols, and web probing that identifies titles, CMS fingerprints, middleware, and WAF/CDN presence.

The brute-force module is where things get serious. It supports 28 different services—SSH, RDP, SMB, FTP, MySQL, MSSQL, Oracle, Redis, and more—with built-in dictionaries of 100+ common weak passwords. You also get NTLM hash authentication for SMB/WMI, SSH private key auth, and a {user} variable substitution system for smarter password guessing.

Beyond scanning and brute-forcing, fscan includes vulnerability detection for high-profile exploits like MS17-010 (EternalBlue) and SMBGhost (CVE-2020-0796), unauthorized access checks for Redis/MongoDB/Memcached/Elasticsearch, and POC scanning with support for both Xray and afrog formats. If you find something exploitable, it can go further: Redis exploitation (writing SSH keys, cron jobs, webshells, or master-slave replication RCE), MS17-010 shellcode injection, and automatic command execution after successful SSH auth.

There's also a local module for post-exploitation work—system info gathering, credential dumping via MiniDump, keylogging, persistence mechanisms, reverse shells, and even security software detection and log cleanup.

Why It's Cool

The 2.2.0 release is a monster update. We're talking 262 commits, 30 new features, 120 bug fixes, and 54 refactors. That's not a minor patch; that's a project that got a serious architectural shake-up.

• The architecture cleanup matters. The README mentions eliminating global variables in favor of Config/State objects, which improves concurrency safety and testability. That's the kind of boring-but-critical work that makes a tool reliable under real-world load. They also merged the SMB plugins (smb/smb2/smbghost/smbinfo) into a unified plugin, which should make maintenance and extension easier.

• Performance got real attention. Regex pre-compilation, swapping map[string]bool for map[string]struct{} to save memory, connection reuse for SOCKS5 proxies, and a sliding window scheduler for port scanning—these are tangible optimizations that matter when you're scanning a /16 at scale. The ICMP token bucket rate limiting is a nice touch too, because nobody wants to crash a router while trying to be stealthy.

• The fingerprint library is huge. Integration with FingerprintHub brings in 3,139 fingerprints, plus favicon hashing with both mmh3 and MD5 formats. That's a lot of coverage for identifying what you're actually looking at.

• The output system got fixed. TXT output now uses real-time disk flushing with a dual-write mechanism to prevent lost or out-of-order results. If you've ever lost scan results because the tool crashed before flushing, you'll appreciate this.

• It's embeddable. The pkg/fscan Go SDK lets you integrate fscan into agents or security platforms with task control (pause/resume), real-time progress callbacks, and TaskID tracking. That's a big deal for teams building internal security tooling.

• 120 bug fixes is a lot of bug fixes. Highlights include fixing RDP certificate parsing panics, resolving race conditions in fingerprint detection, fixing 22 plugin timeout issues, and ensuring Ctrl+C doesn't lose your results. These are the kinds of fixes that come from real-world usage.

How to Try It

Getting started is straightforward. Grab the latest release from the fscan GitHub repository and run it against a target.

Basic usage looks something like this—scan a single IP:

./fscan -h 192.168.1.1

Scan a CIDR range with default settings:

./fscan -h 192.168.1.0/24

Specify ports and output format:

./fscan -h 192.168.1.0/24 -p 1-1000 -o result.txt

If you want the web management interface, you'll need to build with the web build tag:

go build -tags web

There's also a Docker-based lab environment (fscan-lab) for testing and learning, which covers the full range of vulnerability scenarios. And if you're building your own tooling, the Go SDK in pkg/fscan is worth exploring.

Final Thoughts

Fscan 2.2.0 is a genuinely impressive piece of offensive security tooling. It's not trying to be subtle or fancy—it's trying to be comprehensive and fast, and it largely succeeds. If you do internal penetration testing or red team work, having a single tool that handles discovery, brute-forcing, vulnerability detection, and exploitation is a huge time-saver. The SDK and plugin architecture make it extensible for teams that need to integrate it into larger platforms.

That said, this is a powerful tool with real offensive capabilities. Use it only on systems you're authorized to test. But if you're in that line of work, fscan is absolutely worth adding to your arsenal.

Follow @githubprojects for more developer tools and open source projects.