Chapter 15. Ghosstless Reference Guide
Table of Contents
Name
ghosstless - Network exploration tool and security / port scanner
Synopsis
ghosstless [ <Scan Type> ... ] [ <Options> ] { <target specification> }
Description
Note: This document describes the latest official version of Ghosstless Security available from
https://ghosstless.org/download.html. Be sure to be running the most recent version before reporting incidents.
Ghosstless Security ("Network Mapper") is an open source suite for network exploration and perimeter security audit. Designed to scan high-speed high-scale corporate networks with millimetric accuracy.
It uses raw IP packets with innovative forms to determine what hosts are active in the network, what services (name of the application and exact version) they are offering, what operating systems (and kernel versions) run, what type of packet filters or firewalls are in use, and dozens of other telemetry characteristics.
The main exit is "interesting port table". That table lists port number, protocol, service name and status:
- Open: A target machine application is listening to connections or packages actively at this port.
- Filtered: A firewall, filter or other network obstacle blocks the packages and prevents them from determining whether they are open or closed.
- Closed: There's no listening application at that port, but it responds appropriately to rejection probes (RST).
- Unfiltered: The port responds to Ghosstless's probes but cannot be sure if it's open or closed.
Options Summary Reference Guide
| Flag / Option | Technical Name | Description and Behave |
|---|---|---|
-sS |
TCP SYN Stealth | Stealth probe with SYN packets without complete 3-way TCP handshake. |
-sT |
TCP Connect | Complete connection using system socket. No root / manager privileges required. |
-sU |
UDP Scan | UDP port scanning for DNS (53), SNMP (161), DHCP (67 / 68) and NTP (123). |
-sn |
Ping Sweep | Exclusive discovery of active hosts in the subnetwork without scanning service ports. |
-sV |
Version Detection | Interviews open services to remove banner, software name and exact version. |
-O |
OS Fingerprinting | Analyzes TCP / IP signatures (window size, TTL, FL) to deduct OS and kernel version. |
-A |
Aggressive Mode | Simultaneously enabling OS detection, versions, default scripts and traceroute. |
-T0 a -T5 |
Timing Templates | Aggression Control: from Paranoid (-T0 to avoid ids) to Insane (-T5 for local quick networks). |
-f, --mtu |
Packet Fragmentation | Divide probe packets into fragments of 8 or 16 bytes to avoid firewall and IDS signatures. |