OmniScan Comprehensive Vulnerability Scanner

OmniScan is a lightweight, multi-engine vulnerability scanner based on Python, designed for red team operations and security research. It integrates a lightweight Nuclei engine (Lite) and Afrog engine, and provides powerful asset collection and result management capabilities.

Core Features

1. Multi-Engine Support

• Nuclei Lite Engine (Built-in):
  • Implements the core logic of Nuclei natively in Python, without relying on a Go environment.
  • Security Enhancement: Uses simpleeval instead of eval and executes DSL expressions in a sandbox environment to prevent malicious templates from executing code.
  • Smart Variable Generation: Automatically identifies and fills undefined template variables (e.g., {{lang-file}} -> etc/passwd), supporting intelligent Fuzzing.
  • Deep Compatibility:
    • Supports most Nuclei Helper functions (including hmac, gzip, reverse, rand_base, etc.).
    • Supports flow and req-condition logic control.
    • Supports cookie-reuse session persistence and redirects redirection control.
  • Smart False Positive Filtering:
    • Smart FP Reduction: For 200 OK pages, intelligently identifies and filters false positives that only match status codes but not keywords (Strict Mode Heuristic).
    • WAF Identification: Automatically identifies WAF block pages like 403/429, avoiding false positives.
  • OOB Interaction Detection (Enhanced):
    • Built-in Interactsh client, automatically handles vulnerabilities with no direct output (e.g., Blind RCE, SSRF).
    • Correlation ID: Generates a unique correlation ID for each request, accurately matching OOB interactions, completely eliminating false positives.
    • Adaptive Wait: Intelligently adjusts OOB detection wait time, balancing speed and accuracy.
• Afrog Engine: Integrates the Afrog scanner, providing additional vulnerability detection capabilities.
• Nuclei Official Engine: Supports calling the system-installed Nuclei binary for scanning.
• XRay Engine: Supports calling XRay for web scanning.

2. Plugin System (New)

• Python Plugin Extension: Allows users to write Python scripts as scanning plugins to handle complex logic.
• Visual Progress: Built-in tqdm progress bar, showing real-time scanning progress of each plugin on each target.
• Simple to Use: Simply inherit the BasePlugin class and implement the check(url) method.
• Seamless Integration: Plugin scan results are automatically included in the final report, unified with Nuclei results.
• Targeted Scanning: Supports specifying individual or multiple plugin files for targeted detection.
• Example Plugins:
  • git_config.py: Detects .git/config leakage
  • spring_boot.py: Detects Spring Boot Actuator
  • ds_store.py: Detects .DS_Store leakage
  • phpinfo.py: Detects phpinfo() pages
  • backup_files.py: Detects common backup files (.bak, .zip, etc.)
  • swagger_ui.py: Detects Swagger UI documentation

3. Asset Collection

• FOFA Search: Integrates FOFA API, supports batch asset search by syntax (e.g., country="CN").
• Shodan Search: Integrates Shodan API, supports asset search by keyword.
• Single Target: Supports directly specifying a single URL for quick scanning.
• Local Target Loading: Supports batch loading URL lists from a text file.
• Smart Liveness Detection: Automatically performs HTTP liveness checks before scanning, filtering invalid targets.
• URL Normalization: Automatically completes URL protocols (http/https) and deduplicates.

4. High-Performance Async Architecture & Massive Template Support

• Uses Python asyncio and aiohttp framework.
• Memory Optimization (NEW):
  • Lazy Loading: Template files are loaded on demand, no need to load all files at once.
  • Batch Processing: Supports batch scanning of tens of millions of POC templates (default 5000 per batch), completely solving out-of-memory (OOM) issues during large-scale scanning.
  • Automatic Memory Reclamation: Automatically releases memory after each batch scan is completed.
• Real-time Progress Monitoring: Displays detailed batch progress and percentage.
• LogFilter System: Automatically suppresses non-critical errors like "Illegal cookie name", keeping the output clean.

5. Result Management

• Real-time Result Saving:
  • Writes each discovered vulnerability immediately to SQLite database and CSV file, preventing data loss due to program interruption.
  • Automatically refreshes summary statistics after each target scan.
• Multi-format Reports: Generates scan reports in JSON, CSV, and HTML formats in real-time.
• SQLite Database: Built-in SQLite database, automatically deduplicates scan results (based on Template ID + Target + URL).
• Detailed Summary:
  • Outputs vulnerability summary for each target in real-time during scanning (including current batch findings and cumulative total for that target).
  • Progress bar displays the global cumulative total of discovered vulnerabilities in real-time.
  • Provides global vulnerability statistics after scanning is complete.

6. OOB (Out-of-Band) Interaction Detection

• Fully Automated Closed-loop Detection: Automatically handles vulnerabilities with no direct output like Blind RCE, SSRF, Blind SQLi.
• Built-in Interactsh Client:
  • Automatically downloads and manages the interactsh-client binary. (I have uploaded interactsh-client.zip, you can extract it directly in this directory)
  • Automatically obtains OOB Payload URLs (e.g., xxx.oast.pro).
  • Real-time monitoring of DNS/HTTP/SMTP interaction logs.
  • Zero Configuration: The scanner automatically replaces {{interactsh-url}} in templates with the real-time obtained Payload.

Quick Start

Prerequisites

• Python 3.8+
• Linux / macOS / Windows

Installation

1. Clone Repository:

   root@kitploit:~

   git clone https://github.com/d3ckx1/OmniScan.git
   cd omniscan
   

2. Install Dependencies:

   root@kitploit:~

   pip3 install -r requirements.txt
   

3. Configure Tools (Optional):

   • If using Afrog or XRay, ensure the respective executable is in the project root directory or system path.
   • Configure config.yml (optional) to set API Keys and scan parameters.

Usage Examples

1. Single Target Scan

Scan a single URL:

python3 omniscan.py -u http://example.com --tool lite -T ./templates/cve/

2. Asset Collection and Scan (FOFA)

Search assets from FOFA and scan using Nuclei Lite engine:

python3 omniscan.py -f 'app="SpringBoot"' --tool lite -T ./templates/spring-boot/

3. Local Batch Scan

Read targets from urls.txt and scan:

python3 omniscan.py -l urls.txt --tool lite -T ./templates/cve/

4. Specify Scan Tool

• Nuclei Lite: python3 omniscan.py -l urls.txt --tool lite -T ./templates/
• Afrog: python3 omniscan.py -l urls.txt --tool afrog
• XRay: python3 omniscan.py -l urls.txt --tool xray

5. Interactive Mode

Run without --tool parameter to enter interactive menu for tool selection:

python3 omniscan.py -l urls.txt

6. OOB Vulnerability Detection

Scan for Blind RCE vulnerabilities (automatically enables Interactsh):

python3 omniscan.py -l urls.txt --tool lite -T ./templates/blind-rce.yaml

If OOB interaction is detected, the console will output [OOB DETECTED] and record the vulnerability.

8. Enable Python Plugin Scanning

Use Nuclei Lite engine and enable all plugins:

python3 omniscan.py -l urls.txt --tool lite -T ./templates/ --plugins

9. Run Specific Plugins (Targeted Scan)

Run only Git Config and PHPInfo plugins:

python3 omniscan.py -l urls.txt --tool lite -T ./templates/ --plugin-file plugins/git_config.py,plugins/phpinfo.py

10. Classify/Validate Templates Only

Check template compatibility without actual scanning:

python3 omniscan.py --classify-only --tool lite -T ./templates/

Parameter Description

Configuration File (config.yml)

app:
  lite_timeout: 10        # Request timeout (seconds)
  lite_threads: 10        # Concurrent threads
  use_async: true         # Enable async mode
  user_agents:            # Custom User-Agent pool
    - "Mozilla/5.0..."

fofa:
  email: "your_email"
  key: "your_key"

shodan:
  api_key: "your_key"

output:
  formats: ["json", "csv", "html"] # Report formats

Directory Structure

• omniscan.py: Main program entry, responsible for parameter parsing and task scheduling.
• nuclei_lite.py: Nuclei Lite core engine, implements YAML template parsing and scanning.
• result_manager.py: Result management module, handles deduplication and report generation.
• database.py: SQLite database management.
• config.py: Configuration loading module.

Frequently Asked Questions

Q: What does [OOB DETECTED] mean? A: This means the scanner successfully detected an Out-of-Band interaction. It typically indicates that the target triggered a DNS or HTTP request callback, proving the existence of vulnerabilities such as Blind RCE, SSRF, or Blind SQLi.

Q: How to configure FOFA/Shodan API? A: You can fill in the API Key in the config.yml file, or set it through environment variables FOFA_EMAIL, FOFA_KEY, SHODAN_API_KEY.

Q: Which operating systems are supported? A: OmniScan is cross-platform, supporting Linux, macOS, and Windows. External tools (e.g., afrog, interactsh-client) need to be executable on the current system.

License

MIT License