███╗   ██╗███████╗████████╗██╗    ██╗ ██████╗ ██████╗ ██╗  ██╗    ██████╗ ██████╗ ███████╗██████╗ 
████╗  ██║██╔════╝╚══██╔══╝██║    ██║██╔═══██╗██╔══██╗██║ ██╔╝    ██╔══██╗██╔══██╗██╔════╝██╔══██╗
██╔██╗ ██║█████╗     ██║   ██║ █╗ ██║██║   ██║██████╔╝█████╔╝     ██████╔╝██████╔╝█████╗  ██║  ██║
██║╚██╗██║██╔══╝     ██║   ██║███╗██║██║   ██║██╔══██╗██╔═██╗     ██╔═══╝ ██╔══██╗██╔══╝  ██║  ██║
██║ ╚████║███████╗   ██║   ╚███╔███╔╝╚██████╔╝██║  ██║██║  ██╗    ██║     ██║  ██║███████╗██████╔╝
╚═╝  ╚═══╝╚══════╝   ╚═╝    ╚══╝╚══╝  ╚═════╝ ╚═╝  ╚═╝╚═╝  ╚═╝    ╚═╝     ╚═╝  ╚═╝╚══════╝╚═════╝ 

⚠️ LEGAL DISCLAIMER

🔴 FOR AUTHORIZED TESTING ONLY

This tool is designed for educational purposes and authorized penetration testing only. Unauthorized access to computer systems is illegal and may result in criminal charges.

✅ Authorized Use:

• Your own systems and networks
• Systems with explicit written permission
• Educational lab environments
• Professional penetration testing engagements

❌ Unauthorized Use:

• Any system you don't own
• Public networks or infrastructure
• Corporate systems without permission
• Any malicious or harmful intent

By using this tool, you agree to take full responsibility for your actions and comply with all applicable laws.

🚀 Features

🌐 Network Reconnaissance & Discovery

• 🔍 Advanced Network Discovery: Intelligent ping sweeps with customizable timing
• 🔎 Multi-Protocol Port Scanning: TCP connect scanning with service fingerprinting
• 🎨 Banner Grabbing & Versioning: Automated service identification and version detection
• ⚡ Multi-Threading: High-performance concurrent scanning across multiple hosts
• 📊 Progress Tracking: Real-time scanning progress with ETA estimates

🔐 SSH Security Assessment Framework

• 🔍 Deep SSH Fingerprinting: Comprehensive SSH server analysis and version detection
• 🛡️ Configuration Auditing: Automated detection of SSH misconfigurations
• 📝 Vulnerability Database: CVE mapping and exploit availability checking
• 📈 Risk Assessment: Automated security scoring and prioritization
• 📄 Detailed Reporting: Professional-grade vulnerability assessment reports

🎯 Advanced SSH Exploitation Engine

💬 User Enumeration

• CVE-2018-15473: Timing-based username enumeration exploit
• Stealth Mode: Randomized delays and connection pacing to evade detection
• Custom Wordlists: Configurable username dictionaries
• Smart Analysis: Statistical timing analysis for accurate results

🔑 Credential Attack Framework

• Dictionary Attacks: High-performance brute force with custom wordlists
• Smart Brute Force: Intelligent credential combinations and common patterns
• Stealth Brute Force: Advanced evasion with randomized delays and IP rotation
• Session Management: Persistent attack sessions with resume capabilities
• Fail2ban Evasion: Adaptive timing to bypass intrusion detection systems

🛡️ Evasion & Anti-Detection

• Connection Rate Limiting: Configurable delays between attempts
• Randomized Timing: Variable delays to mimic human behavior
• Connection Pooling: Distributed attacks across multiple connections
• Error Handling: Graceful handling of defensive countermeasures

⚙️ Advanced Configuration System

• 📝 YAML Configuration: Flexible parameter management through config.yaml
• 🎯 Custom Port Lists: Configurable scanning profiles for different scenarios
• ⏱️ Timing Controls: Fine-grained timeout and delay customization
• 🗺️ Network Profiles: Pre-configured settings for different network types
• 📊 Performance Tuning: Thread pool and connection optimization

📦 Installation

Prerequisites

# Ensure Python 3.6+ is installed
python3 --version

# Install required dependencies
pip3 install paramiko pyyaml colorama

Quick Install

# Clone the repository
git clone https://github.com/floriankostov/network_scanner.git
cd network_scanner

# Make executable (Unix/Linux/macOS)
chmod +x scanner.py

# Run the scanner
python3 scanner.py

Docker Installation (Optional)

# Build Docker image
docker build -t network-scanner .

# Run in container
docker run -it --network host network-scanner

🔧 Usage Guide

🚀 Quick Start

python3 scanner.py

The scanner provides an intuitive menu system:

╔══════════════════════════════════════════════════════════════════╗
║                    NETWORK SCANNER TOOLKIT                      ║
║                  Professional Penetration Testing               ║
╠══════════════════════════════════════════════════════════════════╣
║  1. 📡 Extended Port Scan    - Comprehensive port discovery     ║
║  2. ⚡ Basic Port Scan       - Quick essential port check       ║
║  3. 🔐 SSH Security Testing  - Advanced SSH vulnerability scan  ║
║  4. 🎯 Custom Target Scan    - Manual IP/range specification   ║
║  5. ❌ Exit                   - Quit the application            ║
╚══════════════════════════════════════════════════════════════════╝

🔍 Network Discovery

# Automatic network detection
[+] Network: 192.168.1.0/24 (254 hosts)
[+] Gateway: 192.168.1.1
[+] Local IP: 192.168.1.100

# Custom network specification
python3 scanner.py --network 10.0.0.0/16

🎯 SSH Exploitation Capabilities

💬 Username Enumeration (CVE-2018-15473)

# Standard enumeration
[EXPLOIT] CVE-2018-15473 Username Enumeration
[+] Target: 192.168.1.50:22 (OpenSSH 7.4)
[+] Testing 100 common usernames...
[✓] Valid users found: admin, user, test

# Stealth enumeration with evasion
[STEALTH] Enabling anti-detection measures
[+] Random delays: 0.5-2.0 seconds
[+] Connection variation: randomized
[✓] Valid users found: admin (confirmed)

🔑 Advanced Brute Force Attacks

# Smart brute force
[EXPLOIT] Smart SSH Brute Force
[+] Target: 192.168.1.50:22
[+] Valid users: admin, user
[+] Wordlist: 500 common passwords
[✓] Credentials found: admin:password123

# Stealth brute force with fail2ban evasion
[STEALTH] Advanced evasion enabled
[+] Adaptive delays: 3-8 seconds
[+] Connection resets: every 5 attempts
[+] IP rotation: enabled
[!] Intrusion detection bypass: active

🛡️ Defense Bypass Features

• Timing Randomization: Variable delays between 0.1-10 seconds
• Connection Management: Automatic connection cycling to avoid detection
• Error Analysis: Smart handling of fail2ban and IDS responses
• Rate Limiting: Adaptive speed adjustment based on target responses

🔧 Advanced Configuration

📝 Configuration File (config.yaml)

# Network scanning settings
network:
  ping_timeout: 1.0
  port_timeout: 3.0
  thread_count: 50
  max_hosts: 254