Guide · Open source
How to use fscan: scan internal networks step by step
Updated · written with AI from the project's own documentation and checked against our catalogue data
Fscan is an open-source command-line tool, written in Go, for scanning internal networks. It checks which hosts are alive, which ports are open, which services run on them, and whether they have weak passwords or known vulnerabilities. This guide shows you how to build it from source, run the basic scans and read the output, for authorized security testing only.
fscanshadow1ng/fscan · ★ 14.7k · MIT Install options & downloads Quick start
- 1Check the licence and scope. Confirm you have written authorization for every host you plan to scan, as the README requires.
- 2Install Go. Install a Go toolchain. The README does not state a version, so check the repo first.
- 3Clone the repository. Run git clone https://github.com/shadow1ng/fscan to get the source.
- 4Build the binary. From the repo folder, run the standard build command to produce the fscan binary.
- 5Run a discovery scan. Start with ./fscan -h on your target range, using -ao to check only which hosts are alive.
- 6Run a port and service scan. Add -p with the ports you need, then review the results.
- 7Save and review results. Export results in TXT, JSON or CSV format and review them with the team.
What fscan does and who it is for
Fscan covers host discovery (ICMP/Ping alive checks), TCP full-connect port scanning with 133 built-in common ports, service identification, and web probing for titles, CMS and middleware fingerprints. Its README also lists weak-password checks for 28 services, unauthorized-access checks for Redis, MongoDB, Memcached and Elasticsearch, and several exploitation modules.
It is aimed at security staff running authorized internal assessments and penetration testers who want one tool for discovery, port scans and service checks. The README states it is intended only for legal, authorized use.
Install fscan by cloning and building it
The README describes a clone-and-build install. You need a Go toolchain installed. The README gives build commands but does not state a required Go version, so check the repository for that before you start.
Clone the repository, then build from the repo folder.
- Prerequisite: a Go toolchain
- Clone: git clone https://github.com/shadow1ng/fscan
- Build from the repo folder with the standard build command below
git clone https://github.com/shadow1ng/fscan
go build -ldflags="-s -w" -trimpath -o fscan .Run your first host and port scan
Point fscan at a target with -h. A CIDR range scans a whole subnet. To limit the ports checked, pass -p with a comma-separated list. To only check which hosts are alive, add -ao. To skip brute-force checks, add -nobr.
Only run these against networks you are authorized to test.
- -h 192.168.1.1/24 scans a C-class range
- -p 22,80,443,3389 sets specific ports
- -ao runs alive detection only
- -nobr disables brute-force checks
./fscan -h 192.168.1.1/24
./fscan -h 192.168.1.1 -p 22,80,443,3389
./fscan -h 192.168.1.1/24 -ao
./fscan -h 192.168.1.1/24 -nobrScan web targets and check specific services
For a web target, use -u with a URL. To test one service module, use -m with the module name. The README notes that -list-plugins shows the module names available in your build, along with their types, default ports and how to call them.
Credentials can be set with -user and -pwd, or you can append values to the built-in dictionary with -pwda and -usera.
- Use ./fscan -list-plugins to see modules in your build
- -pwda and -usera add to the default dictionaries
- -p can scan non-standard ports
./fscan -u http://192.168.1.1
./fscan -h 192.168.1.1 -m ssh -user root -pwd password
./fscan -h 192.168.1.1 -m ssh -user root -pwda pass1 pass2 pass3Route scans through a proxy or network interface
Fscan supports HTTP and SOCKS5 proxies, including SOCKS5 with authentication. The README also lists -iface for choosing a network interface, which it describes for VPN setups, and -ehf for reading excluded hosts from a file.
Rate limits and maximum packet counts are configurable, as are port, web and global timeouts and thread counts.
- HTTP proxy: -proxy http://127.0.0.1:8080
- SOCKS5 proxy: -socks5 socks5://user:pass@127.0.0.1:1080
- Silent mode, language switch -lang zh/en and performance report -perf are also listed
./fscan -h 192.168.1.1 -p80 -proxy http://127.0.0.1:8080
./fscan -h 192.168.1.1 -socks5 socks5://user:pass@127.0.0.1:1080Save results as TXT, JSON or CSV
Fscan lists TXT, JSON and CSV as output formats. The README says the TXT output appends a list of web service URLs at the end, which helps when you want to test them in bulk. Check the repository for the exact output flag name in your version, because the README text does not show it in the examples.
- TXT, JSON and CSV formats are supported
- TXT output ends with a URL summary of web services
What people use it for
- A security team running an authorized internal assessment of a corporate subnet
- A penetration tester checking host discovery, open ports and service versions in one pass
- A developer embedding the scanning engine through the Go SDK at pkg/fscan
- Checking web titles and fingerprints across a list of internal URLs
Frequently asked questions
Is fscan free to use?
Fscan is released under the MIT licence, according to its listing. The licence allows you to use and modify the code, but the README limits use to authorized testing.
What do I need to install fscan?
You need a Go toolchain and git to clone the repository. The README gives the build command but does not state a required Go version.
Can I use fscan without the command line?
The main interface is the command line. The README says the web management interface needs a separate build with the -tags web flag, so it is not part of the standard build.
Is fscan legal to run on any network?
No. The README says it is for legal, authorized enterprise security work and that the author is not responsible for unauthorized scanning. Get written permission before you scan any host.
What are alternatives to fscan?
The repository lists comparable projects including gogo, gopoc, LadonGo and Gscan. Compare them on the features you need, such as discovery, port scanning and output formats.
Why does my scan fail or show few results?
The README does not cover troubleshooting in detail. Start with a single host and a small port list, use -ao to confirm host discovery, and check your proxy and interface settings with -iface or -proxy if you are on a VPN.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Fscan suits security staff and penetration testers who run authorized internal assessments and want discovery, port, service and weak-password checks in one command-line tool. It is a poor fit for anyone who needs a point-and-click app, a tiny embedded build, or who cannot document authorization for the targets they scan.
Install options & downloads