Offensive Security Researcher & Quantum Cryptography Analyst

unicornscan: Network reconnaissance and port scanner

Abdul Wahab Junaid
unicornscan: Network reconnaissance and port scanner

1. Tool Introduction

Unicornscan is an asynchronous, stateless network reconnaissance tool designed for information gathering and stimulus/response correlation across large networks. Built with a distributed, user-land TCP/IP stack, it decouples packet transmission from response processing, similar in philosophy to Masscan, and allows extremely fast TCP and UDP scanning. Unicornscan was created for security research purposes and offers features such as active/passive OS and application fingerprinting, PCAP file logging, and a relational-database-friendly output format, making it useful for large-scale scan data analysis. It is included in the Kali Linux repositories.

2. Installation

sudo apt update
sudo apt install unicornscan -y

Verify:

unicornscan -V

Expected output:

unicornscan 0.4.7

3. Syntax

unicornscan [OPTIONS] {target specification}[:port specification]

4. Command-Line Options (Full Reference)

(Note: Unicornscan’s flag set varies slightly between build versions; unicornscan --help on the installed system is the authoritative reference.)

5. Basic Usage

sudo unicornscan 192.168.1.0/24

Expected output:

Using interface(s) eth0
Scanning 256 total hosts with 65535 total packets
TCP open                     ssh[   22]         from 192.168.1.10     ttl 64
TCP open                    http[   80]         from 192.168.1.10     ttl 64

6. Practical Examples

Example 1 — Basic TCP scan of a single host

sudo unicornscan 10.10.10.5:1-1024

TCP open                     ssh[   22]         from 10.10.10.5     ttl 64
TCP open                    http[   80]         from 10.10.10.5     ttl 64

Example 2 — UDP scan mode

sudo unicornscan -mU 10.10.10.5:53,161

UDP open                  domain[   53]         from 10.10.10.5     ttl 64
UDP open                    snmp[  161]         from 10.10.10.5     ttl 64

Example 3 — Scan with a custom packet rate

sudo unicornscan -r 500 10.10.10.0/24:1-1000

TCP open                     ssh[   22]         from 10.10.10.5     ttl 64
TCP open              microsoft-ds[  445]      from 10.10.10.9     ttl 128

Example 4 — Save results to a pcap file

sudo unicornscan 10.10.10.5:1-65535 -w results.pcap

[creates results.pcap for offline analysis in Wireshark]

Example 5 — ARP-mode local subnet scan

sudo unicornscan -mA 192.168.1.0/24

ARP who-has 192.168.1.10 reply from AA:BB:CC:DD:EE:FF
ARP who-has 192.168.1.15 reply from 11:22:33:44:55:66

Example 6 — Full port range TCP scan on a single host

sudo unicornscan 10.10.10.5:1-65535

TCP open                     ssh[   22]         from 10.10.10.5     ttl 64
TCP open                    http[   80]         from 10.10.10.5     ttl 64
TCP open                    mysql[ 3306]         from 10.10.10.5     ttl 64

Example 7 — Repeat probes for reliability on lossy networks

sudo unicornscan -R 3 10.10.10.5:1-1000

TCP open                     ssh[   22]         from 10.10.10.5     ttl 64

Example 8 — Verbose output with immediate reporting

sudo unicornscan -v -Z 10.10.10.5:1-1000

[verbose] sending SYN to 10.10.10.5:22
TCP open                     ssh[   22]         from 10.10.10.5     ttl 64

Example 9 — Scan with source IP spoofing

sudo unicornscan -s 10.10.10.99 10.10.10.5:1-100

TCP open                     ssh[   22]         from 10.10.10.5     ttl 64

Example 10 — Quiet/dumb mode for script-friendly output

sudo unicornscan -D -q 10.10.10.5:1-1000

10.10.10.5,22,tcp,open
10.10.10.5,80,tcp,open

7. Common Use Cases

8. Automation with Bash

#!/bin/bash
# unicorn_sweep.sh - TCP sweep across a subnet, log results to CSV
SUBNET="10.10.10.0/24"
OUTFILE="unicorn_scan.csv"

echo "[*] Running Unicornscan TCP sweep on $SUBNET..."
sudo unicornscan -D -q "$SUBNET:1-1024" > "$OUTFILE"

echo "[+] Results saved to $OUTFILE"
column -s, -t "$OUTFILE"

9. Tips and Best Practices

10. Troubleshooting

11. References

Exit mobile version