Mastering Unicornscan: High-Speed Port Scanning with Real-World Analysis

📌 Purpose
Learn how to use Unicornscan — a high-performance asynchronous port scanner — for advanced network reconnaissance, stealth scans, and OS fingerprinting. Includes real command outputs, PCAP logging, and a full lab scenario.

🚀 Introduction

When you need blazing-fast port scans, TTL-based OS detection, or stealthy TCP/UDP reconnaissance, Unicornscan shines. Included in Kali Linux, this powerful tool delivers performance Nmap sometimes can’t match on large-scale or noisy networks.

In this guide, we’ll cover:

• ✅ How Unicornscan works
• ✅ Real usage examples with output
• ✅ A practical scenario with analysis

🔧 Installation & Setup

Unicornscan is preinstalled in Kali Linux. But to verify or reinstall:

sudo apt update
sudo apt install unicornscan -y
unicornscan --version

To view all options:

unicornscan -h

🧪 Scan Syntax & Modes

Basic Format:

unicornscan [options] <target[:ports]>

⚡ Common Scan Examples (with Output)

🔹 1. Basic TCP SYN Scan

sudo unicornscan 172.16.215.132

📥 Output:

TCP open                http[   80]     from 172.16.215.132  ttl 128
TCP open               epmap[  135]     from 172.16.215.132  ttl 128
TCP open         netbios-ssn[  139]     from 172.16.215.132  ttl 128
TCP open        microsoft-ds[  445]     from 172.16.215.132  ttl 128

🧠 Insight: Host is running Windows services like NetBIOS and SMB.

🔹 2. UDP Port Check

sudo unicornscan -mU -r200 -I 192.168.100.1:53

📥 Output:

UDP open              domain[   53]     from 192.168.100.1  ttl 128

🧠 Insight: DNS service active on UDP port 53.

🔹 3. Multi-Port Subnet Scan

sudo unicornscan -r500 -mT 192.168.100.1/24:80,443,445,339

📥 Output (sample):

TCP open                http[   80]     from 192.168.100.5  ttl 64
TCP open          microsoft-ds[  445]   from 192.168.100.5  ttl 128

🧠 Insight: Host is dual-serving HTTP and SMB.

🔹 4. TCP + OS Detection + Logging

sudo unicornscan -r200 -Iv -eosdetect -mT 172.16.215.1:3306,80,443

📥 Output:

TCP open 172.16.215.1:80    ttl 64
TCP open 172.16.215.1:3306  ttl 64
OS `Linux'

🧠 Insight: Detected MySQL and web server; TTL suggests a Linux host.

🧑‍💻 Real-World Scenario: Internal Reconnaissance

🎯 Goal

Identify web, SSH, and MySQL services in 192.168.50.0/24, store logs for analysis, and detect operating systems.

🧵 Command

sudo unicornscan -r300 -Iv -eosdetect -mT 192.168.50.0/24:22,80,443,3306 -w scan_results.pcap

• -r300 → Control scan speed
• -eosdetect → TTL-based OS guessing
• -w → Save PCAP for Wireshark

📥 Sample Output:

TCP open 192.168.50.10:22  ttl 64 OS `Linux'
TCP open 192.168.50.10:80  ttl 64 OS `Linux'
TCP open 192.168.50.15:443 ttl 128 OS `Windows'
TCP open 192.168.50.20:3306 ttl 64 OS `Linux'

🧠 Analysis Table

📊 Use:

wireshark scan_results.pcap

To verify TTL, TCP flags, and handshake behavior.

🧠 Pro Tips

• Use lower -r values on sensitive networks to avoid IDS detection.
• Combine with -mTsFPU for Xmas-style stealthy probes.
• Always log scans using -w for offline analysis.
• Compare results with Nmap or Masscan for confirmation.

🧰 Final Cheat Sheet

🧩 Conclusion

Unicornscan is a powerful asset in your recon toolkit. While Nmap offers versatility, Unicornscan excels when speed, stealth, and TTL-based OS fingerprinting matter.

✍️ By Rajkumar Kumawat 🔗 GitHub Blog | Medium