Skip to content

xkillx/specter

BranchesTags

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

5 Commits
examples
examples
 
 
src
src
 
 
.gitignore
.gitignore
 
 
Cargo.lock
Cargo.lock
 
 
Cargo.toml
Cargo.toml
 
 
README.md
README.md
 
 
build.rs
build.rs
 
 
fingerprints.yaml
fingerprints.yaml
 
 
specter.yaml
specter.yaml
 
 

Repository files navigation

Specter

A fast, modern network port and service fingerprinting tool written in Rust.

Rust License

Specter is a next-generation security scanner that goes beyond simple port detection. It identifies services, versions, and known vulnerabilities with high confidence using advanced fingerprinting techniques.

Features

  • Fast async port scanning - Scan thousands of ports in seconds
  • Multi-protocol probing - HTTP, HTTPS (TLS), SSH, FTP, SMTP
  • Service fingerprinting - Identify services with confidence scoring
  • CVE detection - Match services against known vulnerabilities
  • Beautiful output - Colored terminal output with progress bars
  • JSON export - Machine-readable output for automation/CI/CD
  • Profile presets - Quick scan profiles for common scenarios

Installation

From source

git clone https://github.com/xkillx/specter.git
cd specter
cargo build --release

The binary will be available at target/release/specter.

Using cargo (not yet published)

cargo install specter

Quick Start

Basic port scan:

specter scan example.com --ports 1-1000

Full service fingerprinting:

specter scan example.com --ports 1-1000 --probes --features --fingerprint

JSON output for automation:

specter scan example.com --json --probes --features --fingerprint

Usage

Basic Syntax

specter scan <TARGET> [OPTIONS]

Options

Option Description Default
--ports <RANGE> Port range (e.g., 1-1000, 80,443,8080) 1-1000
-c, --concurrency <N> Concurrent connections 100
-t, --timeout <MS> Timeout per port (ms) 1000
--probes Enable protocol probing false
--probe-timeout <MS> Probe timeout (ms) 2000
--features Enable feature extraction false
--fingerprint Enable fingerprint matching false
--min-confidence <N> Minimum confidence (0.0-1.0) 0.5
--fingerprint-db <PATH> Fingerprint database path fingerprints.yaml
--json Output as JSON false
--json-compact Compact JSON output false
--json-output <FILE> Write JSON to file -
--profile <PROFILE> Use scan preset (fast/full/stealth) -
-v, --verbose Verbose mode (can be used multiple times) -
-q, --quiet Quiet mode (minimal output) -
--no-color Disable colored output -
--config <PATH> Config file path -
-h, --help Print help -
-V, --version Print version -

Port Range Formats

  • Single port: --ports 80
  • Range: --ports 1-1000
  • Multiple: --ports 80,443,8080
  • Mixed: --ports 1-100,443,8080-9000

Scan Profiles

Profile Description Ports Concurrency Timeout
fast Quick scan of common ports 22,80,443,8080 200 500ms
full Deep scan with all features 1-65535 100 1000ms
stealth Slow scan to avoid detection 1-1000 10 3000ms

Example:

specter scan example.com --profile fast

Output Formats

Human-Readable Output

════════════════════════════════════ Specter Scanner ════════════════════════════════════
Target: example.com

Scanning 1000 ports...
  ✓ Port 22 is open
  ✓ Port 80 is open
  ✓ Port 443 is open

┌─────────────────────────────────────────────┐
│ Port 443/TCP ────────────────────────────── │
├─────────────────────────────────────────────┤
│ Service: nginx 1.18.0                       │
│ Confidence: 94% ████████████                │
├─────────────────────────────────────────────┤
│ Evidence:                                   │
│   ✓ [nginx_http_server] (weight: 0.9)       │
├─────────────────────────────────────────────┤
│ ⚠ Known CVEs:                              │
│   • CVE-2021-23017                          │
└─────────────────────────────────────────────┘

Summary:
  Ports scanned: 1000
  Open ports: 3
  Services identified: 3
  Total time: 2.31s
  Throughput: 432 ports/sec

JSON Output

{
  "target": {
    "host": "example.com",
    "ip": "93.184.216.34",
    "scan_time": "2026-02-06T10:30:00Z",
    "scan_duration_ms": 2310,
    "ports_scanned": 1000,
    "open_ports": 3
  },
  "results": {
    "443": {
      "port": 443,
      "status": "open",
      "protocol": "tcp",
      "service_detection": {
        "service": "nginx",
        "version": "1.18.0",
        "confidence": 0.94,
        "matched_rules": ["nginx_http_server"]
      },
      "features": {
        "http": {
          "server": "nginx/1.18.0",
          "status_code": 200
        },
        "tls": {
          "version": "TLSv1.3",
          "cipher_suite": "TLS_AES_256_GCM_SHA384"
        }
      },
      "vulnerabilities": [
        {
          "cve_id": "CVE-2021-23017",
          "severity": "HIGH"
        }
      ]
    }
  },
  "summary": {
    "services_detected": ["nginx", "openssh"],
    "total_cves": 1,
    "high_severity_cves": 1
  }
}

Configuration

Specter supports configuration files in YAML format. Config files are loaded from:

  1. $XDG_CONFIG_HOME/specter/specter.yaml
  2. ~/.config/specter/specter.yaml
  3. ./specter.yaml

Example Config File

# specter.yaml

# Default scan options
defaults:
  ports: "1-1000"
  concurrency: 100
  timeout: 1000
  probe-timeout: 3000

# Output preferences
output:
  format: "pretty"  # pretty, json, compact
  show-features: true
  show-cves: true

# Fingerprinting
fingerprinting:
  enabled: true
  min-confidence: 0.5
  database: "fingerprints.yaml"

# Colors
colors:
  enabled: true

Fingerprinting

Specter uses a YAML-based fingerprint database to identify services. The database includes rules for:

  • Web servers (nginx, Apache, IIS, Cloudflare)
  • SSH servers (OpenSSH, Dropbear)
  • FTP servers (vsftpd, ProFTPD)
  • SMTP servers (Postfix, Sendmail)
  • And more...

Custom Fingerprint Rules

You can extend the fingerprint database by adding custom rules to fingerprints.yaml:

rules:
  - id: my_custom_service
    service: MyCustomService
    description: "My custom service detection"
    protocol: HTTP
    weight: 0.9
    conditions:
      http:
        server_pattern: "MyCustomService.*"
        header_patterns:
          x-custom-header: ".*"

Rule Syntax

Field Type Description
id string Unique rule identifier
service string Service name
description string Rule description
protocol string Protocol (HTTP, TLS, SSH, FTP, SMTP)
weight float Confidence weight (0.0-1.0)
conditions object Matching conditions
min_matches int Minimum condition matches required

Performance Tuning

Concurrency

Higher concurrency = faster scans, but more resource usage:

# Fast scan (may trigger IDS/IPS)
specter scan example.com --concurrency 500

# Normal scan
specter scan example.com --concurrency 100

# Slow/stealth scan
specter scan example.com --concurrency 10

Timeouts

Adjust timeouts based on network conditions:

# Fast network
specter scan example.com --timeout 500 --probe-timeout 1000

# Slow/unreliable network
specter scan example.com --timeout 3000 --probe-timeout 10000

Examples

Scan common ports

specter scan example.com --profile fast

Full audit with fingerprinting

specter scan example.com --ports 1-65535 --probes --features --fingerprint

JSON output to file

specter scan example.com --json --json-output results.json --probes --features

Quiet mode (scripts)

specter scan example.com --quiet --probes --fingerprint

Verbose debugging

specter scan example.com --vv --probes

CI/CD integration

#!/bin/bash
# Exit on CVE detection
specter scan example.com --json --probes --fingerprint | \
  jq '.summary.total_cves' | \
  if grep -q "[1-9]"; then
    echo "Vulnerabilities found!"
    exit 1
  fi

Exit Codes

Code Meaning
0 Success
1 General error
2 DNS resolution failed
3 Connection failed
4 Invalid input/configuration
5 File I/O error
6 Database error

Troubleshooting

No open ports found

  • Increase timeout: --timeout 3000
  • Check network connectivity: ping example.com
  • Try nmap for comparison: nmap -p 1-1000 example.com

Fingerprint not matching

  • Lower confidence threshold: --min-confidence 0.3
  • Enable verbose mode: --verbose to see features
  • Check fingerprint database: --fingerprint-db

Slow scanning

  • Increase concurrency: --concurrency 200
  • Use fast profile: --profile fast
  • Scan fewer ports: --ports 1-100

Connection timeouts

  • Increase timeout: --timeout 5000
  • Check firewall rules
  • Verify target is reachable

Contributing

Contributions are welcome! Please:

  1. Fork the repository
  2. Create a feature branch
  3. Make your changes
  4. Add tests
  5. Submit a pull request

Development

# Clone the repo
git clone https://github.com/xkillx/specter.git
cd specter

# Run tests
cargo test

# Run with debug output
cargo run -- scan example.com --vv --probes

# Build release
cargo build --release

License

MIT License - see LICENSE for details.

Acknowledgments

  • Inspired by nmap, masscan, and zmap
  • Built with Rust and the Tokio async runtime
  • Uses clap for CLI parsing and indicatif for progress bars

Disclaimer

This tool is for educational and authorized security testing purposes only. Unauthorized scanning of networks you do not own or have permission to test is illegal. Use responsibly.

About

Network port and service fingerprinting tool written in Rust.

Resources

Readme
Activity

Stars

0 stars

Watchers

0 watching

Forks

0 forks
Report repository

Releases

No releases published

Packages

 
 
 

Contributors

Languages