stackscan

Full web stack, infrastructure, DNS, port, subdomain and CVE analyzer — one command, one colorized report.

stackscan takes one or more targets, fetches them over HTTP(S), and prints a single colorized panel report covering the technology stack, the edge and network infrastructure, full DNS, IP ownership, open ports, subdomains, and known CVEs. A signature database and a compressed CVE database ship inside the package, so it works out of the box.

Every default pass only reads what a server voluntarily returns. The active passes — --ports and --default-creds — open connections the target did not solicit and are opt-in. Only scan systems you are authorized to test.

📦 Installation

pip install "stackscan"

# optional extra
pip install "stackscan[geo]"   # offline IP geolocation via geoip2 + a MaxMind .mmdb

nmap is used for port scans when present; without it a pure-Python scanner is used automatically.

Inside the reekeer shell

stackscan is also a reekeer plugin, mounted at /tools/recon/stackscan (alias ss):

reekeer exec /plugins install reekeer/stackscan

Hosted there it drops the banner and the window title and hands the scan back as data for reekeer to render in the shell's own tables, so it reads as a command of the shell rather than a script being shelled out to. Every flag behaves the same, and standalone (pip, uvx stackscan) is unchanged.

In reekeer's window the scan also gets a form. stackscan says which of its flags are worth a control — the targets, the four switches that decide how deep a scan goes, and the bounds worth changing when one is too slow — and reekeer draws those. The rest are not hidden: the argument line under the form still takes anything argparse takes, --help included.

✨ Features

🧩 Stack & infrastructure

• Technologies — 7.5k-technology bundled sigdb, classified by category.
• Edge — CDN, WAF, reverse proxy and server software from response metadata.
• TLS — certificate issuer, SANs, validity window, protocol and cipher.

🌐 Network & DNS

• Full DNS — A/AAAA, reverse DNS, CNAME, MX, NS, TXT, SOA, CAA.
• IP intelligence — hosting org / ISP / ASN / location for non-CDN origins via ipwho.is.
• Subdomains — AXFR + the popularity-ranked SecLists DNS list over a fast async resolver pool, with wildcard filtering + TLS SANs.

🔎 Ports & vulnerabilities

• Ports — nmap -sV via python-nmap, or a built-in async connect scan with banner/HTTP/RTSP fingerprinting.
• CVEs — offline NVD-sourced database with per-match confidence % and CVSS severity; --cve-online adds a live lookup.
• Default creds / open devices — a bounded, authorized-only check for cameras / routers / panels reachable without a password or with factory-default logins (SecLists default-credentials).

🎛 Output

• Colorized per-target panels, a --compact table, or --json.
• Every run prints the banner and the total scan time.

🚀 Usage

# Scan one or more targets
stackscan example.com https://another.example

# Everything at once: ports, subdomains, online CVEs, IP info, default-cred check
stackscan --full example.com

# Individual deep passes
stackscan --ports --subdomains example.com
stackscan --cve-online example.com

# Speed / coverage knobs
stackscan --full --workers 500 --subdomain-limit 10000 example.com
stackscan --full --site-limit 20 --workers 200 example.com

# JSON (full detail, includes timing) or a compact table
stackscan --json example.com
stackscan --compact a.example b.example

Bare hostnames are normalized to https://.

⚡ Benchmark

Below are performance benchmarks conducted on two production targets using different scanning options (tested on Python 3.12 / macOS).

1. github.com Scan Performance

2. kmtn.ru Deep Scan Performance

3. microsoft.com Scan Performance

🧭 Options

⚙️ Configuration

• Signature sources: stackscan sigdb add|list|update|remove … (recorded under $XDG_CONFIG_HOME/stackscan/).
• Downloaded wordlists (SecLists DNS list, default-credential list): cached under ~/.local/stackscan/db/.
• Refresh the CVE database: python scripts/build_cve_db.py.

🛰 Runner mode

stackscan --runner turns the scanner into a worker for a StackScan panel: it claims jobs (POST /api/jobs/claim), fingerprints each target with the normal engine, and posts the results back (POST /api/results). It needs nothing but network access to the panel — no database, no Redis, no shared filesystem.

STACKSCAN_BACKEND_URL=https://panel.example STACKSCAN_WORKER_TOKEN=… \
  stackscan --runner

Every one has a flag (--backend, --worker-token, --runner-id, --batch, --sigdb, --user-agent), and --once runs a single claim/scan/report cycle, which is what you want in a cron job or a smoke test. The runner profile is deliberately lean — DNS, TLS, geo and IP info, no ports, CVEs or brute passes — because it is meant for volume rather than depth.

Packaged for it:

docker build -t stackscan:latest .
docker run --rm -e STACKSCAN_BACKEND_URL=http://panel:8787 \
  -e STACKSCAN_WORKER_TOKEN=… stackscan:latest

Runner mode is refused inside the reekeer shell: it is a loop that runs until it is killed, and a shell command that never answers is not a command.

🚀 Smart Scan Pipeline

The Smart Scan engine performs multiple analysis stages to collect infrastructure, technology, and security information about the target before generating the final report.

flowchart TD

    A["🎯 Target<br/>Domain / URL"]

    subgraph S1["1. Target Resolution"]
        B["Normalize Target"]
        C["DNS Resolution"]
        C1["IPv4 / IPv6"]
        C2["DNS Records<br/>MX • NS • TXT • CNAME • SOA • CAA"]
        C3["Reverse PTR"]
        B --> C
        C --> C1
        C --> C2
        C --> C3
    end

    subgraph S2["2. HTTP Discovery"]
        D["HTTPS Request"]
        D1{"TLS Error?"}
        D2["HTTP Fallback"]
        D3["Headers • Body • Cookies"]
        D --> D1
        D1 -->|Yes| D2
        D1 -->|No| D3
        D2 --> D3
    end

    subgraph S3["3. Infrastructure Detection"]
        E["Header & Cookie Analysis"]
        F["IP Intelligence"]
        G{"CDN / WAF / Proxy"}
        E --> G
        F --> G
    end

    subgraph S4["4. Port Discovery"]
        H{"Smart Scan"}
        I["Target Scan"]
        J["Enumerate Subdomains<br/>Collect All IPs"]
        K["Nmap / Async Connect"]
        L["Banner & HTTP Fingerprinting"]
        H -->|Disabled| I
        H -->|Enabled| J
        I --> K
        J --> K
        K --> L
    end

    subgraph S5["5. Technology Detection"]
        M["Headers"]
        N["Cookies"]
        O["HTML & Meta"]
        P["JavaScript"]
        Q["URL Patterns"]
        R["SigDB (7500+ Signatures)"]
    end

    subgraph S6["6. Advanced Analysis"]
        S["Subdomain Enumeration"]
        T["CVE Matching"]
        U["Default Credentials"]
    end

    subgraph S7["7. Report"]
        V["Security Report"]
    end

    A --> B
    C --> D
    D3 --> E
    C1 --> F
    G --> H

    L --> M
    L --> N
    L --> O
    L --> P
    L --> Q
    L --> R

    M --> S
    N --> S
    O --> T
    P --> T
    Q --> U
    R --> U

    S --> V
    T --> V
    U --> V

    classDef start fill:#2563eb,color:#fff,stroke:#1d4ed8,stroke-width:2px;
    classDef phase fill:#7c3aed,color:#fff,stroke:#6d28d9,stroke-width:2px;
    classDef decision fill:#f59e0b,color:#fff,stroke:#b45309,stroke-width:2px;
    classDef finish fill:#16a34a,color:#fff,stroke:#166534,stroke-width:2px;

    class A start;
    class B,C,C1,C2,C3,D,D2,D3,E,F,I,J,K,L,M,N,O,P,Q,R,S,T,U phase;
    class D1,G,H decision;
    class V finish;

Pipeline Stages

🗂 Structure

stackscan/
├── src/stackscan/
│   ├── analyzers/     ← tech, infra, security, exposure, cve, creds
│   ├── net/           ← dns, tls, geo, ipinfo, ports, fingerprint, subdomains
│   ├── config/        ← bundled + sourced sigdb loading
│   ├── data/          ← builtin.sigdb, cve.json.gz, subdomains.txt
│   ├── render.py      ← the colorized panel report
│   ├── embed.py       ← findings as data, and the form, for reekeer to draw
│   ├── runner.py      ← panel worker: claim jobs, scan, report back
│   ├── scan.py        ← per-target orchestration
│   └── cli.py         ← argument parsing and entry point
├── scripts/           ← build_cve_db.py (NVD → offline dataset)
└── tests/

🛠 Development

ruff check . && black --check . && pyright && pytest

_{MIT © reekeer}