Unicornscan

Unicornscan is a new information gathering and correlation engine built for and by members of the security research and testing communities. It was designed to provide an engine that is Scalable, Accurate, Flexible, and Efficient. Released under the GPL license, it serves as a superior interface for introducing stimuli into and measuring responses from TCP/IP enabled devices or networks.

The tool supports hundreds of individual features including asynchronous stateless TCP scanning with all variations of TCP flags, TCP banner grabbing, protocol-specific UDP scanning, and active/passive remote OS, application, and component identification through response analysis. Additional capabilities include PCAP file logging and filtering, relational database output, custom module support, and customized data-set views.

Unicornscan excels in high-performance network reconnaissance, enabling researchers to scan large networks efficiently while gathering detailed information about open ports, services, and system characteristics.

Unicornscan operates as a user-land distributed TCP/IP stack that performs asynchronous stateless TCP scanning with customizable TCP flag combinations and protocol-specific UDP scanning that sends minimal signatures to elicit responses. It achieves high packet rates (shown as 963.9 pps in examples) through efficient packet transmission and reception, processing duplicate replies, ICMP errors, and TCP RSTs. The tool uses PCAP filtering for precise response capture and supports custom output formats, module-based processing, and relational database integration for correlation and analysis of scan results.