A: If the WinPCap driver is not installed in the system, Winpcap 3.1will be automatically installed after X-Scan is started; If a higher version of WinPCap has been installed on the system, X-Scan will use the existing version.
Q: What is the reason why 10 checkhost.exe processes appear in a subnet at the same time?
A: Each host will start a Checkhost.exe process independently after detection, and will automatically quit after detection. The number of concurrent hosts can be set through the setting window of the graphical interface, and the command line program can be set through the "-t" parameter.
Q: What is the reason for the sudden blue screen restart of the machine during scanning?
A: It is possible for the system to have a blue screen during scanning. Drivers of AtGuard, Skynet and other firewalls may make mistakes when processing special packages, which may cause the system to crash. In addition, many firewall drivers also conflict with WinPCap drivers themselves. It is recommended to ban or uninstall firewall programs before trying.
Q: What is the reason for the incorrect recognition of the operating system?
A: The accuracy of 100% cannot be guaranteed in operating system identification. At present, the identification is based on the fingerprint database of NMAP and P0F, NETBIOS information and SNMP information. If the target machine does not open NETBIOS and SNMP protocols, and the TCP/IP stack fingerprint is not in the database, the user needs to comprehensively analyze it according to other information.
Q: Why did I choose "SYN" mode for port scanning in one scan, but X-Scan actually adopted "TCP" mode and didn't passively identify the target operating system?
A: SYN mode in port scanning can't be used in NT4 or XP+SP2 systems, and you must have administrator rights when you use it in windows 2000 and other systems, otherwise, you will automatically switch to TCP mode for port scanning.
Q: Is the new version compatible with the plug-in version 2.3?
A: The plug-in interface of version X-Scan above 3.0 has been slightly modified, which is not compatible with the plug-in version before 2.3, and the original author needs to make corresponding modifications. Version 3.0 or above provides a simple development library, and plug-in development is much easier than version 2.3.
Q: I see that there are many nessus Scripts in the scripts directory. Can you download the latest plugin from nessus's website and extract it into the scripts directory to scan the latest vulnerabilities?
A: X-scan transplanted nasl engine of nessus, which currently corresponds to nessus2.2.4, but does not include support for local detection scripts. So as long as this version of nessus supports non-local detection Scripts, they can be copied to the scripts directory and loaded.
Q: The detection range of weak password plug-ins in X-Scan is very limited. Can you add other accounts or passwords that need to be detected?
A: The password dictionary built in "X-Scan" is only a simple demonstration. Users can edit the password dictionary file by themselves if they want the software to have stronger password guessing ability.
Q: Why is there a lot of English in nasl script scanning results, and is it possible to sinicize these English information in the future?
A: At present, there are nearly 2,000 NASL scripts, most of which are in English. What needs to be translated can be seen under X-Scan in the "Focus Project" of this website. Welcome everyone to help with the translation. After passing the examination, we will directly join the online upgrade library for everyone to download.
Q: How to pause or terminate scanning when scanning with xscan.exe in command line mode?
A: In the process of command-line detection, press [space] to view the status of each thread and the scanning progress, press [Enter] to pause or continue scanning, press "Q" to save the current data and exit the program early, and press "< ctrl+c>” Shut down the program forcibly.
Q: How to install X-Scan and do I need to register?
A: X-Scan is completely free software, and there is no need to register or install it (it can be run after decompression, and the WinPCap driver is automatically installed).