s0md3v / smap

a drop-in replacement for Nmap powered by shodan.io

passive Nmap like scanner built with shodan.io

---

Smap is a port scanner built with shodan.io's free API. It takes same command line arguments as Nmap and produces the same output which makes it a drop-in replacament for Nmap.

Features

• Scans 200 hosts per second
• Doesn't require any account/api key
• Vulnerability detection
• Supports all nmap's output formats
• Service and version fingerprinting
• Makes no contact to the targets

Installation

Binaries

You can download a pre-built binary from here and use it right away.

Manual

go install -v github.com/s0md3v/smap/cmd/smap@latest

Confused or something not working? For more detailed instructions, click here

AUR pacakge

Smap is available on AUR as smap-git (builds from source) and smap-bin (pre-built binary).

Homebrew/Mac

Smap is also avaible on Homebrew.

brew update
brew install smap

Usage

Smap takes the same arguments as Nmap but options other than -p, -h, -o*, -iL are ignored. If you are unfamiliar with Nmap, here's how to use Smap.

Specifying targets

smap 127.0.0.1 127.0.0.2

You can also use a list of targets, seperated by newlines.

smap -iL targets.txt

Supported formats

1.1.1.1         // IPv4 address
example.com     // hostname
178.23.56.0/8   // CIDR

Output

Smap supports 6 output formats which can be used with the -o* as follows

smap example.com -oX output.xml

If you want to print the output to terminal, use hyphen (-) as filename.

Supported formats

oX    // nmap's xml format
oG    // nmap's greppable format
oN    // nmap's default format
oA    // output in all 3 formats above at once
oP    // IP:PORT pairs seperated by newlines
oS    // custom smap format
oJ    // json

Note: Since Nmap doesn't scan/display vulnerabilities and tags, that data is not available in nmap's formats. Use -oS to view that info.

Specifying ports

Smap scans these 1237 ports by default. If you want to display results for certain ports, use the -p option.

smap -p21-30,80,443 -iL targets.txt

Considerations

Since Smap simply fetches existent port data from shodan.io, it is super fast but there's more to it. You should use Smap if:

You want

• vulnerability detection
• a super fast port scanner
• results for most common ports (top 1237)
• no connections to be made to the targets

You are okay with

• not being able to scan IPv6 addresses
• results being up to 7 days old
• a few false negatives

smap's Issues

json format -oJ

Hi,
The json output format not working.
The file output is empty.

[Question] Smap display cve

Hi,

With Nmap, if I use vulners scripts, I can have a possible cve list that permit me to know if my system has a cve not patched.

the following nmap command is: nmap -sV --script vulners

With Smap, is it possible to have the result in order to know actives cve on network/hosts?
If yes, what is the command to execute?

Thank you
Best regars
Anthony

-p arguments Erroe

-p21-10000 do not work

Smap not found [windows]

C:\Users\user>smap
'smap' is not recognized as an internal or external command,
operable program or batch file.

C:\Users\user>smap.exe
'smap.exe' is not recognized as an internal or external command,
operable program or batch file.

result???

feature

Can we print output like

example.com:80
example.com:443
example.com:8080
example.com:8888

sub.example.com:80
sub.example.com:443
sub.example.com:8080
sub.example.com:8888

apache version

I would like to get the apache version as in nmap is it possible?

Released on aur

Hi, I start maintaining the the aur for smap.

Can be found here: https://aur.archlinux.org/packages/smap-git
Source can be found here: https://github.com/b-reich/aur

This could be referenz in the readme if you like. (I can open the PR)

Broken range of /16

Hello, the tool doesn't know how to scan the range with 192.xxx.x.x/16

Add wiki homebrew

When this pr is merged smap is avaible in homebrew.

Doing a pr for this.

Version string not matching with the release

This should be bump to 0.1.11 (better 0.1.12 because the source in the releases doenst include this at the moment)

Smap/internal/global/variables.go

Line 35 in 5775197

Version = "0.1.0-rc"

Host is up.

Hi when running smap with just one target it worked perfectly. Then I tried smap -iL ips.txt and all the results were "Host is up." so I tried again with just one target and now I get no results other than "Host is up."

support http proxy

support http proxy

Missing the Vulnerabilities and Version results

Hello,

By looking up your code I identified that you are using https://internetdb.shodan.io/ to fetch the results.

I believe that you are not including all the CPEs, hostnames and vulns from the json result.
It would be nice to get the CVE vulnerabilities as well and CPEs.

Great tool and excelent work!