Scattershot3 — pr0t31n

How It Works

⚠️ Authorized Testing Only

This tool interacts with live systems and must only be used for testing that has been explicitly authorized by the asset owner. Unauthorized use of this tool to probe, scan, exploit, or otherwise interact with systems you do not have written permission to test is illegal under computer fraud and abuse laws (CFAA, CMA, and international equivalents). pr0t31n does not condone or recommend any unauthorized use. Always obtain a signed Rules of Engagement (RoE) or Statement of Work (SoW) before beginning any assessment.

Scattershot3 is a network reconnaissance and vulnerability scanning engine that orchestrates multiple third-party security tools into a unified, multi-phase assessment pipeline. When launched, it accepts individual IPs, hyphen ranges, CIDR blocks, or a targets file, then automatically classifies each target as INTERNAL (RFC-1918 / private address space) or EXTERNAL (publicly routable) and scans them in separate passes with scope-appropriate rules.

The scan proceeds through a structured sequence: host discovery via nmap ping sweeps, full TCP port scanning with service/version detection, per-port banner grabbing (netcat probes for non-web services, curl probes for HTTP/HTTPS), SSL/TLS cipher and certificate analysis (sslscan + testssl.sh), web technology fingerprinting (webanalyze, WPScan for WordPress), security header inspection (shcheck), directory brute-forcing (gobuster), SSH algorithm auditing (ssh-audit), and vulnerability scanning (Nuclei with curated templates). Each tool invocation produces a sibling .log transcript for full auditability.

Scattershot3 features adaptive concurrency that dynamically adjusts parallelism based on CPU and RAM utilisation — it starts at 75% of logical CPUs (bounded by available RAM) and a background monitor thread scales the semaphore up or down every 10 seconds to keep resource pressure below 80%. A checkpoint/resume system persists scan state to checkpoint.json, allowing interrupted scans to pick up where they left off. The correlated output merges per-host, per-port tool results into a unified correlated.json report with a catch-all pass that captures every tool entry logged against each port.

Output follows the pr0t31n universal directory structure: per-host evidence directories under hosts/<ip>/, a unified findings.json (schema v1.1), findings.csv, summary.json, timestamped scan.log and scan.log.json, and errors.log. When running under Crucible, Scattershot3 emits __CRUCIBLE_LOG__, __CRUCIBLE_STATUS__, __CRUCIBLE_TARGET__, and __CRUCIBLE_PORT__ protocol tokens for real-time progress tracking.

Phase Pipeline

Phase 1 — Host Discovery
Phase 1.5 — Hostname Resolution
Phase 2 — Port Scan & Service Analysis
Phase 3 — Nuclei Web Scan
Phase 4 — Searchsploit
Phase 4.5 — Sploitus
Phase 4.75 — Metasploit Search
Phase 5 — Database Attacks
Phase 6 — Hydra Brute Force
Phase 6.5 — BruteSpray
Phase 12 — AD Assessment
Phase 13 — Web App Attack
Phase 14 — O365 Enumeration

Security

Scattershot3 is a CLI tool with no web interface or authentication layer. Security considerations:

Subprocess safety: All third-party tool invocations use list-based subprocess calls (no shell=True) to prevent command injection
Output isolation: Each run creates an isolated directory under the client's engagement directory — no cross-project data leakage
Credential handling: Credentials for authenticated phases are stored in the settings JSON with restricted file permissions — never exposed in process listings

Features

Discovery

Host Discovery

Ping sweeps and ARP scanning to identify live hosts across subnets and CIDR ranges.

Automatic Scope Classification

Targets are automatically sorted into INTERNAL (RFC-1918) and EXTERNAL (publicly routable) scopes with separate scan passes and rules.

Integration

Crucible Protocol Tokens

Emits __CRUCIBLE_LOG__, __CRUCIBLE_STATUS__, __CRUCIBLE_TARGET__, and __CRUCIBLE_PORT__ tokens for real-time progress in the Crucible management console.

Output

Correlated Reporting

Per-host, per-port correlated report merging all tool results with a catch-all pass that captures every logged tool entry.

Universal Schema Output

Findings emitted in pr0t31n universal schema v1.1 with CVSS scores, CWE mappings, and compliance framework references where available.

Performance

Adaptive Concurrency

Hardware-aware thread pool that starts at 75% of logical CPUs, bounded by RAM, and dynamically scales based on real-time CPU/memory utilisation.

Resilience

Checkpoint/Resume

Scan state persisted to checkpoint.json, enabling interrupted scans to resume from the last completed phase.

Scanning

Full TCP Port Scanning

Nmap SYN/connect scans with service version detection, OS fingerprinting, and NSE script execution.

Banner Grabbing

Netcat-based banner probes for non-web services and curl-based HTTP probes for web ports, with automatic service identification for unknown/tcpwrapped ports.

SSL/TLS Analysis

Dual-engine TLS assessment using sslscan and testssl.sh — cipher enumeration, certificate validation, protocol version checks, and vulnerability detection (Heartbleed, POODLE, ROBOT, etc.).

Web Technology Fingerprinting

Webanalyze-based technology detection, WordPress scanning via WPScan, and security header inspection via shcheck.

Directory Discovery

Gobuster directory/file brute-forcing against web services with configurable wordlists.

SSH Security Auditing

SSH algorithm and configuration auditing via ssh-audit, including deprecated cipher and key exchange detection.

Vulnerability

Nuclei Vulnerability Scanning

Template-based vulnerability scanning using ProjectDiscovery Nuclei with curated templates for CVE detection, misconfigurations, and exposures.

Non-Standard Port Detection

Automatically generates INFO findings when services run on non-standard ports (e.g., HTTP on port 8443, SSH on port 2222).

Use Cases

Internal Network Penetration Test

Comprehensive reconnaissance of an internal corporate network — discover live hosts, enumerate services, identify vulnerabilities, and map the attack surface across RFC-1918 address space.

External Perimeter Assessment

Scan publicly-facing infrastructure to identify exposed services, weak TLS configurations, missing security headers, outdated software, and known CVEs.

Compliance-Driven Vulnerability Scan

Generate findings mapped to NIST, PCI DSS, and ISO 27001 frameworks for compliance reporting and remediation tracking.

Pre-Engagement Reconnaissance

Rapidly enumerate targets before launching deeper testing with Fracture (web apps) or Siphon (APIs), providing the target inventory those tools require.

Device Security Assessment Support

Feed network-layer findings into Gearbox hardware assessments — identify Ethernet-attached device services, open ports, and protocol vulnerabilities.

CLI Reference

Command Examples

Basic Scan

python3 scattershot3.py 192.168.1.0/24 --project mytest

Scan a /24 network with all default phases.

Targets from File

python3 scattershot3.py --targets-file targets.txt --project ext_q4

Load targets from a file (one IP/CIDR per line).

Resume Interrupted Scan

python3 scattershot3.py --settings /path/to/settings.json --resume

Resume from the last checkpoint after interruption.

Managed by Crucible

python3 scattershot3.py --settings <project_settings.json>

Run under Crucible management with project-level settings.

Third-Party Tool Invocations

Commands and flags used when this tool invokes third-party dependencies during operation.

nmap

Host discovery, port scanning, service/version detection, NSE scripts

nmap -sS -sV -O -A --top-ports 1000 <target>

nmap -sC -sV -p- <target>

sslscan

SSL/TLS cipher enumeration and vulnerability detection

sslscan --no-colour <host>:<port>

testssl.sh

Comprehensive TLS/SSL analysis including protocol checks and cipher grading

testssl.sh --ip one <host>:<port>

nuclei

Template-based vulnerability scanning for CVEs, misconfigurations, and exposures

nuclei -u <url> -t cves/

nuclei -u <url> -severity critical,high

gobuster

Directory and file brute-forcing on web services

gobuster dir -u <url> -w <wordlist> -t 50

webanalyze

Web technology fingerprinting (Wappalyzer-compatible)

webanalyze -host <url> -crawl 1

wpscan

WordPress-specific vulnerability scanning

wpscan --url <url> --enumerate vp,vt,u

shcheck

Security header inspection for web services

shcheck.py <url>

ssh-audit

SSH server algorithm and configuration auditing

ssh-audit <host>:<port>

curl

HTTP/HTTPS probing for web port detection and response capture

curl -sk -D - https://<host>:<port>/

nc (netcat)

Banner grabbing for non-web services

echo '' | nc -w5 <host> <port>

rustscan

Fast port discovery feeding into nmap

rustscan -a <target> -- -sV -sC

searchsploit

Exploit database search for identified services

searchsploit --json <service> <version>

snmpwalk

SNMP MIB tree enumeration

snmpwalk -v2c -c public <host>

smbmap

SMB share enumeration

smbmap -H <host>

rpcclient

RPC endpoint enumeration

rpcclient -U '' -N <host> -c 'enumdomusers'

smbclient

SMB share listing

smbclient -L //<host> -N

enum4linux

Windows/Samba enumeration

enum4linux -a <host>

showmount

NFS export enumeration

showmount -e <host>

ipmitool

IPMI interface testing

ipmitool -I lanplus -H <host> -U admin chassis status

hydra

Network service brute-forcing

hydra -l admin -P <wordlist> <host> ssh

sqlmap

SQL injection testing

sqlmap -u <url> --batch

responder

LLMNR/NBT-NS poisoning (passive analysis mode)

responder -I <iface> -A

kerbrute

Kerberos user enumeration and password spraying

kerbrute userenum -d <domain> <userlist>

ike-scan

IPsec VPN gateway detection

ike-scan <host>

Finding Nomenclature

Scattershot3 findings use the SS- prefix in the findings catalogue (e.g., SS-001, SS-002). Each finding includes:

Catalogue ID — Unique identifier from findings_catalogue.json mapping to a specific detection rule
Risk Level — CRITICAL, HIGH, MEDIUM, LOW, or INFO (always uppercase)
IP + Port — The specific host and port where the finding was identified
Tool Attribution — Which underlying tool (nmap, nuclei, sslscan, etc.) produced the detection
Evidence Files — Run-directory-relative paths to the raw tool output and .log transcripts substantiating the finding

Common finding categories include: deprecated SSL/TLS protocols, weak cipher suites, missing security headers, known CVEs (via Nuclei), default credentials, exposed sensitive files, end-of-life software, and non-standard service port configurations.

Action Items

Scattershot3 generates action items for findings requiring manual verification or exploitation. The system deduplicates items — each unique (target, title) pair produces at most one action item:

"Manually verify SQL injection on <URL>" — when Nuclei reports potential SQLi
"Test default credentials on <service> at <IP>:<port>" — login pages detected
"Investigate exposed admin panel at <URL>" — administrative interfaces discovered
"Attempt Kerberoasting with impacket-GetUserSPNs" — service accounts with SPNs found
"Enumerate SMB shares with valid credentials" — when authenticated SMB is accessible

Output Files

File	Format	Description
`meta.json`	JSON	Tool identity and engagement metadata
`findings.json`	JSON	Universal findings array v1.1
`findings.csv`	CSV	CSV mirror of findings
`summary.json`	JSON	Aggregated statistics
`scan.log`	TXT	Human-readable timestamped log
`scan.log.json`	JSONL	Machine-readable JSON log events
`errors.log`	TXT	ERROR-level entries only
`findings_catalogue.json`	JSON	Findings catalogue
`correlated.json`	JSON	Per-host/per-port correlated results
`checkpoint.json`	JSON	Resumable scan checkpoint
`inventory/software.json`	JSON	Detected software inventory
`findings_vantage.json`	JSON	Vantage-format findings

Invocation Methods

Method	Usage
CLI — Direct	`cd /opt/pr0t31n/Scattershot3 && python3 scattershot3.py [OPTIONS]` Run directly with command-line arguments.
Crucible-Managed	Launched and managed by Crucible (port 5100). Crucible handles start/stop/pause, log streaming, findings aggregation, and status tracking.

Integration

Depends On

OSift (feeds targets)

Used By

Crucible (manages)
Prometheus (reports)
Trawler (pcap analysis)

Third-Party Dependencies & Credits

Tool / Library	Developer	Type	Link
nmap	Gordon Lyon (Fyodor)	system	https://github.com/nmap/nmap
rustscan	RustScan Team / Bee	system	https://github.com/RustScan/RustScan
sslscan	rbsec (originally Ian Ventura-Whiting)	system	https://github.com/rbsec/sslscan
testssl.sh	Dirk Wetter	system	https://github.com/drwetter/testssl.sh
ssh-audit	Joe Testa (jtesta)	system	https://github.com/jtesta/ssh-audit
Nuclei	ProjectDiscovery	system	https://github.com/projectdiscovery/nuclei
gobuster	OJ Reeves	system	https://github.com/OJ/gobuster
wpscan	WPScan Team / Automattic	system	https://github.com/wpscanteam/wpscan
Responder	Laurent Gaffie (lgandx)	system	https://github.com/lgandx/Responder
smbmap	ShawnDEvans	system	https://github.com/ShawnDEvans/smbmap
enum4linux	Mark Lowe / Portcullis Labs (CiscoCXSecurity)	system	https://github.com/CiscoCXSecurity/enum4linux
Hydra	THC / van Hauser	system	https://github.com/vanhauser-thc/thc-hydra
sqlmap	Bernardo Damele / Miroslav Stampar	system	https://github.com/sqlmapproject/sqlmap
XSStrike	s0md3v (Somdev Sangwan)	system	https://github.com/s0md3v/XSStrike
BloodHound-Python	Dirk-jan Mollema / Fox-IT	system	https://github.com/dirkjanm/BloodHound.py
Kerbrute	Ronnie Flathers (ropnop)	system	https://github.com/ropnop/kerbrute
odat (Oracle)	quentinhardy	system	https://github.com/quentinhardy/odat
OWASP ZAP	OWASP / Simon Bennetts	system	https://github.com/zaproxy/zaproxy
searchsploit / ExploitDB	OffSec	system	https://gitlab.com/exploit-database/exploitdb
webanalyze (Wappalyzer)	rverton	system	https://github.com/rverton/webanalyze
tcpdump	The Tcpdump Group	system	https://github.com/the-tcpdump-group/tcpdump
curl	Daniel Stenberg	system	https://github.com/curl/curl
BruteSpray	x90skysn3k	system	https://github.com/x90skysn3k/brutespray
gowitness	SensePost / Orange Cyberdefense	system	https://github.com/sensepost/gowitness
ldapdomaindump	Dirk-jan Mollema / Fox-IT	system	https://github.com/dirkjanm/ldapdomaindump
python-nmap	Alexandre Norman	python	https://pypi.org/project/python-nmap/
nikto	Chris Sullo / David Lodge / CIRT	system	https://github.com/sullo/nikto
shcheck	meliot / santoru	system	https://github.com/santoru/shcheck

Metadata

Name	Scattershot3
Category	Exploitation
Version	1.54.5
Install Path	`/opt/pr0t31n/Scattershot3`
Main File	`scattershot3.py`
GitHub	https://github.com/pr0t31n/Scattershot3.git