Insecure Protocol Scanner

A Go tool that scans a network segment for three things you don't want on an internal network:

• services still accepting TLS 1.0 / 1.1
• telnet or FTP listening in cleartext
• SMBv1, and for Windows hosts, whether they are actually vulnerable to MS17-010 (the EternalBlue flaw behind WannaCry)

It runs as a single static binary on Linux or Windows, has both a CLI and a local web dashboard, and needs nothing installed to run. Nmap is only required if you want the MS17-010 confirmation, and it runs on the scanner host, never on the targets.

Only scan networks you own or have written permission to test. See SECURITY.md.

Why I built it

Old protocols are still how a lot of networks get broken into. A forgotten box on SMBv1, a switch left on telnet, a web service that never dropped TLS 1.0. None of it is exotic, but finding all of it across a subnet usually means running three or four separate tools and reading their output by hand. I wanted one pass that does the sweep and writes up what it found in language an operations team can act on.

The part I cared about most was not lying. Plenty of scanners print "patched" when what actually happened is the check failed. This one keeps "I confirmed it is fine" separate from "I could not tell," because on a hardened network the second case is common, and pretending otherwise is worse than saying nothing. When it cannot reach a verdict without credentials, it says so.

What it does

Discovery finds the live hosts on a segment, then each check runs as its own plugin.

TLS. It handshakes at 1.0, 1.1, 1.2 and 1.3 one at a time and records which the host accepts. Accepting 1.0 or 1.1 is the finding. The write-up also tells you whether the old version can be switched off safely, meaning the host already speaks 1.2 or higher, or whether turning it off would take the service down.

Cleartext. A reachable telnet or FTP port is the finding. It reads the opening bytes to confirm the service is really telnet and not something else sitting on the port, but a listening port is enough to flag.

SMB. It negotiates SMBv1 to confirm the protocol is enabled. For Windows or unknown hosts it then hands off to Nmap's smb-vuln-ms17-010 script for the actual verdict. Letting Nmap make that call was deliberate: my first version probed SMB directly and got the answer wrong against a real Windows 7 box, so the vulnerability verdict now goes to the tool that is known to get it right, and my code sticks to detection and reporting.

Findings are graded by OS, so an unpatched Windows 7 is critical while a printer on SMBv1 is low but still listed. They are tracked across runs as new, still open, or fixed, and exported to CSV for an audit trail.

What it looks like

An unpatched Windows 7 SP1 box in the lab, confirmed vulnerable to EternalBlue rather than estimated:

Obsolete TLS and a non-Windows SMBv1 host in the same segment. The Linux host is flagged for SMBv1 but is deliberately not labelled EternalBlue, because MS17-010 is a Windows flaw. The web service is caught accepting both TLS 1.0 and 1.1:

Build

The module is under src/.

cd src
CGO_ENABLED=0 go build -o ../scanner ./cmd/scanner

# cross-compile, static, from anywhere
CGO_ENABLED=0 GOOS=linux   GOARCH=amd64 go build -ldflags='-s -w' -o ../scanner     ./cmd/scanner
CGO_ENABLED=0 GOOS=windows GOARCH=amd64 go build -ldflags='-s -w' -o ../scanner.exe ./cmd/scanner

go test ./...

Prebuilt binaries are on the Releases page.

Run

./scanner serve -config config/scanner.json     # dashboard at http://127.0.0.1:8087
./scanner scan  -config config/scanner.json -v  # one-shot from the CLI
./scanner probe 192.168.56.105                  # test a single host

The config is a small JSON file. Set the segment CIDR and which checks to run:

{
  "check_plaintext": true,
  "check_smb": true,
  "scopes": [
    { "name": "lab", "cidr": "192.168.56.0/24", "zone": "test", "owner": "you@lab" }
  ]
}

Turning a check on is all you need. The SMB and cleartext checks add their own ports (445/139, 23/21) to the sweep automatically.

Tested against

Built and checked in an isolated lab using GNS3 and VirtualBox host-only networking:

• Windows 7 SP1, unpatched, came back confirmed vulnerable to MS17-010
• Windows 10 with SMBv1 turned on was flagged for SMBv1 but not called vulnerable
• Linux and Samba on SMBv1 were flagged and correctly not labelled EternalBlue
• A web service accepting TLS 1.0 and 1.1 was flagged with the matching remediation

Notes and limits

This is an exposure scanner, not a patch-compliance tool. It reports what is reachable and answering from wherever it runs. A definitive patch state, especially on a hardened host that refuses the unauthenticated check, needs a credentialed scan or a cross-check against patch-management records. The tool says that plainly instead of guessing.

License

MIT.