NAME

       scanssh — scans the Internet for open proxies and SSH servers

SYNOPSIS

       scanssh [-VIERph] [-s scanners,...] [-n ports,...] [-u socks hosts,...] [-e excludefile] addresses...

DESCRIPTION

       ScanSSH  scans  the given addresses and networks for running services.  It mainly allows the detection of
       open proxies and Internet services.  For known services, ScanSSH will  query  their  version  number  and
       displays the results in a list.

       The  adresses can be either specified as an IPv4 address or an CIDR like IP prefix, ipaddress/masklength.
       Ports can be appended by adding a colon at the end of address specification.

       Additionally, the following two commands can be prefixed to the address:

       random(n[,seed])/  The random command selects random address  from  the  address  range  specified.   The
                          arguments  are  as follows: n is the number of address to randomly create in the given
                          network and seed is a seed for the pseudo random number generator.

       split(s,e)/        The split command is used to split the address range  in  several  unique  components.
                          This  can  be  use  to  scan  from  serveral  hosts in parallel.  The arguments are as
                          follows: e specifies the number of hosts scanning in parallel and s is the  number  of
                          the host this particular scan runs on.

       The options are as follows:

       -V              Causes scanssh to print its version number.

       -I              Does not send a SSH identification string.

       -E              Exit the program, if the file containing the addresses for exclusion can not be found.

       -R              If  addresses  are  generated  at random, this flag causes the program to ignore excluded
                       addresses from the exclude file.  The default behaviour is to always exclude addresses.

       -p              Specifies that ScanSSH should operate as a proxy detector.  This flag  sets  the  default
                       modes and default scanners to detect open proxies.

       -h              Displays the usage of the program.

       -n ports,...    Specifies  the  port  numbers  to  scan.   Ports are separated by commas.  Each specified
                       scanner is run for each port in this list.  The default is 22.

       -u socks hosts,...
                       A list of comma separated host:port pairs of SOCKS proxies that  scanssh  should  use  to
                       scan through.

       -s scanners     Specifies  a number of scanners should be executed for each open port.  Multiple scanners
                       are separated by commas.  The following scanners are currently supported:

                       ssh            Finds versions for SSH, Web and SMTP servers.

                       socks5         Detects if a SOCKS V5 proxy is running on the port.

                       socks4         Detects if a SOCKS V4 proxy is running on the port.

                       http-proxy     Detects a HTTP get proxy.

                       http-connect   Detects a HTTP connect proxy.

                       telnet-proxy   Detects telnet based proxy servers.

       -e excludefile  Specifies the file that contains the addresses to be excluded from the scan.  The  syntax
                       is the same as for the addresses on the command line.

       The  output from scanssh contains only IP addresses.  However, the IP addresses can be converted to names
       with the logresolve(8) tool included in the Apache webserver.

EXAMPLES

       The following command scans the class C network 10.0.0.0 - 10.0.0.255 for open proxies:

       scanssh -p 10.0.0.0/24

       The next command scans for ssh servers on port 22 only:

       scanssh -n 22 -s ssh 192.168.0.0/16

       The following command can be used in a parallel scan.  Two hosts scan the  specified  networks  randomly,
       where this is the first host:

       scanssh 'random(0,rsd)/split(1,2)/(192.168.0.0/16 10.1.0.0/24):22,80'

BUGS

       At  the  moment,  scanssh  leaves a one line entry in the log file of the ssh server.  It is probably not
       possible to avoid that.

Debian                                            July 17, 2000                                       scanssh(1)