ek0mssavi0r/Flock_SCAN
1
0
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update README.md

Browse Source
This commit is contained in:
ek0ms savi0r
2026-07-19 06:02:17 +00:00
parent e6c41a69a6
commit 61d21be3f9
1 changed files with 19 additions and 41 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+19 -41
View File
@@ -1,6 +1,5 @@
<p align="center"> <p align="center">
<img src="https://img.shields.io/badge/Flock_Scan-v3.1-red?style=flat-square&logo=appveyor" /> <img src="https://img.shields.io/badge/Flock_Scan-v3.1-red?style=flat-square&logo=appveyor" />
<img src="https://img.shields.io/badge/CVEs-4-brightgreen-brightgreen?style=flat-square" />
<img src="https://img.shields.io/badge/license-MIT-blue?style=flat-square" /> <img src="https://img.shields.io/badge/license-MIT-blue?style=flat-square" />
</p> </p>
@@ -13,7 +12,7 @@
╚═╝ ╚══════╝ ╚═════╝ ╚═════╝╚═╝ ╚═╝ ╚══════╝ ╚═════╝╚═╝ ╚═╝╚═╝ ╚═══╝ ╚═╝ ╚══════╝ ╚═════╝ ╚═════╝╚═╝ ╚═╝ ╚══════╝ ╚═════╝╚═╝ ╚═╝╚═╝ ╚═══╝
``` ```
Multi-mode Flock Safety security assessment tool. Multi-mode Flock Safety security assessment tool. Flock_scan is intended to see what else we are not seeing. Our hardwear hacker homies are killing it on scanning the phsyical layer so i built flock_scan to help scan the network and application layers.
--- ---
@@ -157,7 +156,24 @@ TLS Traffic Categories:
pip install requests pip install requests
sudo python3 scanner.py sudo python3 scanner.py
``` ```
### Enrichment Mode (v3.0+)
```bash
# Add --enrich to any scan for extra data collection
sudo python3 scanner.py -t 192.168.1.100 --enrich
sudo python3 scanner.py -f targets.txt --enrich --output enriched_scan.json
sudo python3 scanner.py --discover 192.168.1.0/24 --enrich -v
```
**What --enrich adds:**
- **Banner grabber** -- HTTP headers (Server, X-Powered-By, Via, cookies), FTP banner (SpeedPourer version), TLS cert (SANs, issuer, expiry), SSH version
- **Cloud provider enrichment** -- IP → ASN/org/provider via ip-api.com + WHOIS fallback (AWS, GCP, Azure, Cloudflare, etc.)
- **Telemetry detection** -- Google Analytics IDs, Hotjar, Sentry, Facebook Pixel, Segment, and 30+ other SaaS services
- **ADB deep collect** -- WiFi SSID/BSSID, gateway, DNS servers, ARP table, uptime, processes, battery state, installed packages, logcat errors
- **Network map** -- Passive subnet discovery via ARP table + MAC OUI vendor resolution
- **Credential extractor** -- Scans HTTP bodies for leaked M2M OAuth client_id/secret, webhook API keys, Auth0 configs, org UUIDs
- **Prometheus scraper** -- Probes local network for open Prometheus/Grafana instances, scrapes targets + metrics
- **S3 URL catcher** -- Extracts signed S3 image URLs from captured traffic (flock-hibiki-inbox, hotlist, webhook payloads)
### CVE Scanning ### CVE Scanning
```bash ```bash
sudo python3 scanner.py -t 192.168.1.100 sudo python3 scanner.py -t 192.168.1.100
@@ -193,23 +209,7 @@ sudo python3 scanner.py --tap-pcap capture.pcap --tap-output report.json
sudo tcpdump -i eth0 -l -nn | sudo python3 scanner.py --tap-pipe -v sudo tcpdump -i eth0 -l -nn | sudo python3 scanner.py --tap-pipe -v
``` ```
### Enrichment Mode (v3.0+)
```bash
# Add --enrich to any scan for extra data collection
sudo python3 scanner.py -t 192.168.1.100 --enrich
sudo python3 scanner.py -f targets.txt --enrich --output enriched_scan.json
sudo python3 scanner.py --discover 192.168.1.0/24 --enrich -v
```
**What --enrich adds:**
- **Banner grabber** -- HTTP headers (Server, X-Powered-By, Via, cookies), FTP banner (SpeedPourer version), TLS cert (SANs, issuer, expiry), SSH version
- **Cloud provider enrichment** -- IP → ASN/org/provider via ip-api.com + WHOIS fallback (AWS, GCP, Azure, Cloudflare, etc.)
- **Telemetry detection** -- Google Analytics IDs, Hotjar, Sentry, Facebook Pixel, Segment, and 30+ other SaaS services
- **ADB deep collect** -- WiFi SSID/BSSID, gateway, DNS servers, ARP table, uptime, processes, battery state, installed packages, logcat errors
- **Network map** -- Passive subnet discovery via ARP table + MAC OUI vendor resolution
- **Credential extractor** -- Scans HTTP bodies for leaked M2M OAuth client_id/secret, webhook API keys, Auth0 configs, org UUIDs
- **Prometheus scraper** -- Probes local network for open Prometheus/Grafana instances, scrapes targets + metrics
- **S3 URL catcher** -- Extracts signed S3 image URLs from captured traffic (flock-hibiki-inbox, hotlist, webhook payloads)
--- ---
@@ -336,30 +336,8 @@ sudo python3 scanner.py -t 192.168.1.100 --exploit
--- ---
## File Layout
```
FLOCK_scan/
├── scanner.py # Main tool (CVE scan + discovery + traffic analysis)
├── flock_tap.py # Passive traffic monitor (callbacks, FRP, SNI, DNS)
├── shodan_queries.py # Shodan dork generator
├── run_scanner.sh # Quick-launch script
├── masscan_wrapper.sh # Masscan integration
├── modules/ # Enrichment modules (v3.1+)
│ ├── __init__.py
│ ├── banner_grabber.py # HTTP/FTP/TLS/SSH banner collection
│ ├── cloud_enrich.py # IP → ASN/org/cloud provider
│ ├── telemetry.py # Analytics, pixels, JS endpoints
│ ├── adb_deep.py # Extended ADB props (route, wifi, DNS, processes)
│ ├── network_map.py # ARP-based passive subnet discovery
│ ├── creds_extractor.py # Leaked M2M tokens, webhook API keys, auth configs
│ ├── prometheus_scraper.py # Prometheus/Grafana discovery on local network
│ └── s3_url_catcher.py # Signed S3 image URL extraction from traffic
└── README.md
```
--- ---
<p align="center"> <p align="center">
<sub>Authorized security testing only. Use on systems you own or have written permission to test.</sub> <sub>Authorized security testing only. Use on systems you own or have written permission to test.</sub>
</p> </p>