ShadowSecurityScanner - Free, open-source network vulnerability scanner &

项目说明

ShadowSecurityScanner

!Go
!License: MIT
!Platforms
!Latest release
!Stars

ShadowSecurityScanner is a free penetration testing tool and **network
scanner**. It performs port scanning, service & OS fingerprinting, and
thousands of catalogued network and web checks, then ranks every finding by real-world
exploit probability — EPSS (FIRST.org) + CISA KEV — not just raw CVSS. A single
self-contained desktop app for Windows, macOS and Linux. No cloud, no agents, no telemetry.

> Open-core. The desktop app is free to use; its core exploit-aware components are
> open-source (MIT) and live in this repository — read, audit and reuse them below.

Download

Get the latest build for your platform from the
Releases page:

| Platform | File |
|---|---|
| Windows (x64) | ShadowSecurityScanner-windows-amd64.exe |
| Windows (ARM64) | ShadowSecurityScanner-windows-arm64.exe |
| macOS (Apple Silicon) | ShadowSecurityScanner-macos-arm64.dmg |
| Linux (x64) | ShadowSecurityScanner-linux-amd64 |
| Linux (ARM64) | ShadowSecurityScanner-linux-arm64 |

No installer required. On Linux: chmod +x and run. On macOS: first launch, right-click → Open.

Open-source components

This repository hosts the open-source, MIT-licensed parts of ShadowSecurityScanner as
reusable Go packages and CLIs.

epsskev — EPSS + CISA KE

Fetch FIRST.org EPSS scores and CISA KE for any list of CVEs and sort them
fix-first (KEV → EPSS → CVSS).

sarif — findings → SARIF 2.1.0

Convert findings into a SARIF 2.1.0 document for GitHub code scanning,
with per-C, NVD helpUri and GitHub security-se.

triage — findings → enrich → SARIF (end to end)

Read findings as JSON (see
findings/findings.schema.json), enrich them with
EPSS + CISA KEV, sort fix-first, and print a ranked table or a SARIF report.

Build the libraries

Legal & ethical use

For authorized security testing only — scan systems you own or are explicitly
permitted to assess. Denial-of-service tests are intentionally excluded.

License

MIT — © AndriiGordiienko.

项目信息

开发语言：Go

Star 数：8

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Free, open-source network vulnerability scanner & penetration testing tool that ranks findings by real-world exploitability (EPSS + CISA KEV). Single desktop app for Windows, macOS, Linux. No cloud, no telemetry. MIT.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。