Configuration File Reference

The config/config.json file is the primary configuration file for scan4all. It controls all aspects of scanning behavior, from performance settings to dictionary paths.

File Location

scan4all searches for config.json in the following locations:

./config/config.json (current directory)
./config.json
$HOME/config/config.json
$HOME/.config/config.json
/etc/config.json

The first found configuration file will be used. Environment variables can override any setting.

Core Settings

Performance & Resources

Field	Type	Default	Description
`ScanPoolSize`	integer	5000	Maximum concurrent scan operations
`Fuzzthreads`	integer	32	Number of fuzzing threads (2, 4, 8, 16, 32)
`esthread`	integer	8	Elasticsearch worker threads
`hydrathread`	integer	64	Password brute-force threads
`LimitReader`	integer	819200	Max response body size (bytes)
`MaxErrorTimes`	integer	100	Max errors before stopping

{
  "ScanPoolSize": 5000,
  "Fuzzthreads": 32,
  "esthread": 8,
  "hydrathread": 64,
  "LimitReader": 819200,
  "MaxErrorTimes": 100
}

Scan Behavior

Field	Type	Default	Description
`priorityNmap`	boolean	true	Use nmap for port scanning if available
`noScan`	boolean	false	Skip port scanning (read nmap XML results)
`UrlPrecise`	boolean	true	Enable precise URL scanning
`ParseSSl`	boolean	true	Deep analysis of SSL certificates
`EnableSubfinder`	boolean	false	Enable subdomain enumeration
`EnableKsubdomain`	boolean	true	Enable ksubdomain scanning
`EnableHoneyportDetection`	boolean	true	Detect and skip honeypots
`enableNuclei`	boolean	true	Enable Nuclei vulnerability scanner
`enableMultNuclei`	boolean	false	Enable multiple Nuclei instances
`enableByWaf`	boolean	true	Enable WAF bypass techniques
`enableEmbedYaml`	boolean	true	Use embedded YAML templates
`enableFileFuzz`	boolean	true	Enable file fuzzing
`enableWebScan`	boolean	false	Enable web application scanning
`CheckWeakPassword`	boolean	true	Enable password brute-forcing

{
  "priorityNmap": true,
  "noScan": false,
  "UrlPrecise": true,
  "ParseSSl": true,
  "EnableSubfinder": false,
  "EnableHoneyportDetection": true,
  "enableNuclei": true,
  "CheckWeakPassword": true
}

Setting EnableSubfinder=true enables subdomain brute-forcing, which can significantly increase scan time.

Network & Protocol Settings

Field	Type	Default	Description
`OnClient`	boolean	true	Enable client mode
`Cookie`	string	""	Custom cookie header for requests
`nmapScan`	string	See below	Nmap execution command with sudo
`nmap`	string	See below	Nmap parameters
`KsubdomainRegxp`	string	See below	Ksubdomain regex pattern

{
  "nmapScan": "echo $PPSSWWDD|sudo -S nmap ",
  "nmap": "nmap -n --unique --resolve-all -Pn --min-hostgroup 64 --max-retries 0 --host-timeout 10m --script-timeout 3m -oX {filename} --version-intensity 9 --min-rate 10000 -T4 "
}

Nmap requires root privileges. Set the PPSSWWDD environment variable with your root password:

export PPSSWWDD=yourRootPassword

httpx Configuration

Field	Type	Default	Description
`Pipeline`	boolean	false	Enable HTTP pipelining
`HTTP2Probe`	boolean	false	Probe for HTTP/2 support
`VHost`	boolean	false	Enable virtual host discovery
`CSPProbe`	boolean	true	Check Content-Security-Policy
`TLSProbe`	boolean	true	Probe TLS/SSL configuration
`TechDetect`	boolean	true	Detect technologies
`FollowRedirects`	boolean	false	Follow HTTP redirects
`MaxRedirects`	integer	3	Maximum redirect hops

{
  "httpx": {
    "Pipeline": false,
    "HTTP2Probe": false,
    "VHost": false,
    "CSPProbe": true,
    "TLSProbe": true,
    "TechDetect": true,
    "FollowRedirects": false,
    "MaxRedirects": 3
  }
}

naabu Configuration

Field	Type	Default	Description
`TopPorts`	string	”http”	Port category to scan
`ScanAllIPS`	boolean	true	Scan all IPs for a domain
`Threads`	integer	50	Number of scanning threads
`EnableProgressBar`	boolean	false	Show progress bar

{
  "naabu": {
    "TopPorts": "http",
    "ScanAllIPS": true,
    "Threads": 50,
    "EnableProgressBar": false
  }
}

Integration Settings

Elasticsearch

Field	Type	Default	Description
`enableEsSv`	boolean	true	Enable Elasticsearch storage
`esUrl`	string	See below	Elasticsearch endpoint URL

{
  "enableEsSv": true,
  "esUrl": "https://127.0.0.1:8081/%s_index/_doc/%s"
}

See Elasticsearch Integration for complete setup.

External Services

Field	Type	Default	Description
`CeyeDomain`	string	scan4all.51pwn.com	Ceye domain for DNS callback
`JndiAddress`	string	See config	JNDI server address
`ldapServer`	string	See config	LDAP server for exploits

{
  "CeyeDomain": "scan4all.51pwn.com",
  "JndiAddress": "docker.for.mac.localhost:1389",
  "ldapServer": "ldap://docker.for.mac.localhost:1389/%s/#UpX34defineClass"
}

Dictionary Configuration

All dictionary paths are relative to the scan4all directory. See Custom Dictionaries for details.

Brute-Force Dictionaries

SSH Dictionaries

{
  "ssh_username": "pkg/hydra/dicts/ssh_user.txt",
  "ssh_pswd": "pkg/hydra/dicts/ssh_pswd.txt",
  "ssh_default": "pkg/hydra/dicts/ssh_default.txt"
}

Database Dictionaries

{
  "mysqlusername": "pkg/hydra/dicts/mysql_user.txt",
  "mysql_pswd": "pkg/hydra/dicts/mysql_pswd.txt",
  "mysql_default": "pkg/hydra/dicts/mysql_default.txt",
  "postgresqlusername": "pkg/hydra/dicts/postgresql_user.txt",
  "postgresql_pswd": "pkg/hydra/dicts/postgresql_pswd.txt",
  "postgresql_default": "pkg/hydra/dicts/postgresql_default.txt",
  "mongodbusername": "pkg/hydra/dicts/mongodb_user.txt",
  "mongodb_pswd": "pkg/hydra/dicts/mongodb_pswd.txt",
  "mongodb_default": "pkg/hydra/dicts/mongodb_default.txt"
}

Web Application Dictionaries

{
  "tomcatuserpass": "brute/dicts/tomcatuserpass.txt",
  "jbossuserpass": "brute/dicts/jbossuserpass.txt",
  "weblogicuserpass": "brute/dicts/weblogicuserpass.txt",
  "filedic": "brute/dicts/filedic.txt",
  "top100pass": "brute/dicts/top100pass.txt",
  "httpuser": "brute/dicts/httpuser.txt",
  "httpass": "brute/dicts/httpass.txt"
}

Fuzzing Dictionaries

{
  "bakSuffix": "brute/dicts/bakSuffix.txt",
  "fuzzct": "brute/dicts/fuzzContentType1.txt",
  "fuzz404": "brute/dicts/fuzz404.txt",
  "404url": "brute/dicts/404url.txt",
  "prefix": "brute/dicts/prefix.txt"
}

Fingerprint Dictionaries

{
  "eHoleFinger": "pkg/fingerprint/dicts/eHoleFinger.json",
  "localFinger": "pkg/fingerprint/dicts/localFinger.json"
}

Exploit Configuration

{
  "Exploit": {
    "Path": "./config/poc/",
    "Logs": "./logs/errror.log"
  }
}

Field	Description
`Path`	Directory containing custom POC files
`Logs`	Error log file location

Cache Settings

{
  "CacheName": ".DbCache",
  "autoRmCache": "true"
}

Field	Type	Default	Description
`CacheName`	string	.DbCache	Cache directory name
`autoRmCache`	string	true	Auto-remove cache on exit

The cache is automatically removed on Windows or when autoRmCache is enabled.

Advanced Settings

Development & Debugging

{
  "enableDevDebug": false,
  "enableFingerTitleHeaderMd5Hex": false
}

Enable development debugging:

enableDevDebug=true ./scan4all -v -host example.com

Hydra Password Defaults

{
  "HydraUser": "",
  "HydraPass": ""
}

Set default username/password for all services:

HydraUser=admin HydraPass=password123 ./scan4all -host example.com

Complete Example

{
  "LimitReader": 819200,
  "OnClient": true,
  "ScanPoolSize": 5000,
  "MaxErrorTimes": 100,
  "priorityNmap": true,
  "noScan": false,
  "enableNuclei": true,
  "enableEsSv": true,
  "CheckWeakPassword": true,
  "esthread": 8,
  "hydrathread": 64,
  "Fuzzthreads": 8,
  "UrlPrecise": true,
  "ParseSSl": true,
  "EnableSubfinder": false,
  "EnableHoneyportDetection": true,
  "EnableKsubdomain": true,
  "httpx": {
    "CSPProbe": true,
    "TLSProbe": true,
    "TechDetect": true
  },
  "naabu": {
    "TopPorts": "http",
    "ScanAllIPS": true,
    "Threads": 50
  }
}

Get Started

Core Features

Usage Guide

Configuration

POC & Detection

Configuration File Reference

File Location

Core Settings

Performance & Resources

Scan Behavior

Network & Protocol Settings

httpx Configuration

naabu Configuration

Integration Settings

Elasticsearch

External Services

Dictionary Configuration

Brute-Force Dictionaries

Fingerprint Dictionaries

Exploit Configuration

Cache Settings

Advanced Settings

Development & Debugging

Hydra Password Defaults

Complete Example

Next Steps

Build docs developers (and LLMs) love

Get Started

Core Features

Usage Guide

Configuration

POC & Detection

​File Location

​Core Settings

​Performance & Resources

​Scan Behavior

​Network & Protocol Settings

​httpx Configuration

​naabu Configuration

​Integration Settings

​Elasticsearch

​External Services

​Dictionary Configuration

​Brute-Force Dictionaries

​Fingerprint Dictionaries

​Exploit Configuration

​Cache Settings

​Advanced Settings

​Development & Debugging

​Hydra Password Defaults

​Complete Example

​Next Steps

Build docs developers (and LLMs) love

File Location

Core Settings

Performance & Resources

Scan Behavior

Network & Protocol Settings

httpx Configuration

naabu Configuration

Integration Settings

Elasticsearch

External Services

Dictionary Configuration

Brute-Force Dictionaries

Fingerprint Dictionaries

Exploit Configuration

Cache Settings

Advanced Settings

Development & Debugging

Hydra Password Defaults

Complete Example

Next Steps