ike-scan

No entries match these filters. Clear filters

1. 1.1 Nov 24, 2013 · release notes

   ike-scan 1.1 adds backoff patterns for Cisco and isakmpd plus builds on Windows/Solaris

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 1.1 https://github.com/royhills/ike-scan.git
   # already have the repo? check out this version:
   $ git checkout 1.1

   • Supports building and running on Windows/Cygwin, old libc5 Linux systems, and Solaris 2.8 / SPARC.
   • Releases a Windows command-line binary.

   2 details in Everything

2. 1.4 Nov 24, 2013 · release notes

   ike-scan 1.4 adds --vendor flag to specify arbitrary Vendor IDs and display received payloads for fingerprinting

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 1.4 https://github.com/royhills/ike-scan.git
   # already have the repo? check out this version:
   $ git checkout 1.4

   └──▷ TRY IT
   Send a custom Vendor ID to test how a target handles specific ISAKMP payloads
   copy

   $ ike-scan --vendor '0123456789abcdef' <target>

   • Adds the --vendor CLI argument to ike-scan allowing specification of an arbitrary Vendor ID payload
   • Enables display of Vendor ID payloads returned by target hosts during scanning

   2 details in Everything

3. 1.5 Nov 24, 2013 · release notes

   ike-scan 1.5 adds --aggressive mode for full IKE negotiations, multiple --vendor/--trans options, and dynamic UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. timing

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 1.5 https://github.com/royhills/ike-scan.git
   # already have the repo? check out this version:
   $ git checkout 1.5

   └──▷ TRY IT
   Perform an IKE Aggressive Mode scan against a target IP to identify supported encryption suites quickly.
   copy

   $ ike-scan --aggressive 192.168.1.1

   Send a custom proposal with multiple Vendor IDs and specific transforms to test for specific vendor implementations.
   copy

   $ ike-scan --vendor 'Cisco' --vendor 'MSFT' --trans ESP:AES:128 --trans ESP:3DES:168 10.0.0.5

   • Adds --aggressive (-A) option to enable IKE Aggressive Mode for quicker phase 1 exchanges
   • Allows --trans flag to be specified multiple times to generate custom ISAKMP SA Proposals with arbitrary transforms
   • Allows --vendor flag to be specified multiple times to include multiple Vendor ID payloads in requests
   • Removes the need for the --selectwait argument by dynamically adjusting UDP select() timeouts and timing errors

   4 details in Everything

4. 1.6 Nov 24, 2013 · release notes

   ike-scan v1.6 adds GSS ID fingerprinting, ISAKMP lifetime size transforms, and multi-payload support

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 1.6 https://github.com/royhills/ike-scan.git
   # already have the repo? check out this version:
   $ git checkout 1.6

   └──▷ USE IT
   Test how a server handles GSS authentication by injecting specific GSS IDs
   shell copy

   ike-scan --gssid <hex_gss_id> <target_host>

   Fingerprint vendor identities on a network range using the new pattern database
   shell copy

   ike-scan -z 1024 192.168.1.0/24

   • Adds --gssid (-G) flag to inject custom GSS IDs for testing KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application.-based IPsecIPsecA suite of IETF protocols that authenticate and encrypt IP packets at the network layer, giving cyber tools a standards-based way to build VPNs or secure host-to-host tunnels without modifying applications. authentication
   • Adds --lifesize (-z) option to specify ISAKMP lifetime size transform attribute in kilobytes
   • Enables display of multiple Vendor ID payloads sent by servers instead of only the first one
   • Adds ike-vendor-ids database for automatic Vendor ID fingerprinting using Posix extended regular expressions
   • Adds support for specifying target hosts as IPnet/bits or IPstart-IPend ranges alongside single IPs and hostnames

   +2 more show less

   • Adds --quiet option to suppress SA transform attribute and ID payload decoding
   • Adds --multiline option to split decoded payloads onto separate lines, each prefixed with a TAB

   7 details in Everything

5. 1.7 Nov 24, 2013 · release notes

   Adds PSK cracking, IKE over TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it., --random host ordering, and --nodns flag in ike-scan 1.7

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 1.7 https://github.com/royhills/ike-scan.git
   # already have the repo? check out this version:
   $ git checkout 1.7

   └──▷ TRY IT
   Crack PSKs offline from previous scan results using a dictionary file
   copy

   $ ike-scan <target> --pskcrack > psk_output.txt
   psk-crack -d /usr/share/wordlists/rockyou.txt psk_output.txt

   Scan using encapsulated IKE over TCP for Cisco-compatible devices
   copy

   $ ike-scan --tcp=2 <target>

   Avoid DNS delays by skipping lookups entirely during scanning
   copy

   $ ike-scan --nodns <target>

   • Adds --pskcrack (-P) option to output aggressive mode pre-shared key parameters for offline cracking via the new psk-crack program
   • Introduces psk-crack binary for offline dictionary and brute-force cracking of MD5/SHA1-based HMACHMACA keyed hash that proves a message came from someone holding a shared secret and was not altered. Webhooks and API request signing commonly use it. hashes from ike-scan output
   • Adds --tcp (-T) option to support raw (-T1) and encapsulated (-T2) IKE over TCP scanning
   • Adds --tcptimeout (-O) option to configure the connect timeout for TCP scans (default 10 seconds)
   • Adds --random (-R) option to randomise target host scanning order using Knuth shuffle

   +3 more show less

   • Adds --nodns (-N) option to skip DNS lookups and avoid delays on systems with non-functioning DNS
   • Allows --id payloads to be specified as hex values with a leading 0x prefix (previously always interpreted as hex)
   • Supports OpenSSL MD5/SHA1 hash functions for faster pre-shared key cracking when compiled with --with-openssl

   8 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !--id payload strings are now interpreted differently if they lack a leading 0x prefix; previously all strings were treated as hex, but now only those starting with 0x are hex values, likely requiring updates to previous ID payload configurations
6. 1.8 Nov 24, 2013 · release notes

   ike-scan 1.8 adds fine-grained ISAKMP packet construction flags and extended payload decoding

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 1.8 https://github.com/royhills/ike-scan.git
   # already have the repo? check out this version:
   $ git checkout 1.8

   └──▷ TRY IT
   Send a forged IKE proposal with a non-standard DOI and Situation to test responder handling of edge-case SA parameters
   copy

   $ ike-scan --doi=99 --situation=0xff <target>

   Construct a packet with a fixed SPISPISerial Peripheral Interface, a synchronous communication bus standard used to connect microcontrollers to sensors, flash memory, and other peripherals at short range; cyber tools use it to read or write firmware on embedded devices. length and hex-encoded lifetime to probe for implementation-specific parsing bugs
   copy

   $ ike-scan --spisize=4 --lifetime=0xff <target>

   Use the new flexible transform syntax to specify attributes out of order with custom key-value pairs
   copy

   $ ike-scan --trans=(enc=AES_CBC,keylen=256,hash=SHA2_256) <target>

   • Adds --spisize, --cookie, --hdrflags, --hdrmsgid, --exchange, -c, -B, -C, -L, -Z, -E, -j, -k, -D, and -S CLI arguments for arbitrary control over outgoing IKE packet headers, payloads, and metadata
   • Adds decoding support for CERTIFICATE, DELETE, and NOTIFICATION ISAKMP payloads in scan results
   • Enables --trans=(attr=value, ...) alternative syntax for specifying transform attributes in any order with an arbitrary number of key-value pairs
   • Allows --lifetime and --lifesize arguments to accept the string none, decimal integers, or hex numbers (e.g., 0xff) for variable-length attribute control

   4 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The default packet-rate calculation changed from interval to bandwidth (defaulting to 56000 bits/sec), altering timing behavior for existing scans that relied on the old default
7. 1.9 Nov 24, 2013 · release notes

   ike-scan 1.9 adds IKEv2IKEv2The second version of the Internet Key Exchange protocol, standardized by the IETF, used to negotiate and authenticate IPsec tunnels. Cyber tools build on it for reliable, fast VPN session setup with built-in NAT traversal and EAP support. support, --nat-t, --sourceip spoofing, and psk-crack stdin dictionary input.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 1.9 https://github.com/royhills/ike-scan.git
   # already have the repo? check out this version:
   $ git checkout 1.9

   └──▷ TRY IT
   Probe a host for IKEv2 support using experimental v2 packet formatting
   copy

   $ ike-scan --ikev2 192.168.1.1

   Pipe password candidates from john directly into psk-crack
   copy

   $ john --incremental --stdout | psk-crack --dictionary=- psk_file.dump

   Test NAT traversal compatibility by forcing UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. port 4500 and adding Non-ESP markers
   copy

   $ ike-scan --nat-t 10.0.0.1

   • --ikev2 sends and decodes IKE version 2 packets for experimental IPv2 ISAKMP testing
   • --rcookie <value> sets the responder cookie in outgoing packets (default is zero)
   • psk-crack --dictionary=- reads candidate passwords from stdin for pipeline integration
   • --nat-t enables RFC 3947 NAT Traversal by switching default UDP ports to 4500 and handling Non-ESP markers
   • --shownum displays the received packet number before details

   +2 more show less

   • --timestamp displays the reception time in %H:%M:%S.%u format
   • --randomseed <seed> sets the PRNG seed to make packets with random payloads repeatable

   7 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The --version and ident(1) output format changed from 1.x style version strings to integers (e.g., 9876) due to the SVNSVNApache Subversion, an open-source centralized version control system maintained by the Apache Software Foundation, used by tools to track, branch, and merge source code changes across a shared repository. transition
8. 2013-10-26 Roy Hills <Roy.Hills@nta-monitor.com> Oct 26, 2013 · release notes

   Adds --dhgroup support for ECP Diffie-Hellman groups 19, 20 and 21

   └──▷ TRY IT
   Probe a target using Elliptic Curve Diffie-Hellman group 19.
   copy

   $ ike-scan --dhgroup=19 <target>

   Probe a target using Elliptic Curve Diffie-Hellman group 21.
   copy

   $ ike-scan --dhgroup=21 <target>

9. 1.9.3 Apr 4, 2011 · release notes

   ike-scan 1.9.3 adds IPnet:netmask pattern support and optimizes address parsing.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 1.9.3 https://github.com/royhills/ike-scan.git
   # already have the repo? check out this version:
   $ git checkout 1.9.3

   • Adds IPnet:netmask format support in host patterns for more flexible network targeting
   • Optimizes IPnet/bits, IPnet:mask and IPstart-IPend pattern parsing to use efficient inet_aton() instead of get_host_address()

   2 details in Everything

10. 2007-01-02 Roy Hills <Roy.Hills@nta-monitor.com> Jan 2, 2007 · release notes

    Adds --readpktfromfile flag to parse IKE packets from a local file

    └──▷ TRY IT
    Debug IKE packet decoding by analyzing a captured pcappcapA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. or raw file locally without network traffic.
    copy

    $ ike-scan --readpktfromfile <path>

    • Adds --readpktfromfile CLI flag to read an IKE packet from a specified file instead of the network
    • New check-psk-crack-4 test script added to improve psk-crack.c and hash_functions.h coverage

    2 details in Everything

11. 2006-12-27 Roy Hills <Roy.Hills@nta-monitor.com> Dec 27, 2006 · release notes

    Adds --rcookie flag to ike-scan for setting the responder cookie.

    └──▷ TRY IT
    Force a specific responder cookie during an IKE negotiation test.
    copy

    $ ike-scan --rcookie <value> <target_ip>

12. 2006-12-21 Roy Hills <Roy.Hills@nta-monitor.com> Dec 21, 2006 · release notes

    Adds --nat-t flag for RFC 3947 NAT Traversal in ike-scan

    └──▷ TRY IT
    Scan for IKE services behind NAT devices by forcing standard NAT-T ports and markers.
    copy

    $ ike-scan --nat-t <target_ip>

13. 2006-12-17 Roy Hills <Roy.Hills@nta-monitor.com> Dec 17, 2006 · release notes

    ike-scan adds support for CRACK authentication method (RFC draft defined auth code 128).

14. 2006-11-25 Roy Hills <Roy.Hills@nta-monitor.com> Nov 25, 2006 · release notes

    New --sourceip option allows IP or random spoofing in ike-scan

    └──▷ USE IT
    Probe an IKE endpoint using a spoofed random source IP to avoid detection or NAT issues.
    shell copy

    ike-scan --sourceip random <target>

    • --sourceip: New CLI flag accepting an IP address or the string random to set the source IP for IKE probes

    1 detail in Everything

    └──▷ BREAKING ON UPGRADE

    • !The --ranssrc option has been removed; use --sourceip instead.
15. 2006-08-22 Roy Hills <Roy.Hills@nta-monitor.com> Aug 22, 2006 · release notes

    ike-scan 2006-08-22 makes --randsrc portable to Solaris and FreeBSD.

16. 2006-08-14 Roy Hills <Roy.Hills@nta-monitor.com> Aug 14, 2006 · release notes

    New check-packet CLI tool for validating aggressive mode packets using platform-independent RNG

    └──▷ TRY IT
    Validate the structure of a captured aggressive mode IKE packet file
    copy

    $ check-packet <path-to-aggressive-mode-packet>

    • Introduces platform-independent random packet generation via the new Mersenne Twister PRNG

    1 detail in Everything

    └──▷ BREAKING ON UPGRADE

    • !Packets generated by this version are incompatible with previous versions due to a different PRNG implementation
17. 2006-08-04 Roy Hills <Roy.Hills@nta-monitor.com> Aug 4, 2006 · release notes

    ike-scan adds --randsrc for spoofed IPs and --shownum to identify return packets.

    └──▷ TRY IT
    Scan IKE services while randomly spoofing your source IP address.
    copy

    $ ike-scan --randsrc <target>

    Inspect return packets to identify specific responses during DoS testing.
    copy

    $ ike-scan --shownum <target>

    • Adds --randsrc option for source IP spoofing in ike-scan
    • Adds --shownum flag to display the return packet number

    2 details in Everything

18. 2006-05-12 Roy Hills <Roy.Hills@nta-monitor.com> May 12, 2006 · release notes

    Adds s suffix for --interval and experimental packet timestamp display

    • Allows --interval flag to accept seconds via a trailing s (e.g., 10s) for finer granularity in timing packets.
    • Adds experimental %H:%M:%S.%u format support to display received packet timestamps before packet details.

    2 details in Everything

19. 2006-03-22 Roy Hills <Roy.Hills@nta-monitor.com> Mar 22, 2006 · release notes

    Adds --randomseed CLI flag to ike-scan for deterministic packet generation.

    └──▷ TRY IT
    Generate a deterministic IKE SA query to compare payloads against known good examples in testing.
    copy

    $ ike-scan --randomseed 12345 <target>

    • --randomseed enables specifying the PRNG seed for repeatable packet data

    1 detail in Everything

20. 2005-11-25 Roy Hills <Roy.Hills@nta-monitor.com> Nov 25, 2005 · release notes

    ike-scan 2005-11-25 adds --writepkttofile to capture packets for debugging

    • Adds --writepkttofile flag to write output packets to a local file instead of sending them

    1 detail in Everything

21. 2005-11-24 Roy Hills <Roy.Hills@nta-monitor.com> Nov 24, 2005 · release notes

    ike-scan 2005-11-24 adds --disable-lookup flag and improved OpenSSL libcrypto.a detection

    └──▷ TRY IT
    Scan for IKE services without performing reverse DNS lookups to reduce scan time or avoid DNS-related noise.
    copy

    $ ike-scan --disable-lookup <target>

    • Adds --disable-lookup option to disable initial DNS lookup
    • Supports libcrypto.a from $ssldir/lib or $ssldir via configure.ac

    2 details in Everything

22. 2005-08-02 Roy Hills <Roy.Hills@nta-monitor.com> Aug 2, 2005 · release notes

    ike-scan adds advanced transform creation with --trans=(attr=value,...) syntax for arbitrary IKE attributes

    └──▷ USE IT
    Specify custom IKE attributes for an ISAKMP transform using the new advanced syntax.
    shell copy

    ike-scan --trans=(a=1,b=2) <target_ip>

23. 2005-08-01 Roy Hills <Roy.Hills@nta-monitor.com> Aug 1, 2005 · release notes

    ike-scan 2005-08-01 adds Notification payload detail display

    • ike-scan now displays details of an ISAKMP Notification payload if one is returned, rather than just generic payload information

    1 detail in Everything

24. 2005-07-21 Roy Hills <Roy.Hills@nta-monitor.com> Jul 21, 2005 · release notes

    ike-scan adds --lifetime and --lifesize hex support for variable-length IKE attributes

    └──▷ USE IT
    Send a proposal with a custom hex-encoded lifetime value for testing edge cases.
    shell copy

    ike-scan --proposal=3:sha1:modp1024 --lifetime=0xff <target>

    • --lifetime and --lifesize options now accept hex numbers (e.g., 0xff) to set variable length values in addition to decimal integers or the none option

    1 detail in Everything

25. 2005-07-06 Roy Hills <Roy.Hills@nta-monitor.com> Jul 6, 2005 · release notes

    Adds --exchange flag to set arbitrary ISAKMP header values and changes default rate control to bandwidth.

    • Adds --exchange option to allow the exchange field in the ISAKMP header to be set to arbitrary values
    • Changes default packet rate calculation from interval to bandwidth (default: 56000 bits per second)
    • Retains interval argument support for backwards compatibility with exact packet rate specifications

    3 details in Everything

26. 2005-06-21 Roy Hills <Roy.Hills@nta-monitor.com> Jun 21, 2005 · release notes

    ike-scan adds --hdrflags, --hdrmsgid, and --cookie flags to control ISAKMP header fields.

    └──▷ TRY IT
    Send an IKE SA request with custom flags and message ID for protocol analysis
    copy

    $ ike-scan --hdrflags 0x12 --hdrmsgid 5 192.168.1.1

    Spoof a specific initiator cookie to test or interact with VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. gateways requiring static cookies
    copy

    $ ike-scan --cookie 0x1a2b3c4d5e6f7890 10.0.0.1

    • Adds --hdrflags option to specify the Flags field in the ISAKMP header
    • Adds --hdrmsgid option to specify the MsgID field in the ISAKMP header
    • Adds --cookie option to set the initiator cookie to a static value

    3 details in Everything

27. 2005-06-17 Roy Hills <Roy.Hills@nta-monitor.com> Jun 17, 2005 · release notes

    ike-scan now displays detailed ISAKMP Delete payload content

    • Display details of an ISAKMP Delete payload if one is returned

    1 detail in Everything

28. 2005-06-15 Roy Hills <Roy.Hills@nta-monitor.com> Jun 15, 2005 · release notes

    ike-scan adds hex display for responder cookies and non-zero SPIs

    • Displays the IKEv1 responder cookie value as a hex string in SA and Notify payloads.
    • Prints the SA Proposal Security Parameter Index (SPISPISerial Peripheral Interface, a synchronous communication bus standard used to connect microcontrollers to sensors, flash memory, and other peripherals at short range; cyber tools use it to read or write firmware on embedded devices.) as hex when the proposal header SPI size is non-zero.

    2 details in Everything

29. 2005-05-12 Roy Hills <Roy.Hills@nta-monitor.com> May 12, 2005 · release notes

    ike-scan adds SO_REUSEADDR for TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. sockets, POSIXPOSIXA family of standards for operating-system interfaces, including process, file and shell behavior. Software that uses these interfaces is easier to move between compatible systems. regex patterns, and 16 new vendor IDs.

    └──▷ TRY IT
    Scan for IKE services on a specific IP using TCP to avoid TIME_WAIT conflicts.
    copy

    $ ike-scan --tcp <target>

    • Adds --tcp option with SO_REUSEADDR to allow TCP scanning even if the port is in TIME_WAIT state.
    • Uses POSIX regex to split backoff and vendor ID patterns for more flexible matching.
    • Updates ike-vendor-ids with 16 new Vendor IDs.

    3 details in Everything

30. 2005-03-19 Roy Hills <Roy.Hills@nta-monitor.com> Mar 19, 2005 · release notes

    ike-scan adds --doi, --situation, --protocol, and --transid flags for fine-grained IKE packet construction.

    • Adds --doi (-D) flag to set the DOI in outbound IKE SA packets
    • Adds --situation (-S) flag to set the Situation ID in outbound IKE SA packets
    • Adds --protocol (-j) flag to set the proposal protocol for outbound IKE packets
    • Adds --transid (-k) flag to set the transform ID for outbound IKE packets

    4 details in Everything

31. 2005-03-10 Roy Hills <Roy.Hills@nta-monitor.com> Mar 10, 2005 · release notes

    ike-scan adds --certreq flag and improves certificate type decoding

    └──▷ TRY IT
    Send an IKE_SA_INIT request containing a CertificateRequest payload to probe for specific certification authorities.
    copy

    $ ike-scan --certreq <target_ip>

    • Adds --certreq (-C) CLI flag to include a CertificateRequest payload in outgoing packets
    • Improves decoding of Certificate and CertificateRequest payloads to explicitly include the certificate type in output

    2 details in Everything

32. 2005-03-09 Roy Hills <Roy.Hills@nta-monitor.com> Mar 9, 2005 · release notes

    ike-scan adds manual control over ISAKMP header length, version, and MBZ fields via new CLI flags.

    └──▷ USE IT
    Send an IKE probe with a manually crafted header length for custom testing or evasion.
    shell copy

    ike-scan --headerlen 100 <target_ip>

    Force the MBZ fields to non-zero values to test endpoint compliance with strict RFC validators.
    shell copy

    ike-scan --mbz 1 <target_ip>

    Spoof the IKE version in the header to test for backward compatibility with legacy implementations.
    shell copy

    ike-scan --headerver 0x20 <target_ip>

    • Adds --headerlen (short flag -L) to manually specify the ISAKMP header length
    • Adds --mbz (short flag -Z) to set the reserved (MBZ) fields to non-zero values
    • Adds --headerver (short flag -E) to alter the ISAKMP header version from the default 0x10

    3 details in Everything

33. 2005-02-18 Roy Hills <Roy.Hills@nta-monitor.com> Feb 18, 2005 · release notes

    ike-scan now allows attaching arbitrary data (IDs, transforms) to host entries via new structure field

    • Adds extra data structure to host entry to support attaching arbitrary extra data such as an id string or transform specification

    1 detail in Everything

34. 2005-02-15 Roy Hills <Roy.Hills@nta-monitor.com> Feb 15, 2005 · release notes

    ike-scan adds --bandwidth and --noncelen flags for traffic shaping and nonce control

    └──▷ TRY IT
    Throttle scan traffic to a specific bandwidth limit (e.g., 1 Mbps) to avoid detection or congestion
    copy

    $ ike-scan --bandwidth=1000000 <target>

    Force a specific nonce length (e.g., 16 bytes) for aggressive mode probes
    copy

    $ ike-scan --noncelen=16 <target>

    • Adds --bandwidth (-B) flag to specify outgoing bandwidth directly, automatically calculating the appropriate interval based on packet size
    • Adds --noncelen (-c) option to allow changing the length of nonce data in aggressive mode

    2 details in Everything

35. 2004-12-31 Roy Hills <Roy.Hills@nta-monitor.com> Dec 31, 2004 · release notes

    ike-scan adds --interval microsecond suffix support for finer timing control

    └──▷ TRY IT
    Use microsecond precision when scanning for low-latency or high-precision IKE responder detection
    copy

    $ ike-scan --interval=10u 192.168.1.1

    • Adds u suffix to the --interval CLI argument to specify time in microseconds (default remains milliseconds)

    1 detail in Everything

36. 2004-12-08 Roy Hills <Roy.Hills@nta-monitor.com> Dec 8, 2004 · release notes

    ike-scan adds automatic default dictionary loading and multi-hash cracking to psk-crack

    • psk-crack no longer requires the --dictionary argument to use its default dictionary file
    • psk-crack now supports cracking multiple PSK hashes from a single parameters file containing multiple lines

    2 details in Everything

37. 2004-11-29 Roy Hills <Roy.Hills@nta-monitor.com> Nov 29, 2004 · release notes

    ike-scan allows writing PSK data to a file via the new -P argument

    └──▷ TRY IT
    Capture Pre-Shared Key material from an ISAKMP exchange to a file for offline brute-forcing.
    copy

    $ ike-scan --pskcrack=keys.dat <target_ip>

    • Adds optional filename argument to --pskcrack (-P) option to write PSK data to a file for later cracking with psk-crack

    1 detail in Everything

38. 2004-10-05 Roy Hills <Roy.Hills@nta-monitor.com> Oct 5, 2004 · release notes

    ike-scan 2004-10-05 adds --nodns to skip DNS lookups and stabilizes long argument handling

    └──▷ TRY IT
    Scan an IP range without waiting on DNS lookups to speed up CI or bulk scans.
    copy

    $ ike-scan --nodns 192.168.1.0/24

    • Adds --nodns / -N flag to skip DNS resolution during scans

    1 detail in Everything

39. 2004-07-19 Roy Hills <Roy.Hills@nta-monitor.com> Jul 19, 2004 · release notes

    Adds psk-crack utility for Aggressive Mode PSK cracking via dictionary attack

40. 2004-07-09 Roy Hills <Roy.Hills@nta-monitor.com> Jul 9, 2004 · release notes

    ike-scan adds --pskcrack (-P) flag for Aggressive Mode PSK parameter extraction

    └──▷ TRY IT
    Extract IKE SA parameters from a target in Aggressive Mode to prepare the hash for offline cracking.
    copy

    $ ike-scan --pskcrack <target_ip>

    • Adds --pskcrack (-P) option to output PSK parameters as colon-separated hex values for external cracking.

    1 detail in Everything

41. 1.6.2 Jul 8, 2004 · release notes

    ike-scan 1.6.2 adds --tcp support with Cisco encapsulation and connect timeout

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.6.2 https://github.com/royhills/ike-scan.git
    # already have the repo? check out this version:
    $ git checkout 1.6.2

    • Adds --tcp (-T) option to scan IKE over TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. instead of UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. only, supporting raw IKE and Cisco proprietary encapsulated IKE.
    • Allows --tcp flag to take an optional numeric argument (1 for raw IKE over TCP, default; 2 for Cisco encapsulation) to target specific implementations like Cisco VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. Concentrator.

    2 details in Everything

42. 2004-06-16 Roy Hills <Roy.Hills@nta-monitor.com> Jun 16, 2004 · release notes

    ike-scan adds vendor ID patterns and timing error smoothing for improved detection reliability

    • Adds several new Vendor ID patterns bringing the total recognized to 68
    • Merges in timing error smoothing code based on RFC 793 TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. RTT algorithm, controlled by ALPHA define in ike-scan.h

    2 details in Everything

43. 2004-05-25 Roy Hills <Roy.Hills@nta-monitor.com> May 25, 2004 · release notes

    This release updates the ike-scan CLI tool to distinguish between string and hex inputs for identification, improving clarity for network practitioners.

    • The --id argument now supports both hex (e.g. 0xdeadbeef) and plain text (e.g. test) values, with the leading 0x indicating a hex format.

    1 detail in Everything

    └──▷ BREAKING ON UPGRADE

    • !Existing hexadecimal values passed to --id must gain a leading 0x or be rewritten as text strings.
44. 2004-04-15 Roy Hills <Roy.Hills@nta-monitor.com> Apr 15, 2004 · release notes

    Adds --random (-R) flag to randomize host entry scanning order

    └──▷ TRY IT
    Randomize the order in which targets are probed to avoid triggering linear pattern-based defenses or load balancers
    copy

    $ ike-scan --random <target_range>

    • Adds the --random (shorthand -R) CLI option to shuffle the list of target hosts using the Knuth shuffle algorithm before scanning

    1 detail in Everything

45. 2003-12-24 Roy Hills <Roy.Hills@nta-monitor.com> Dec 24, 2003 · release notes

    ike-scan adds --quiet, --multiline flags and improves SA/ID payload decoding

    • Adds --quiet option to suppress packet decode output
    • Adds --multiline option to split decode over multiple lines (one line per payload)
    • Improves protocol decode by showing SA transform attributes and ID payloads

    3 details in Everything

46. 2003-12-11 Roy Hills <Roy.Hills@nta-monitor.com> Dec 11, 2003 · release notes

    ike-scan adds Vendor ID fingerprinting via --vidpatterns option

    └──▷ TRY IT
    Scan a target for IKE vendors using a custom database file instead of the default.
    copy

    $ ike-scan --vidpatterns /path/to/my-vendors.txt <target>

    • --vidpatterns / -I flag to specify a custom Vendor ID patterns file location for fingerprinting.
    • Vendor ID fingerprinting capability using fingerprints loaded from the ike-vendor-ids database.

    2 details in Everything

47. 2003-12-10 Roy Hills <Roy.Hills@nta-monitor.com> Dec 10, 2003 · release notes

    ike-scan 1.x supports IPnet/bits and IP start-end ranges for target specification

    └──▷ TRY IT
    Scan a CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. subnet for IKE responses without expanding the list manually
    copy

    $ ike-scan 192.168.1.0/24

    Scan a contiguous block of IP addresses by specifying start and end points
    copy

    $ ike-scan 192.168.1.1-192.168.1.50

    • Adds support for IPnet/bits CIDR notation in target arguments
    • Adds support for IPstart-IPend range syntax in target arguments

    2 details in Everything

48. 2003-11-18 Roy Hills <Roy.Hills@nta-monitor.com> Nov 18, 2003 · release notes

    ike-scan 2003-11-18 adds flexible ISAKMP packet parsing and multi-Vendor ID display via display_packet re-write.

    • Re-writes display_packet() to parse ISAKMP packets using new isakmp.c routines, enabling display of multiple Vendor ID payloads instead of just the first one.
    • Adds detection and printing of vendor ID payloads anywhere in the packet (previously restricted to immediately after the SA payload), supporting accurate aggressive mode analysis.

    2 details in Everything

49. 2003-10-30 Roy Hills <Roy.Hills@nta-monitor.com> Oct 30, 2003 · release notes

    ike-scan gains strtoul parsing for full unsigned range and dynamic timeout adjustment.

    • Uses strtoul(optarg, (char **)NULL, 10) instead of atoi() for unsigned options to allow the full unsigned integer range.
    • Dynamically adjusts select_timeout based on the requested interval and cumulative error to improve timing precision.
    • Displays the pass number in verbose output (verbose >= 1) during scanning.

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The --selectwait option is removed as it is now unnecessary.
50. 2003-07-16 Roy Hills <Roy.Hills@nta-monitor.com> Jul 16, 2003 · release notes

    ike-scan 2003-07-16 allows custom vendor IDs via --vendor hex strings

    • Allows specifying arbitrary vendor IDs in --vendor as a hex string instead of an MD5 hash

    1 detail in Everything

    └──▷ BREAKING ON UPGRADE

    • !--vendor now expects a hex string; passing a plain text string (previously hashed to MD5) is no longer interpreted as a vendor ID.
51. 2003-07-10 Roy Hills <Roy.Hills@nta-monitor.com> Jul 10, 2003 · release notes

    ike-scan adds watchguard-soho/sonicwall-pro backoff patterns using new / notation

    └──▷ USE IT
    Specify a custom backoff with per-entry fuzz using the new slash notation.
    shell copy

    ike-scan --backoff=10/5/2 <target_ip>

    • Adds watchguard-soho and sonicwall-pro to the list of supported ike-backoff-patterns for testing device rekeying behavior.
    • Enables per-entry fuzz values in backoff patterns using the / notation (e.g., base/interval/fuzz).
    • Updates help output to clarify that per-pattern fuzz entries override global --fuzz settings.

    3 details in Everything

52. 2003-07-04 Roy Hills <Roy.Hills@nta-monitor.com> Jul 4, 2003 · release notes

    ike-scan adds per-pattern-entry fuzz specification support