flan-go-scan - A modular, extensible vulnerability scanner in Go.

项目说明

!Go-Gopher-Flan-small

flan

![Go 1.23+]()
![CI]()

Flan is a Swiss army knife network scanner in Go. Successor to Flan Scan.

Features

Architecture

!Flan Scan Runtime

Installation

From GitHub:

From source (go > 1.21):

Docker:

Usage

Scan a single target:

Scan a domain (DNS enumeration + port scan):

Scan from a file with top 1000 ports:

Fingerprint already-open endpoints directly:

Fingerprint a known database or service endpoint directly:

High-signal platform fingerprints are surfaced automatically for common control-plane and admin surfaces, including Kubernetes, Grafana, Vault, Artifactory, Elasticsearch, Consul, Prometheus, TeamCity, and etcd.

Scan a CIDR range from stdin:

Scan with custom wordlist and resolver:

Passi only (skip brute-force):

Subdomains only output (subfinder-style, one per line):

Domain scan port profile:

Tune passi sources/settings:

Scan all ports on CDN hosts (default is 80/443 only):

Discover scan targets from Cloudflare zones:

Limit Cloudflare discovery to matching hostnames:

Print Cloudflare-discovered hostnames only:

Discover scan targets from AWS:

Print AWS-discovered targets only:

Write a normalized AWS in snapshot for later diffing:

Scan only added or changed AWS targets when a previous snapshot exists:

Kubernetes access from a kubeconfig:

Enumerate externally reachable Kubernetes resources from an authenticated cluster and scan them:

Write a normalized Kubernetes in snapshot for later diffing:

Scan only added or changed Kubernetes resources when a previous snapshot exists:

Write a normalized Cloudflare in snapshot for later diffing:

Diff the current Cloudflare in against a previous snapshot:

Scan only added/changed Cloudflare hosts when a previous snapshot exists:

Enable UDP scanning:

Crawl HTTP/HTTPS services for endpoints, sensiti, and app fingerprinting:

Run a normal scan and let Flan surface deeper product fingerprints automatically:

Crawl with custom depth:

Scan with detailed AI-powered analysis (requires TOGETHER_API_KEY):

> [!TIP]
> Use --analyze when you want the full AI report sa scan artifacts. The default pretty-mode AI summary is intended for quick triage, not detailed remediation tracking.

Use a custom asset context file for policy-aware AI analysis:

Turn saved scan output into operator-facing findings:

Run Nuclei against derived HTTP surfaces and merge the results:

Emit unified findings as JSON:

Pipe a scan directly into :

Runtime Behavior

> [!NOTE]
> config/context.yaml is loaded automatically when present. It defines asset criticality, data classification, and security policies such as TLS minimum , SSH auth requirements, and allowed ports. Policy are flagged before AI analysis runs.

Flan uses a deterministic resol: custom resolver when provided, otherwise the system resolver, then configured fallbacks. Resolver and cache stats are recorded in scan metadata.

Use --workers, --rate-limit, and --max-host-conns to tune scan concurrency and make large in runs gentler on shared targets and load-balanced services.

When you run flan --run, Flan deri HTTP targets from scan results, invokes the nuclei binary found on PATH, and stores per-run artifacts under artifacts//. Each run bundle includes the target list, target map, Nuclei JSONL output, logs, and a manifest so operators can inspect or replay the step without templates into this repository.

> [!TIP]
Security-header findings are generated only for HTTP 2xx/3xx responses. On 4xx/5xx responses, which are common on load balancer and CDN default pages, Flan reports header checks as skipped instead of treating them as header failures.

> [!WARNING]
Keep provider credentials and API keys out of config files and committed shell scripts. Use en such as TOGETHER_API_KEY, CLOUDFLARE_API_TOKEN, and AWS_PROFILE, or inject them through your CI secret store.

Control Plane & Discovery

!Flan Control Plane And Discovery

Cloudflare Discovery

Cloudflare discovery is zone-based. It keeps A, AAAA, and CNAME scan candidates and skips , wildcard, and non-public-IP records by default. It can persist normalized in snapshots, diff them across runs, and optionally narrow scans to added or changed hosts. If --cloudflare-diff-against is omitted but --cloudflare-in is set, Flan reuses the in output path as the diff base.

AWS Discovery

AWS discovery is in. It collects public scan targets from Route53, EC2, ELB/ELBv2, CloudFront, API Gateway, Lightsail, EKS, Lambda function URLs, and S3 website endpoints. It can persist normalized in snapshots, diff them across runs, and optionally narrow scans to added or changed targets. If --aws-diff-against is omitted but --aws-in is set, Flan reuses the in output path as the diff base.

Kubernetes Access

Kubernetes kubeconfig support is explicit. Flan can cluster access via the API server / endpoint, or enumerate externally relevant resources from authenticated cluster access when --kube-in is enabled. The current in phase focuses on API ser, Ingress resources, LoadBalancer services, and externally reachable NodePort services. Kubernetes-derived scan results carry cluster, namespace, resource kind, and exposure metadata into output and AI summaries.

Flags

| Flag | Description |
|------|-------------|
| -t | Target host/IP |
| -l | Target file (default ips.txt, - for stdin) |
| -d | Domain to enumerate via DNS |
| -p | Ports to scan |
| --top-ports | Use top port profile: 100, 1000, 2000, or 5000 |
| --subdomain-ports | Domain mode port profile: web, standard, or full |
| -c | Config file (default config/config.yaml) |
| --workers | Number of concurrent scan workers |
| --rate-limit | Global scan requests per second |
| --max-host-conns | Max concurrent scan connections per host IP (0 disables) |
| --fingerprint-only | Treat manual input as host:port targets and skip host discovery |
| -w | Custom DNS subdomain wordlist |
| -r | Custom DNS resolver (ip:port) |
| --cloudflare | Discover scan targets from Cloudflare zone DNS records |
| --cloudflare-zones | Comma-separated Cloudflare zone filter |
| --cloudflare-include | Comma-separated hostname include filters |
| --cloudflare-exclude | Comma-separated hostname exclude filters |
| --cloudflare-in | Write normalized Cloudflare in snapshot to this path |
| --cloudflare-diff-against | Compare the current Cloudflare in against a previous snapshot; defaults to --cloudflare-in when omitted |
| --cloudflare-delta-only | Scan only added/changed Cloudflare hosts when a previous snapshot is a |
| --aws | Discover scan targets from AWS assets |
| --aws-profile | AWS shared config profile to use |
| --aws-regions | Comma-separated AWS region filter |
| --aws-include | Comma-separated AWS target include filters |
| --aws-exclude | Comma-separated AWS target exclude filters |
| --aws-in | Write normalized AWS in snapshot to this path |
| --aws-diff-against | Compare the current AWS in against a previous snapshot; defaults to --aws-in when omitted |
| --aws-delta-only | Scan only added/changed AWS targets when a previous snapshot is a |
| --kubeconfig | Path to kubeconfig for Kubernetes |
| --kube-context | Optional kubeconfig context to use |
| --kube-in | Enumerate externally reachable Kubernetes resources from the selected cluster |
| --kube-in | Write normalized Kubernetes in snapshot to this path |
| --kube-diff-against | Compare the current Kubernetes in against a previous snapshot; defaults to --kube-in when omitted |
| --kube-delta-only | Scan only added/changed Kubernetes resources when a previous snapshot is a |
| --passi | Skip brute-force, use passi only |
| --subdomains-only | Print discovered subdomains and exit (no port scan) |
| --subfinder-sources | Comma-separated passi o |
| --subfinder-exclude-sources | Comma-separated passi to exclude |
| --subfinder-all | Use all subfinder passi |
| --subfinder-recursive | Use only recursi passi |
| --subfinder-max-time | Max passi time in minutes |
| --subfinder-rate-limit | Passi HTTP requests/second |
| --subfinder-threads | Passi threads |
| --subfinder-pro | Path to subfinder provider config |
| --scan-cdn | Scan all ports on CDN hosts (default: 80/443 only) |
| --udp | Enable UDP scanning (ports 53, 123, 161, 500 by default) |
| --crawl | Crawl HTTP/HTTPS services for endpoints, sensiti, and app fingerprinting |
| --crawl-depth | Max crawl depth (default: 2) |
| --tls-enum | Enumerate supported TLS and cipher suites (~60 connections per TLS port, off by default) |
| --tls- | TLS certificates for TLS inspection, crawl, header probe, and TLS enumeration |
| --context | Asset context YAML file (auto-loads config/context.yaml if present) |
| --analyze | Detailed AI security analysis API (requires TOGETHER_API_KEY) |
| --json | JSON output |
| --jsonl | JSONL streaming output |
| --csv | CS |

flan Flags

| Flag | Description |
|------|-------------|
| --input, -i | Path to scan results in JSON or JSONL format; use - for stdin |
| --json | Emit the unified summary and findings as JSON |
| --run | Run Nuclei against derived HTTP targets and merge results into findings |
| --templates | Comma-separated Nuclei template files or directories |
| --template-url | Comma-separated remote Nuclei template URLs |
| --workflows | Comma-separated Nuclei workflow files or directories |
| --workflow-url | Comma-separated remote Nuclei workflow URLs |
| --tags | Comma-separated Nuclei tags |
| --se | Comma-separated Nuclei se |
| --rate-limit | Nuclei requests per second |
| --timeout | Nuclei per-request timeout in seconds |

Tests

License

BSD 3-Clause License

项目信息

开发语言：Go

Star 数：21

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A modular, extensible vulnerability scanner in Go. 展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。