---
name: "scanssh"
section: "1"
platform: "linux"
package: "scanssh"
version: "2.1.3.1-0.2"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/scanssh"
---

# scanssh(1)

scans the Internet for open proxies and SSH servers

## NAME

**scanssh** – scans the Internet for open proxies and SSH servers

## SYNOPSIS

**scanssh** \[**-VIERph**\] \[**-s** *scanners,...*\] \[**-n** *ports,...*\] \[**-u** *socks* *hosts,...*\] \[**-e** *excludefile*\] *addresses...*

## DESCRIPTION

**ScanSSH** scans the given addresses and networks for running services. It mainly allows the detection of open proxies and Internet services. For known services, **ScanSSH** will query their version number and displays the results in a list.

The adresses can be either specified as an IPv4 address or an CIDR like IP prefix, *ipaddress/masklength*. Ports can be appended by adding a colon at the end of address specification.

Additionally, the following two commands can be prefixed to the address:

- random(n\[,seed\])/

  The random command selects random address from the address range specified.  The arguments are as follows: *n* is the number of address to randomly create in the given network and *seed* is a seed for the pseudo random number generator.

- split(s,e)/

  The split command is used to split the address range in several unique components.  This can be use to scan from serveral hosts in parallel. The arguments are as follows: *e* specifies the number of hosts scanning in parallel and *s* is the number of the host this particular scan runs on.

The options are as follows:

- **-V**

  Causes **scanssh** to print its version number.

- **-I**

  Does not send a SSH identification string.

- **-E**

  Exit the program, if the file containing the addresses for exclusion can not be found.

- **-R**

  If addresses are generated at random, this flag causes the program to ignore excluded addresses from the exclude file.  The default behaviour is to always exclude addresses.

- **-p**

  Specifies that **ScanSSH** should operate as a proxy detector. This flag sets the default modes and default scanners to detect open proxies.

- **-h**

  Displays the usage of the program.

- **-n** *ports,...*

  Specifies the port numbers to scan. Ports are separated by commas. Each specified scanner is run for each port in this list. The default is 22.

- **-u** *socks* *hosts,...*

  A list of comma separated host:port pairs of SOCKS proxies that **scanssh** should use to scan through.

- **-s** *scanners*

  Specifies a number of scanners should be executed for each open port. Multiple scanners are separated by commas. The following scanners are currently supported:

  - ssh

    Finds versions for SSH, Web and SMTP servers.

  - socks5

    Detects if a SOCKS V5 proxy is running on the port.

  - socks4

    Detects if a SOCKS V4 proxy is running on the port.

  - http-proxy

    Detects a HTTP get proxy.

  - http-connect

    Detects a HTTP connect proxy.

  - telnet-proxy

    Detects telnet based proxy servers.

- **-e** *excludefile*

  Specifies the file that contains the addresses to be excluded from the scan. The syntax is the same as for the addresses on the command line.

The output from  **scanssh** contains only IP addresses.  However, the IP addresses can be converted to names with the [logresolve(8)](/logresolve/8.md) tool included in the Apache webserver.

## EXAMPLES

The following command scans the class C network 10.0.0.0 - 10.0.0.255 for open proxies:

```
scanssh -p 10.0.0.0/24
```

The next command scans for ssh servers on port 22 only:

```
scanssh -n 22 -s ssh 192.168.0.0/16
```

The following command can be used in a parallel scan.  Two hosts scan the specified networks randomly, where this is the first host:

```
scanssh 'random(0,rsd)/split(1,2)/(192.168.0.0/16 10.1.0.0/24):22,80'
```

## BUGS

At the moment,  **scanssh** leaves a one line entry in the log file of the ssh server.  It is probably not possible to avoid that.