Scannerl is a modular distributed fingerprinting engine implemented by Kudelski Security. It can fingerprint thousands of targets on a single host, but can just as easily be distributed across multiple hosts. It is to fingerprint what zmap is to port scanning.
It works on Debian/Ubuntu/Arch (but will probably work on other distributions as well). It uses a master/slave architecture where the master node will distribute the work (host(s) to fingerprint) to its slaves (local or remote). The entire deployment is transparent to the user.
When using conventional fingerprinting tools for large-scale analysis, security researchers will often hit two limitations: first, these tools are typically built for scanning comparatively few hosts at a time and are inappropriate for large ranges of IP addresses. Second, if the large range of IP addresses protected by IPS devices are being fingerprinted, the probability of being blacklisted is higher what could lead to an incomplete set of information. It is designed to circumvent these limitations, not only by providing the ability to fingerprint multiple hosts simultaneously but also by distributing the load across an arbitrary number of hosts. Scannerl also makes the distribution of these tasks completely transparent, which makes setup and maintenance of large-scale fingerprinting projects trivial; this allows to focus on the analyses rather than the herculean task of managing and distributing fingerprinting processes by hand. In addition to the speed factor, scannerl has been designed to allow to easily set up specific fingerprinting analyses in a few lines of code. Not only is the creation of a fingerprinting cluster easy to set up, but it can be tweaked by adding fine-tuned scans to your fingerprinting campaigns.
It is the fastest tool to perform large-scale fingerprinting campaigns.
- release modules for grabing certificates
- with starttls (imap, smtp, pop3)
- for ssh host key
- for https X509 certificates
Scannerl will list the available modules (output modules as well as fingerprinting modules) with the -l switch:
- Fingerprint all the things with scannerl at BlackAlps
- Fingerprinting MySQL with scannerl
- Fingerprint ICS/Scada with scannerl
- Distributed fingerprinting with scannerl
- 6 months of ICS scanning
Copyright(c) 2017 Nagravision SA.