Skip to content

Pentest#

The networkscan pentest command provides comprehensive penetration testing capabilities against network services, including credential spraying and service-specific attacks.

Usage#

networkscan pentest [command]

Available Commands#

  • spray password: Password spray authentication attacks across network services
  • service smb: SMB service pentesting
  • service ssh: SSH service pentesting
  • service telnet: Telnet service pentesting
  • service ldap: LDAP service pentesting and domain enumeration
  • service msrpc: MSRPC service pentesting
  • service kerberos: Kerberos service attacks
  • service winrm: WinRM service pentesting
  • service ftp: FTP service pentesting
  • service oracle: Oracle Database (TNS) pentesting
  • scan cve: CVE scanning using nuclei templates

Commands#

Spray Commands#

The spray commands perform credential spraying attacks and username enumeration against network services.

Password Spray#

Perform password spraying attacks against specified targets and services.

Usage#
networkscan pentest spray password --targets 192.168.1.100:445 --service SMB --usernames admin,user --passwords Password123,123456
Supported Services#
  • SSH - Secure Shell protocol
  • SMB - Server Message Block protocol
  • TELNET - Telnet protocol
  • FTP - File Transfer Protocol
  • LDAP - Lightweight Directory Access Protocol
  • KERBEROS - Kerberos authentication protocol
  • MYSQL - MySQL database protocol
  • ORACLE - Oracle Database (TNS) protocol
Key Flags#
  • --targets / -t - Target hosts (IP:port or IP for default port) (required)
  • --service / -s - Target service (required)
  • --usernames / -u - Usernames to spray
  • --passwords / -p - Passwords to spray
  • --username-file - File containing usernames (one per line)
  • --password-file - File containing passwords (one per line)
  • --username-lists - Built-in username lists (SYSTEM_USERNAMES, DOMAIN_USERNAMES, SERVICE_USERNAMES)
  • --password-lists - Built-in password lists (SYSTEM_PASSWORDS, DOMAIN_PASSWORDS, SERVICE_PASSWORDS)
  • --domain / -d - Domain for SMB/LDAP/KERBEROS authentication
  • --ntlm-hashes - NTLM hashes for pass-the-hash authentication (32 hex chars each)
  • --timeout - Connection timeout in milliseconds (default: 5000)
  • --sleep - Delay between password attempts in seconds
  • --jitter - Random jitter percentage (0-100) to apply to sleep delays
  • --max-attempts - Maximum number of attempts to make (0 = unlimited)
  • --stop-on-first-success - Stop after first successful authentication
  • --successful-only - Only show successful authentications in output
Help Text#
networkscan pentest spray password -h
Perform password spraying attacks against specified targets and services.

Usage:
  networkscan pentest spray password [flags]

Flags:
      --credentials strings          Pre-paired credentials in user:pass format (e.g. alice:Summer2025,bob:Hunter2); tried as-is, no Cartesian product
      --credentials-file string      File containing pre-paired user:pass credentials (one per line)
  -d, --domain string                Domain for SMB/LDAP/KERBEROS authentication
  -h, --help                         help for password
      --jitter int                   Random jitter percentage (0-100) to apply to sleep delays
      --local-auth                   Force authentication against local account instead of domain
      --max-attempts int             Maximum number of attempts to make (0 = unlimited)
      --ntlm-hashes strings          NTLM hashes for pass-the-hash authentication (32 hex chars each)
      --oracle-service-name string   Oracle service name (for ORACLE service spray; defaults to ORCL if neither --oracle-sid nor --oracle-service-name is set)
      --oracle-sid string            Oracle SID (for ORACLE service spray)
      --password-file string         File containing passwords (one per line)
      --password-lists strings       Built-in password lists (SYSTEM_PASSWORDS, DOMAIN_PASSWORDS, SERVICE_PASSWORDS)
  -p, --passwords strings            Passwords to spray
  -s, --service string               Target service (SSH, SMB, TELNET, FTP, LDAP, KERBEROS)
      --sleep int                    Delay between password attempts in seconds
      --stop-on-first-success        Stop after first successful authentication
      --successful-only              Only show successful authentications in output
  -t, --targets strings              Target hosts (IP:port or IP for default port)
      --timeout int                  Connection timeout in milliseconds (default 5000)
      --username-file string         File containing usernames (one per line)
      --username-lists strings       Built-in username lists (SYSTEM_USERNAMES, DOMAIN_USERNAMES, SERVICE_USERNAMES)
  -u, --usernames strings            Usernames to spray

Global Flags:
  -o, --output string        Output format (signal, json, yaml). Default value is signal (default "signal")
  -f, --output-file string   Path to output file. If blank, will output to STDOUT
  -q, --quiet                Suppress output
      --socks-proxy string   SOCKS5 proxy URL for TCP connections (e.g., socks5://127.0.0.1:1080)
  -v, --verbose              Verbose output

Username Enumeration#

Use the Kerberos USER_ENUM action for username enumeration:

networkscan pentest service kerberos --targets dc.example.com:88 --actions USER_ENUM --domain EXAMPLE.COM --principals admin,guest

Service Commands#

The service commands perform service-specific penetration testing operations against network services.

SMB#

Perform pentest operations against SMB services including authentication testing, command execution, share enumeration, and file downloads.

Usage#
networkscan pentest service smb --targets 192.168.1.100:445 --usernames admin,user --passwords password,123456 --actions AUTH,SHARES_MAP
Available Actions#

Use the --actions flag to specify what operations to perform. Available actions: PROBE, AUTH, SAMDUMP, LSADUMP, SHARES_MAP, SHARE_DOWNLOAD, EXEC. Base enumeration is always performed.

Key Flags#
  • --targets - Target hosts (required)
  • --actions - Actions to perform (see available actions)
  • --usernames / -u - Usernames for authentication
  • --passwords / -p - Passwords for authentication
  • --username-file - File containing usernames (one per line)
  • --password-file - File containing passwords (one per line)
  • --credentials - Credentials in user:pass format
  • --domain / -d - Domain for authentication
  • --ntlm-hash - NTLM hash for pass-the-hash authentication
  • --local-auth - Force authentication against local account instead of domain
  • --execute / -x - Commands to execute on successful auth
  • --command-file - File containing commands to execute
  • --remote-file-path - Remote file path to download (format: SHARE\path\to\file)
  • --timeout - Connection timeout in milliseconds (default: 10000)
  • --stop-on-first-success - Stop after first successful auth
  • --successful-only - Show only successful results
  • --verbose - Enable verbose output
Help Text#
networkscan pentest service smb -h
Perform pentest operations against SMB services.

Base enumeration is always performed to extract server info, domain, OS version, etc.
Additional actions can be specified to layer more functionality on top.

Usage:
  networkscan pentest service smb [flags]

Flags:
      --actions strings           Actions to perform: PROBE,AUTH,SAMDUMP,LSADUMP,SHARES_MAP,SHARE_DOWNLOAD,EXEC
      --anonymous                 Use null session (anonymous authentication, no credentials required)
      --command-file string       File containing commands to execute
      --credentials string        Credentials in user:pass format
  -d, --domain string             Domain for authentication
  -x, --execute strings           Commands to execute on successful auth
  -h, --help                      help for smb
      --local-auth                Force authentication against local account instead of domain
      --max-file-size int         Max file size in bytes for SHARE_DOWNLOAD (default 10MB) (default 10485760)
      --ntlm-hash string          NTLM hash for pass-the-hash authentication
      --password-file string      File containing passwords (one per line)
  -p, --passwords strings         Passwords for authentication
      --remote-file-path string   Remote file path to download (format: SHARE\path\to\file)
      --share-name string         Filter SHARES_MAP to a specific share name
      --stop-on-first-success     Stop after first successful auth
      --successful-only           Show only successful results
      --targets strings           Target hosts
      --timeout int               Connection timeout in milliseconds (default 10000)
      --username-file string      File containing usernames (one per line)
  -u, --usernames strings         Usernames for authentication
      --verbose                   Verbose output

Global Flags:
  -o, --output string        Output format (signal, json, yaml). Default value is signal (default "signal")
  -f, --output-file string   Path to output file. If blank, will output to STDOUT
  -q, --quiet                Suppress output
      --socks-proxy string   SOCKS5 proxy URL for TCP connections (e.g., socks5://127.0.0.1:1080)

SSH#

Perform pentest operations against SSH services including authentication testing, command execution, and file transfers.

Usage#
networkscan pentest service ssh --targets 192.168.1.100:22 --usernames root,admin --passwords password,123456 --actions AUTH,EXEC
Available Actions#

Available actions: AUTH, EXEC, FILE_TRANSFER

Key Flags#
  • --targets - Target hosts (required)
  • --actions - Actions to perform: AUTH, EXEC, FILE_TRANSFER
  • --usernames / -u - Usernames for authentication
  • --passwords / -p - Passwords for authentication
  • --username-file - File containing usernames (one per line)
  • --password-file - File containing passwords (one per line)
  • --key-file - SSH private key file
  • --execute / -x - Commands to execute on successful auth
  • --command-file - File containing commands to execute
  • --upload - Files to upload (local:remote format)
  • --download - Remote files to download
  • --timeout - Connection timeout in milliseconds (default: 10000)
  • --stop-on-first-success - Stop after first successful auth
  • --successful-only - Show only successful results
Help Text#
networkscan pentest service ssh -h
Perform pentest operations against SSH services.

Base enumeration is always performed to extract server info, supported auth methods, etc.
Additional actions can be specified to layer more functionality on top.

Usage:
  networkscan pentest service ssh [flags]

Flags:
      --actions strings         Actions to perform: AUTH,EXEC,FILE_TRANSFER
      --command-file string     File containing commands to execute
      --download strings        Remote files to download
  -x, --execute strings         Commands to execute on successful auth
  -h, --help                    help for ssh
      --key-file string         SSH private key file
      --password-file string    File containing passwords (one per line)
  -p, --passwords strings       Passwords for authentication
      --stop-on-first-success   Stop after first successful auth
      --successful-only         Show only successful results
      --targets strings         Target hosts
      --timeout int             Connection timeout in milliseconds (default 10000)
      --upload strings          Files to upload (local:remote format)
      --username-file string    File containing usernames (one per line)
  -u, --usernames strings       Usernames for authentication

Global Flags:
  -o, --output string        Output format (signal, json, yaml). Default value is signal (default "signal")
  -f, --output-file string   Path to output file. If blank, will output to STDOUT
  -q, --quiet                Suppress output
      --socks-proxy string   SOCKS5 proxy URL for TCP connections (e.g., socks5://127.0.0.1:1080)
  -v, --verbose              Verbose output

Telnet#

Perform pentest operations against Telnet services including authentication testing and command execution.

Usage#
networkscan pentest service telnet --targets 192.168.1.100:23 --usernames admin --passwords password --actions AUTH
Available Actions#

Available actions: AUTH

Key Flags#
  • --targets - Target hosts (required)
  • --actions - Actions to perform: AUTH
  • --usernames / -u - Usernames for authentication
  • --passwords / -p - Passwords for authentication
  • --username-file - File containing usernames (one per line)
  • --password-file - File containing passwords (one per line)
  • --execute / -x - Commands to execute on successful auth
  • --command-file - File containing commands to execute
  • --timeout - Connection timeout in milliseconds (default: 10000)
  • --stop-on-first-success - Stop after first successful auth
  • --successful-only - Show only successful results
Help Text#
networkscan pentest service telnet -h
Perform pentest operations against Telnet services.

Base enumeration is always performed to extract banner, prompts, etc.
Additional actions can be specified to layer more functionality on top.

Usage:
  networkscan pentest service telnet [flags]

Flags:
      --actions strings         Actions to perform: AUTH,EXEC
      --command-file string     File containing commands to execute
  -x, --execute strings         Commands to execute on successful auth
  -h, --help                    help for telnet
      --password-file string    File containing passwords (one per line)
  -p, --passwords strings       Passwords for authentication
      --stop-on-first-success   Stop after first successful auth
      --successful-only         Show only successful results
      --targets strings         Target hosts
      --timeout int             Connection timeout in milliseconds (default 10000)
      --username-file string    File containing usernames (one per line)
  -u, --usernames strings       Usernames for authentication

Global Flags:
  -o, --output string        Output format (signal, json, yaml). Default value is signal (default "signal")
  -f, --output-file string   Path to output file. If blank, will output to STDOUT
  -q, --quiet                Suppress output
      --socks-proxy string   SOCKS5 proxy URL for TCP connections (e.g., socks5://127.0.0.1:1080)
  -v, --verbose              Verbose output

LDAP#

Perform pentest operations against LDAP services including authentication testing and domain enumeration.

Usage#
networkscan pentest service ldap --targets 192.168.1.10:389 --usernames user --passwords pass --domain EXAMPLE.COM --actions AUTH,DOMAINDUMP
Available Actions#

Available actions: PROBE, AUTH, DOMAINDUMP

Key Flags#
  • --targets - Target hosts (required)
  • --actions - Actions to perform: PROBE, AUTH, DOMAINDUMP
  • --usernames / -u - Usernames for authentication
  • --passwords / -p - Passwords for authentication
  • --username-file - File containing usernames (one per line)
  • --password-file - File containing passwords (one per line)
  • --credentials - Credentials in user:pass format
  • --domain / -d - Domain for authentication
  • --ntlm-hash - NTLM hash for pass-the-hash authentication
  • --local-auth - Force authentication against local account instead of domain
  • --timeout - Connection timeout in milliseconds (default: 10000)
  • --stop-on-first-success - Stop after first successful auth
  • --successful-only - Show only successful results
  • --sleep - Delay in seconds between LDAP queries for stealth mode
  • --jitter - Jitter percentage (0-100) to randomize sleep delays
  • --max-queries - Maximum total LDAP queries to perform (0 = unlimited)
  • --minimal-queries - Use minimal query sets and essential attributes only
  • --collection-methods - Collection methods for domain dump (GROUP, TRUSTS, OBJECTPROPS, CONTAINER, LOCAL_ADMIN) (default: GROUP,CONTAINER,TRUSTS)
Help Text#
networkscan pentest service ldap -h
Perform pentest operations against LDAP services.

Base enumeration is always performed to extract server info, domain, etc.
Additional actions can be specified to layer more functionality on top.

Usage:
  networkscan pentest service ldap [flags]

Flags:
      --actions strings              Actions to perform: PROBE,AUTH,DOMAINDUMP,SEARCH
      --collection-methods strings   Collection methods for domain dump (GROUP, TRUSTS, OBJECTPROPS, CONTAINER, LOCAL_ADMIN) (default [GROUP,CONTAINER,TRUSTS])
      --credentials string           Credentials in user:pass format
  -d, --domain string                Domain for authentication
  -h, --help                         help for ldap
      --jitter int                   Jitter percentage (0-100) to randomize sleep delays
      --local-auth                   Force authentication against local account instead of domain
      --max-queries int              Maximum total LDAP queries to perform (0 = unlimited)
      --minimal-queries              Use minimal query sets and essential attributes only
      --ntlm-hash string             NTLM hash for pass-the-hash authentication
      --password-file string         File containing passwords (one per line)
  -p, --passwords strings            Passwords for authentication
      --search-attributes strings    SEARCH action: attributes to return (default all)
      --search-base-dn string        SEARCH action: base DN (defaults to the directory naming context)
      --search-filter string         SEARCH action: LDAP filter (default (objectClass=*))
      --search-scope string          SEARCH action: scope BASE|ONE_LEVEL|SUBTREE (default SUBTREE)
      --search-size-limit int        SEARCH action: max entries to return (default 100)
      --sleep int                    Delay in seconds between LDAP queries for stealth mode
      --stop-on-first-success        Stop after first successful auth
      --successful-only              Show only successful results
      --targets strings              Target hosts
      --timeout int                  Connection timeout in milliseconds (default 10000)
      --username-file string         File containing usernames (one per line)
  -u, --usernames strings            Usernames for authentication

Global Flags:
  -o, --output string        Output format (signal, json, yaml). Default value is signal (default "signal")
  -f, --output-file string   Path to output file. If blank, will output to STDOUT
  -q, --quiet                Suppress output
      --socks-proxy string   SOCKS5 proxy URL for TCP connections (e.g., socks5://127.0.0.1:1080)
  -v, --verbose              Verbose output

MSRPC#

Perform pentest operations against MS-RPC services including DCSync attacks via DRSUAPI.

Usage#
networkscan pentest service msrpc --targets dc.example.com:445 --usernames admin --passwords Password123 --domain EXAMPLE.COM --actions DCSYNC
Key Flags#
  • --targets - Target hosts (required)
  • --usernames / -u - Username for authentication
  • --passwords / -p - Password for authentication
  • --ntlm-hash - NTLM hash for pass-the-hash authentication
  • --kerberos-ticket - Base64-encoded Kerberos ticket (TGS) for ticket-based authentication
  • --domain - Domain name (required for DCSync)
  • --actions - Actions to perform: DCSYNC (required)
  • --timeout - Connection timeout in seconds (default: 10)
Help Text#
networkscan pentest service msrpc -h
Perform pentest operations against MS-RPC services including DCSync attacks via DRSUAPI.

Usage:
  networkscan pentest service msrpc [flags]

Flags:
      --actions strings          Actions to perform: DCSYNC (required)
      --domain string            Domain name (required for DCSync)
  -h, --help                     help for msrpc
      --kerberos-ticket string   Base64-encoded Kerberos ticket (TGS) for ticket-based authentication
      --ntlm-hash string         NTLM hash for pass-the-hash authentication
  -p, --passwords strings        Password for authentication
      --targets strings          Target hosts (required)
      --timeout int              Connection timeout in seconds (default 10)
  -u, --usernames strings        Username for authentication

Global Flags:
  -o, --output string        Output format (signal, json, yaml). Default value is signal (default "signal")
  -f, --output-file string   Path to output file. If blank, will output to STDOUT
  -q, --quiet                Suppress output
      --socks-proxy string   SOCKS5 proxy URL for TCP connections (e.g., socks5://127.0.0.1:1080)
  -v, --verbose              Verbose output

Kerberos#

Perform pentest operations against Kerberos services including advanced attacks such as constrained delegation.

Usage#
networkscan pentest service kerberos --targets dc.example.com:88 --usernames user --passwords pass --domain EXAMPLE.COM --actions SERVICE_TICKET --spn HTTP/server.example.com
Key Flags#
  • --targets - Target domain controllers (DC.domain.com:88) (required)
  • --actions - Actions to perform: SERVICE_TICKET, AS_REP_ROAST, KERBEROAST, USER_ENUM
  • --usernames / -u - Username for authentication
  • --passwords / -p - Password for user
  • --ntlm-hash - NTLM hash for user authentication
  • --domain / -d - Domain name
  • --spn - Target Service Principal Name (e.g., HTTP/server.domain.com)
  • --impersonate - Target user to impersonate (optional, for delegation attacks)
  • --timeout - Connection timeout in milliseconds (default: 5000)
Help Text#
networkscan pentest service kerberos -h
Perform pentest operations against Kerberos services.

Supported attacks (one per action; one --actions value per invocation is the
expected pattern — each maps to a full attack workflow, not a raw primitive):

  SERVICE_TICKET   Request a service ticket for an SPN. Add --impersonate to
                   chain S4U2Self + S4U2Proxy for constrained delegation /
                   resource-based constrained delegation (RBCD).
  AS_REP_ROAST     Find AD accounts flagged DONT_REQUIRE_PREAUTH and harvest
                   their AS-REP cipher (hashcat mode 18200) for offline
                   cracking. Credential-free.
  KERBEROAST       Given valid creds (--usernames / --passwords), request
                   TGS-REPs for each --spns target and emit hashcat-format
                   hashes (mode 13100 RC4, 19600/19700 AES) for offline
                   cracking.
  USER_ENUM        Discover valid principals against the KDC via AS-REQ
                   error-code classification. Credential-free.

For Kerberos password spraying use: pentest spray --service KERBEROS

Usage:
  networkscan pentest service kerberos [flags]

Flags:
      --actions strings      Attack action: SERVICE_TICKET, AS_REP_ROAST, KERBEROAST, USER_ENUM
  -d, --domain string        AD domain / realm (uppercased)
      --etypes strings       Kerberos etype preference order (AES256_CTS_HMAC_SHA1_96, AES128_CTS_HMAC_SHA1_96, RC4_HMAC) (default [AES256_CTS_HMAC_SHA1_96,AES128_CTS_HMAC_SHA1_96,RC4_HMAC])
  -h, --help                 help for kerberos
      --impersonate string   User to impersonate for SERVICE_TICKET (triggers S4U2Self + S4U2Proxy for constrained delegation)
      --ntlm-hash string     NTLM hash for user authentication (alternative to --passwords)
  -p, --passwords strings    Passwords for authentication (SERVICE_TICKET, KERBEROAST)
      --principals strings   Candidate principals for AS_REP_ROAST / USER_ENUM (defaults to --usernames)
      --spn string           Target Service Principal Name for SERVICE_TICKET (e.g., HTTP/server.domain.com)
      --spns strings         Target Service Principal Names for KERBEROAST
      --targets strings      Target domain controllers (DC.domain.com:88)
      --timeout int          Connection timeout in milliseconds (per AS-REQ / TGS-REQ exchange) (default 5000)
  -u, --usernames strings    Usernames for authentication (KERBEROAST) or default principal list (USER_ENUM, AS_REP_ROAST)

Global Flags:
  -o, --output string        Output format (signal, json, yaml). Default value is signal (default "signal")
  -f, --output-file string   Path to output file. If blank, will output to STDOUT
  -q, --quiet                Suppress output
      --socks-proxy string   SOCKS5 proxy URL for TCP connections (e.g., socks5://127.0.0.1:1080)
  -v, --verbose              Verbose output

WinRM#

Perform pentest operations against WinRM services including authentication testing and command execution.

Usage#
networkscan pentest service winrm --targets 192.168.1.100 --usernames admin --passwords Password123 --actions AUTH,EXEC
Available Actions#

Available actions: AUTH, EXEC

Key Flags#
  • --targets - Target hosts (required)
  • --actions - Actions to perform: AUTH, EXEC
  • --usernames / -u - Usernames for authentication
  • --passwords / -p - Passwords for authentication
  • --username-file - File containing usernames (one per line)
  • --password-file - File containing passwords (one per line)
  • --domain / -d - Domain for authentication
  • --local-auth - Force authentication against local account instead of domain
  • --execute / -x - Commands to execute on successful auth
  • --command-file - File containing commands to execute
  • --port - WinRM port (default: 5985 for HTTP, 5986 for HTTPS)
  • --https - Use HTTPS instead of HTTP
  • --insecure - Skip TLS certificate verification
  • --timeout - Connection timeout in milliseconds (default: 10000)
  • --stop-on-first-success - Stop after first successful auth
  • --successful-only - Show only successful results
Help Text#
networkscan pentest service winrm -h
Perform pentest operations against WinRM services.

Supports authentication testing and command execution via WinRM protocol.

Usage:
  networkscan pentest service winrm [flags]

Flags:
      --actions strings         Actions to perform: AUTH,EXEC
      --command-file string     File containing commands to execute
  -d, --domain string           Domain for authentication
  -x, --execute strings         Commands to execute on successful auth
  -h, --help                    help for winrm
      --https                   Use HTTPS instead of HTTP
      --insecure                Skip TLS certificate verification
      --local-auth              Force authentication against local account instead of domain
      --password-file string    File containing passwords (one per line)
  -p, --passwords strings       Passwords for authentication
      --port int                WinRM port (default: 5985 for HTTP, 5986 for HTTPS)
      --stop-on-first-success   Stop after first successful auth
      --successful-only         Show only successful results
      --targets strings         Target hosts
      --timeout int             Connection timeout in milliseconds (default 10000)
      --username-file string    File containing usernames (one per line)
  -u, --usernames strings       Usernames for authentication

Global Flags:
  -o, --output string        Output format (signal, json, yaml). Default value is signal (default "signal")
  -f, --output-file string   Path to output file. If blank, will output to STDOUT
  -q, --quiet                Suppress output
      --socks-proxy string   SOCKS5 proxy URL for TCP connections (e.g., socks5://127.0.0.1:1080)
  -v, --verbose              Verbose output

FTP#

Perform pentest operations against FTP services including directory enumeration, write permission testing, file download, and file upload.

Usage#
networkscan pentest service ftp --targets 192.168.1.100:21 --usernames anonymous --passwords guest@example.com --actions LIST
Available Actions#

Available actions: AUTH, LIST, WRITE_TEST, DOWNLOAD, UPLOAD

Key Flags#
  • --targets - Target hosts (required)
  • --actions - Actions to perform: AUTH, LIST, WRITE_TEST, DOWNLOAD, UPLOAD
  • --usernames - Usernames for authentication
  • --passwords - Passwords for authentication
  • --paths - Directories for LIST or WRITE_TEST (defaults to landing directory)
  • --recursive - Recursively list subdirectories
  • --max-depth - Max recursion depth for listing (default: 5)
  • --remote-paths - Remote file paths to download
  • --contents - Files to upload as remote_path:base64content
  • --max-file-size - Max file size in bytes for download or upload (default: 1048576 / 1MB)
  • --timeout - Connection timeout in milliseconds (default: 10000)
Help Text#
networkscan pentest service ftp -h
Perform pentest operations against FTP services.

Supports directory enumeration (LIST), write permission testing (WRITE_TEST),
file download (DOWNLOAD), and file upload (UPLOAD).

Usage:
  networkscan pentest service ftp [flags]

Flags:
      --actions strings         Actions to perform: AUTH,LIST,WRITE_TEST,DOWNLOAD,UPLOAD
      --contents strings        Files to upload as remote_path:base64content (UPLOAD action)
      --data-mode string        FTP data connection mode: auto, passive, or active (default "auto")
      --domain string           Domain for authentication
  -h, --help                    help for ftp
      --max-depth int           Max recursion depth for listing (LIST action) (default 5)
      --max-file-size int       Max file size in bytes for DOWNLOAD/UPLOAD (default 1MB) (default 1048576)
      --passwords strings       Passwords for authentication
      --paths strings           Directories for LIST or WRITE_TEST actions (defaults to landing directory)
      --recursive               Recursively list subdirectories (LIST action)
      --remote-paths strings    Remote file paths to download (DOWNLOAD action)
      --stop-on-first-success   Stop after first successful auth (AUTH action)
      --successful-only         Return only successful auth attempts (AUTH action)
      --targets strings         Target hosts
      --timeout int             Connection timeout in milliseconds (default 10000)
      --usernames strings       Usernames for authentication

Global Flags:
  -o, --output string        Output format (signal, json, yaml). Default value is signal (default "signal")
  -f, --output-file string   Path to output file. If blank, will output to STDOUT
  -q, --quiet                Suppress output
      --socks-proxy string   SOCKS5 proxy URL for TCP connections (e.g., socks5://127.0.0.1:1080)
  -v, --verbose              Verbose output

Oracle#

The Oracle pentest command provides TNS listener enumeration, server fingerprinting, credential testing, and authenticated query execution against Oracle Database services.

Usage#
networkscan pentest service oracle [flags]
Available Actions#
Action Auth Required Description
LISTENER No Enumerate TNS listener metadata, SIDs, and services
PROBE No Gather server version and edition without credentials
AUTH No (tests creds) Test credential pairs against the target SID/service
QUERY Yes Run discovery queries after successful authentication
Key Flags#
Flag Description
--targets Target hosts (IP:port or IP, default port 1521)
--actions Actions: LISTENER, PROBE, AUTH, QUERY (default: PROBE)
--sid Oracle SID to connect to
--service-name Oracle service name to connect to
--usernames / -u Usernames for authentication
--passwords / -p Passwords for authentication
--username-file File containing usernames (one per line)
--password-file File containing passwords (one per line)
--timeout Connection timeout in milliseconds (default 10000)
--query-types Query types for QUERY: SESSION_PRIVS, DBA_USERS, ROLE_PRIVS, VERSION, CUSTOM
--custom-query Custom SQL query for QUERY; adds CUSTOM to query types automatically
--allow-mutations Allow DML/DDL custom SQL queries
Help Text#
networkscan pentest service oracle -h
Perform pentest operations against Oracle Database (TNS) services.

LISTENER enumerates listener metadata, SIDs, and services without authentication.
PROBE gathers server version and edition info without authentication.
AUTH attempts credential authentication against the target.
QUERY runs discovery queries (session privileges, users, roles, version) after successful auth.

Usage:
  networkscan pentest service oracle [flags]

Flags:
      --actions strings         Actions: LISTENER, PROBE, AUTH, QUERY (default: PROBE)
      --allow-mutations         Allow DML/DDL custom SQL queries
      --custom-query string     Custom SQL query for QUERY action
  -h, --help                    help for oracle
      --password-file string    File containing passwords (one per line)
  -p, --passwords strings       Passwords for authentication
      --query-types strings     Oracle query types: SESSION_PRIVS, DBA_USERS, ROLE_PRIVS, VERSION, CUSTOM
      --service-name string     Oracle service name to connect to
      --sid string              Oracle SID to connect to
      --stop-on-first-success   Stop after first successful auth
      --successful-only         Show only successful results
      --targets strings         Target hosts (IP:port or IP, default port 1521)
      --timeout int             Connection timeout in milliseconds (default 10000)
      --username-file string    File containing usernames (one per line)
  -u, --usernames strings       Usernames for authentication

Global Flags:
  -o, --output string        Output format (signal, json, yaml). Default value is signal (default "signal")
  -f, --output-file string   Path to output file. If blank, will output to STDOUT
  -q, --quiet                Suppress output
      --socks-proxy string   SOCKS5 proxy URL for TCP connections (e.g., socks5://127.0.0.1:1080)
  -v, --verbose              Verbose output

etcd#

Perform pentest operations against etcd services. Supports unauthenticated probing, keyspace reads, credential authentication, full key dumps, and Kubernetes Secret decoding.

Usage#
networkscan pentest service etcd --targets 192.168.1.10:2379 --actions PROBE
networkscan pentest service etcd --targets 192.168.1.10:2379 --actions PROBE,READ_UNAUTH
networkscan pentest service etcd --targets 192.168.1.10:2379 --actions AUTH --usernames root --passwords root,etcd
networkscan pentest service etcd --targets 192.168.1.10:2379 --actions PROBE,READ_UNAUTH,DUMP,K8S_DECODE
Available Actions#
  • PROBE — GET /version, /health, /metrics, /v3/cluster/member/list. Returns server version, cluster version, member list, leader identity, and Kubernetes inference flag.
  • READ_UNAUTH — POST /v3/kv/range with full-keyspace range. Confirms unauthenticated read access (the canonical etcd compromise).
  • AUTH — POST /v3/auth/authenticate with operator-supplied or embedded default credentials (root:root, root:etcd, etc.). Captures JWT bearer token on success.
  • DUMP — Paginated full keyspace dump. Tags entries by prefix (/registry/secrets/, /registry/configmaps/, etc.).
  • K8S_DECODE — Decodes k8s\x00 magic-prefixed entries from the dump into structured Secret, ConfigMap, and ServiceAccount objects. Local-only; no network calls.
Key Flags#
  • --targets - Target hosts (host:port, default port 2379) (required)
  • --actions - Actions to perform: PROBE, READ_UNAUTH, AUTH, DUMP, K8S_DECODE (default: PROBE)
  • --usernames - Usernames for AUTH action (default: root)
  • --passwords - Passwords to try for AUTH action
  • --cluster-endpoints - Override cluster endpoints discovered during PROBE
  • --max-keys - Maximum keys to dump (DUMP action, default: 1000)
  • --key-prefix-filter - Filter dump to keys matching this prefix (e.g. /registry/secrets/)
  • --decode-kubernetes-secrets - Enable K8s Secret decoding in K8S_DECODE action (default: true)
  • --timeout - Connection timeout in milliseconds (default: 10000)
  • --stop-on-first-success - Stop AUTH after first successful credential
  • --successful-only - Output only successful AUTH results
Safety Posture#

Read-only by default. PUT, DELETE, COMPACT, DEFRAGMENT, and all auth-mutation endpoints are not implemented. K8S_DECODE is fully local — no additional network calls. DUMP is capped at --max-keys (default 1000) with a truncated flag when the limit is hit.

Help Text#
networkscan pentest service etcd -h
Perform pentest operations against etcd services.

Supports connection probing (PROBE), unauthenticated key reads (READ_UNAUTH),
credential authentication testing (AUTH), full key dump (DUMP), and
Kubernetes secret decoding (K8S_DECODE).

Usage:
  networkscan pentest service etcd [flags]

Flags:
      --actions strings             Actions to perform: PROBE,READ_UNAUTH,AUTH,DUMP,K8S_DECODE (default: PROBE)
      --cluster-endpoints strings   Additional cluster member endpoints to include
      --decode-kubernetes-secrets   Attempt to decode Kubernetes secrets found in dump (K8S_DECODE action)
  -h, --help                        help for etcd
      --key-prefix-filter string    Key prefix filter for reads and dump (e.g. /registry)
      --max-keys int                Maximum number of keys to retrieve (0 = unlimited; default 1000; DUMP action) (default 1000)
      --passwords strings           Passwords for authentication (AUTH action)
      --stop-on-first-success       Stop credential testing on first success
      --successful-only             Return only successful auth attempts
      --targets strings             Target etcd hosts (host:port or host; defaults to port 2379)
      --timeout int                 Connection timeout in milliseconds (default 10000)
      --usernames strings           Usernames for authentication (AUTH action)

Global Flags:
  -o, --output string        Output format (signal, json, yaml). Default value is signal (default "signal")
  -f, --output-file string   Path to output file. If blank, will output to STDOUT
  -q, --quiet                Suppress output
      --socks-proxy string   SOCKS5 proxy URL for TCP connections (e.g., socks5://127.0.0.1:1080)
  -v, --verbose              Verbose output

Scan Commands#

The scan commands perform vulnerability scanning operations against network targets.

CVE Scan#

Perform CVE scanning against network targets using nuclei templates. Scans network services for known CVE vulnerabilities, with templates filtered by application protocol and optionally by year.

Usage#
networkscan pentest scan cve --targets 192.168.1.100:22 --protocol SSH
networkscan pentest scan cve --targets 192.168.1.100:21 --protocol FTP --years 2023,2024,2025
Key Flags#
  • --targets - Target hosts (IP:port or hostname:port) (required)
  • --protocol - Application protocol to filter templates (e.g., FTP, SSH, HTTP, SMB, RPC, TELNET, REDIS, SLP) (required)
  • --years - Filter CVE templates by year (e.g., 2023,2024,2025) (default: all years 2000-2025)
  • --timeout - Timeout in seconds for each scan (default: 30)
  • --threads - Number of concurrent threads (default: 25)
  • --verbose-logs - Enable verbose logging
  • --global-rate-limit - Global rate limit in requests per second (default: no limit)
Help Text#
networkscan pentest scan cve -h
Perform CVE scanning against network targets using nuclei templates.

Scans network services for known CVE vulnerabilities. Templates are filtered by application
protocol (e.g., FTP, SSH, HTTP, SMB, RPC, TELNET, REDIS, SLP) and optionally by year.

Usage:
  networkscan pentest scan cve [flags]

Flags:
      --cves strings             Filter by specific CVE IDs (e.g., CVE-2017-0144,CVE-2019-0708); ignored when --template-paths is set
      --global-rate-limit int    Global rate limit (requests per second, default is no limit)
  -h, --help                     help for cve
      --protocol string          Application protocol to filter nuclei templates and custom CVE detectors (e.g., FTP, SSH, HTTP, SMB, RPC, TELNET, REDIS, SLP, RDP); ignored when --template-paths is set
      --targets strings          Target hosts (IP:port or hostname:port)
      --template-paths strings   Custom nuclei template file or directory paths; overrides --protocol and --years, and skips custom CVE detectors when set
      --threads int              Number of concurrent threads (default 25)
      --timeout int              Timeout in seconds for each scan (default 30)
      --verbose-logs             Enable verbose logging
      --years strings            Filter CVE templates by year (e.g., 2023,2024,2025); ignored when --template-paths is set (default [2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021,2022,2023,2024,2025])

Global Flags:
  -o, --output string        Output format (signal, json, yaml). Default value is signal (default "signal")
  -f, --output-file string   Path to output file. If blank, will output to STDOUT
  -q, --quiet                Suppress output
      --socks-proxy string   SOCKS5 proxy URL for TCP connections (e.g., socks5://127.0.0.1:1080)
  -v, --verbose              Verbose output

Examples#

Basic Authentication Testing#

# Test SMB authentication with domain
networkscan pentest service smb --targets server.domain.com:445 --usernames admin --passwords Password123 --domain CORP --actions AUTH

# Test SSH with key-based auth
networkscan pentest service ssh --targets 192.168.1.10:22 --usernames root --key-file ~/.ssh/id_rsa --actions AUTH,EXEC --execute "whoami"

# Test Telnet with wordlists
networkscan pentest service telnet --targets 192.168.1.20:23 --username-file users.txt --password-file passwords.txt --actions AUTH

Password Spraying#

# SMB password spray
networkscan pentest spray password --targets 192.168.1.0/24 --service SMB --usernames admin,guest --passwords Password123,123456 --domain CORP

# Kerberos username enumeration
networkscan pentest service kerberos --targets dc.example.com:88 --actions USER_ENUM --domain EXAMPLE.COM --principals admin,guest

# LDAP password spray with stealth
networkscan pentest spray password --targets ldap.example.com:389 --service LDAP --usernames user1,user2 --passwords pass1,pass2 --domain EXAMPLE --sleep 2 --jitter 10

Advanced Usage#

# SMB with file download
networkscan pentest service smb --targets 192.168.1.100:445 --usernames admin --passwords password --remote-file-path "C$\\Windows\\System32\\drivers\\etc\\hosts"

# LDAP domain dump with stealth
networkscan pentest service ldap --targets dc.example.com:389 --usernames user --passwords pass --domain EXAMPLE.COM --actions AUTH,DOMAINDUMP --sleep 1 --minimal-queries

# Kerberos service ticket with impersonation
networkscan pentest service kerberos --targets dc.example.com:88 --usernames service_account --passwords ServicePass123 --domain EXAMPLE.COM --actions SERVICE_TICKET --spn HTTP/webapp.example.com --impersonate administrator

# DCSync attack
networkscan pentest service msrpc --targets dc.example.com:445 --usernames admin --passwords Password123 --domain EXAMPLE.COM --actions DCSYNC