OmniScan Comprehensive Vulnerability Scanner

OmniScan is a lightweight, multi-engine vulnerability scanner based on Python, designed for red team operations and security research. It integrates a lightweight Nuclei engine (Lite) and Afrog engine, and provides powerful asset collection and result management capabilities.

Core Features

1. Multi-Engine Support

• Nuclei Lite Engine (Built-in):
  • Implements the core logic of Nuclei natively in Python, without relying on a Go environment.
  • Security Enhancement: Uses simpleeval instead of eval and executes DSL expressions in a sandbox environment to prevent malicious templates from executing code.
  • Smart Variable Generation: Automatically identifies and fills undefined template variables (e.g., {{lang-file}} -> etc/passwd), supporting intelligent Fuzzing.
  • Deep Compatibility:
    • Supports most Nuclei Helper functions (including hmac, gzip, reverse, rand_base, etc.).
    • Supports flow and req-condition logic control.
    • Supports cookie-reuse session persistence and redirects redirection control.
  • Smart False Positive Filtering:
    • Smart FP Reduction: For 200 OK pages, intelligently identifies and filters false positives that only match status codes but not keywords (Strict Mode Heuristic).
    • WAF Identification: Automatically identifies WAF block pages like 403/429, avoiding false positives.
  • OOB Interaction Detection (Enhanced):
    • Built-in Interactsh client, automatically handles vulnerabilities with no direct output (e.g., Blind RCE, SSRF).
    • Correlation ID: Generates a unique correlation ID for each request, accurately matching OOB interactions, completely eliminating false positives.
    • Adaptive Wait: Intelligently adjusts OOB detection wait time, balancing speed and accuracy.
• Afrog Engine: Integrates the Afrog scanner, providing additional vulnerability detection capabilities.
• Nuclei Official Engine: Supports calling the system-installed Nuclei binary for scanning.
• XRay Engine: Supports calling XRay for web scanning.

2. Plugin System (New)

• Python Plugin Extension: Allows users to write Python scripts as scanning plugins to handle complex logic.
• Visual Progress: Built-in tqdm progress bar, showing real-time scanning progress of each plugin on each target.
• Simple to Use: Simply inherit the BasePlugin class and implement the check(url) method.
• Seamless Integration: Plugin scan results are automatically included in the final report, unified with Nuclei results.
• Targeted Scanning: Supports specifying individual or multiple plugin files for targeted detection.
• Example Plugins:
  • git_config.py: Detects .git/config leakage
  • spring_boot.py: Detects Spring Boot Actuator
  • ds_store.py: Detects .DS_Store leakage
  • phpinfo.py: Detects phpinfo() pages
  • backup_files.py: Detects common backup files (.bak, .zip, etc.)
  • swagger_ui.py: Detects Swagger UI documentation

3. Asset Collection

• FOFA Search: Integrates FOFA API, supports batch asset search by syntax (e.g., country="CN").
• Shodan Search: Integrates Shodan API, supports asset search by keyword.
• Single Target: Supports directly specifying a single URL for quick scanning.
• Local Target Loading: Supports batch loading URL lists from a text file.
• Smart Liveness Detection: Automatically performs HTTP liveness checks before scanning, filtering invalid targets.
• URL Normalization: Automatically completes URL protocols (http/https) and deduplicates.

4. High-Performance Async Architecture & Massive Template Support

• Uses Python asyncio and aiohttp framework.
• Memory Optimization (NEW):
  • Lazy Loading: Template files are loaded on demand, no need to load all files at once.
  • Batch Processing: Supports batch scanning of tens of millions of POC templates (default 5000 per batch), completely solving out-of-memory (OOM) issues during large-scale scanning.
  • Automatic Memory Reclamation: Automatically releases memory after each batch scan is completed.
• Real-time Progress Monitoring: Displays detailed batch progress and percentage.
• LogFilter System: Automatically suppresses non-critical errors like "Illegal cookie name", keeping the output clean.

5. Result Management

• Real-time Result Saving:
  • Writes each discovered vulnerability immediately to SQLite database and CSV file, preventing data loss due to program interruption.
  • Automatically refreshes summary statistics after each target scan.
• Multi-format Reports: Generates scan reports in JSON, CSV, and HTML formats in real-time.
• SQLite Database: Built-in SQLite database, automatically deduplicates scan results (based on Template ID + Target + URL).
• Detailed Summary:
  • Outputs vulnerability summary for each target in real-time during scanning (including current batch findings and cumulative total for that target).
  • Progress bar displays the global cumulative total of discovered vulnerabilities in real-time.
  • Provides global vulnerability statistics after scanning is complete.

6. OOB (Out-of-Band) Interaction Detection

• Fully Automated Closed-loop Detection: Automatically handles vulnerabilities with no direct output like Blind RCE, SSRF, Blind SQLi.
• Built-in Interactsh Client:
  • Automatically downloads and manages the interactsh-client binary. (I have uploaded interactsh-client.zip, you can extract it directly in this directory)
  • Automatically obtains OOB Payload URLs (e.g., xxx.oast.pro).
  • Real-time monitoring of DNS/HTTP/SMTP interaction logs.
  • Zero Configuration: The scanner automatically replaces {{interactsh-url}} in templates with the real-time obtained Payload.

Quick Start

Prerequisites

• Python 3.8+
• Linux / macOS / Windows

Installation

1. Clone Repository:

   git clone https://github.com/d3ckx1/OmniScan.git
   cd omniscan
   

2. Install Dependencies:

   pip3 install -r requirements.txt
   

3. Configure Tools (Optional):

   • If using Afrog or XRay, ensure the respective executable is in the project root directory or system path.
   • Configure config.yml (optional) to set API Keys and scan parameters.

Usage Examples

1. Single Target Scan

Scan a single URL:

python3 omniscan.py -u http://example.com --tool lite -T ./templates/cve/

2. Asset Collection and Scan (FOFA)

Search assets from FOFA and scan using Nuclei Lite engine:

python3 omniscan.py -f 'app="SpringBoot"' --tool lite -T ./templates/spring-boot/

3. Local Batch Scan

Read targets from urls.txt and scan:

python3 omniscan.py -l urls.txt --tool lite -T ./templates/cve/

4. Specify Scan Tool

• Nuclei Lite: python3 omniscan.py -l urls.txt --tool lite -T ./templates/
• Afrog: python3 omniscan.py -l urls.txt --tool afrog
• XRay: python3 omniscan.py -l urls.txt --tool xray

5. Interactive Mode

Run without --tool parameter to enter interactive menu for tool selection:

python3 omniscan.py -l urls.txt

6. OOB Vulnerability Detection

Scan for Blind RCE vulnerabilities (automatically enables Interactsh):

python3 omniscan.py -l urls.txt --tool lite -T ./templates/blind-rce.yaml

If OOB interaction is detected, the console will output [OOB DETECTED] and record the vulnerability.

8. Enable Python Plugin Scanning

Use Nuclei Lite engine and enable all plugins:

python3 omniscan.py -l urls.txt --tool lite -T ./templates/ --plugins