fscanx

Because the Go standard library net/proxy does not support UDP for SOCKS5, this project implements custom SOCKS5 UDP proxying logic in mylib\proxy and mylib\socks.

When using common.WrapperTcpWithTimeout with the network parameter set to "udp", the returned connection is an instance of *socks.UDPConnSocks5. To read from this connection, you must use the ReadFrom method instead of the standard Read method used for TCP.

// Example of handling both TCP and custom SOCKS5 UDP connections
if tConn, ok := conn.(*net.TCPConn); ok {
	for {
		count, err := tConn.Read(buf)
		if err != nil {
			break
		}
		result = append(result, buf[0:count]...)
		if count < size {
			break
		}
	}
} else if uConn, ok := conn.(*socks.UDPConnSocks5); ok {
	for {
		count, _, err := uConn.ReadFrom(buf)
		if err != nil {
			break
		}
		result = append(result, buf[0:count]...)
		if count < size {
			break
		}
	}
}

The Framework struct is the standard output format for fingerprint detection. It provides mapping to CPE standards and supports several metadata features:

• Name: The fingerprint name.
• From/Froms: Tracks the source(s) of the fingerprint. When merging fingerprints, multiple sources are recorded in the Froms map.
• Tags: Custom string tags.
• IsFocus: A boolean flag for high-priority fingerprints.
• Attributes: Contains NVD-compatible WFN (Wolfram Function Language) attributes such as Vendor, Product, Version, Part, etc.

Output Format: Calling .String() on a Framework produces a compact string like: tomcat:8.5.81:(goby fingers fingerprinthub).

type Framework struct {
    Name        string        `json:"name"`
    From        From          `json:"-"` 
    Froms       map[From]bool `json:"froms,omitempty"`
    Tags        []string      `json:"tags,omitempty"`
    IsFocus     bool          `json:"is_focus,omitempty"`
    *Attributes `json:"attributes,omitempty"`
}

type Attributes struct {
    Part      string `json:"part" yaml:"part"`
    Vendor    string `json:"vendor" yaml:"vendor"`
    Product   string `json:"product" yaml:"product"`
    Version   string `json:"version,omitempty" yaml:"version,omitempty"`
    // ... other fields like Update, Edition, etc.
}

The alias system solves the problem of inconsistent naming across different fingerprinting libraries. It maps various engine-specific names to a single, normalized identity with fixed Vendor and Product fields (useful for CPE support).

Key Alias Configuration Fields:

• name: The normalized name shown to the user.
• vendor / product: Used to construct CPE identifiers.
• label: Comma-separated categories (e.g., web,server,proxy).
• priority: Importance/confidence level (0-5).
• target: Test URLs or IP:Port addresses for validation.
• alias: A map where keys are engine names and values are the names used by those engines to represent the normalized product.
• block: A list of engines to ignore if they produce a specific fingerprint, used to mitigate false positives.

Example Configuration (nginx):

- name: nginx
  vendor: nginx
  product: nginx
  label: web,server,proxy
  priority: 2
  target:
    - https://nginx.org
  alias:
    fingers: [nginx]
    wappalyzer: [Nginx]

To register a custom fingerprinting engine, your implementation must satisfy the EngineImpl interface. This allows you to extend the Engine with new detection logic.

Required Interface:

type EngineImpl interface {
	Name() string
	Compile() error
	Len() int
	Capability() common.EngineCapability
	WebMatch(content []byte) common.Frameworks
	ServiceMatch(host string, port int, level int, sender common.ServiceSender, callback common.ServiceCallback) *common.ServiceResult
}

Capability Declaration: Each engine must declare its capabilities via Capability(), specifying whether it supports SupportWeb or SupportService identification.

Registration: Use the Register method on an existing Engine instance to add your custom implementation.

// Registering a custom engine
func RegisterCustomEngine(engine *fingers.Engine) error {
    customEngine, err := NewCustomEngine()
    if err != nil {
       return err
    }
    engine.Register(customEngine)
    return nil
}

The fingers engine implements multiple fingerprint libraries to allow a single scan to match against several different rule sets simultaneously. The supported libraries include:

• fingers (Native): The primary library with the most features, including multiple configuration methods, version matching, 404/favicon/WAF/CDN/Supply Chain identification, active fingerprinting, and high-performance optimizations (caching, regex pre-compilation, default ports, and priority algorithms).
• wappalyzer: An implementation of the Wappalyzer fingerprint library (forked from projectdiscovery/wappalyzergo). It unifies output results into a frameworks format. Rules are synchronized via weekly GitHub Actions.
• fingerprinthub: A Go implementation of the rules from FingerprintHub. This repository performs rule synchronization via weekly GitHub Actions.
• ehole: A Go implementation of the rules from EHole. This repository performs rule synchronization via weekly GitHub Actions.
• goby: A Go implementation of rules reverse-engineered from the goby community tool.