Khonshu
Khonsu is a powerful port scanning tool written in python that detect open ports with concurrent and accurately
Install / Use
/learn @RevoltSecurities/KhonshuREADME
<h1 align="center">
<img src="static/khonshu.png" alt="khonshu" width="300px">
<br>
</h1>
<p align="center">
<a href="https://opensource.org/licenses/MIT"><img src="https://img.shields.io/badge/license-MIT-_red.svg"></a>
<a href="https://github.com/RevoltSecurities/Khonshu/issues"><img src="https://img.shields.io/badge/contributions-welcome-brightgreen.svg?style=flat"></a>
<a href="https://github.com/RevoltSecurities/Khonshu/releases"><img src="https://img.shields.io/github/release/RevoltSecurities/Khonshu"></a>
</p>
Khonshu – A stealthy, concurrent port scanner written in asynchronous python that crafted for speed and accuracy.
Features:
<h1 align="center"> <img src="/static/khonsu-terminal.png" alt="khonshu-terminal" width="700px"> <br> </h1>- Accurate, concurrent, and highly scalable scanning engine with distributed workers, adjustable concurrency, and deterministic results.
- Passive scanning capability using Shodan Internet Database API for stealth reconnaissance
- Resume functionality allows continuing interrupted scans from where they left off
- JSON output format support for better integration with other security tools
- Custom network interface selection and DNS resolver configuration for advanced networking
- Port state filtering to show only specific port states (open, closed, filtered, unfiltered)
- Enhanced rate limiting up to 1000 requests per second with configurable concurrency levels
- Retry mechanism and configurable timeouts for improved scan reliability
- Multiple ping methods for comprehensive host discovery and validation
- All DNS IPs scanning to discover all IP addresses associated with a domain
- Scans for both IPv4/IPv6 addresses with full protocol support
Installation:
Prerequisite
Note: before installing khonshu, make sure to install
libpcap.
To install libcap on Linux: sudo apt install -y libpcap-dev, on Mac: brew install libpcap
Khonshu can be easily installed using the modern Python package installer uv. This method provides the fastest and most reliable installation experience.
Requirements:
- Python 3.13 or higher
uvpackage manager
Quick Installation:
# Install using uv (Recommended)
uv tool install khonshu
Alternative Installation Methods:
# Install using pip
pip install khonshu
# Install from source
git clone https://github.com/RevoltSecurities/Khonshu.git
cd Khonshu
pip install .
Verify Installation:
khonshu --version
Update Khonshu:
# Update using built-in updater
khonshu --update
# Or update using uv
uv tool upgrade khonshu
Note: The
uv tool installmethod automatically handles dependencies and provides better isolation, making it the preferred installation method for Khonshu.
Usage:
khonshu -h
_ __ _ _
| |/ /| | | |
| ' / | |__ ___ _ __ ___ | |__ _ _
| < | '_ \ / _ \ | '_ \ / __|| '_ \ | | | |
| . \ | | | || (_) || | | |\__ \| | | || |_| |
|_|\_\|_| |_| \___/ |_| |_||___/|_| |_| \__,_|
- RevoltSecurities
Khonshu – A stealthy, concurrent Python port scanner crafted for speed and accuracy.
[DEFAULT FLAGS]
╭────────────┬────────────────────────────────────────╮
│ Flag │ Description │
├────────────┼────────────────────────────────────────┤
│ -h, --help │ show this help message and exit. │
├────────────┼────────────────────────────────────────┤
│ --plain │ display the help message in plain text │
╰────────────┴────────────────────────────────────────╯
[INPUT]
╭───────────────────┬──────────────────────────────────────────────────────────────────────────────╮
│ Flag │ Description │
├───────────────────┼──────────────────────────────────────────────────────────────────────────────┤
│ -host, --host │ hosts to scan for open ports and supports comma separated values │
├───────────────────┼──────────────────────────────────────────────────────────────────────────────┤
│ -list, --list │ file that contains list of host to scan for open ports │
├───────────────────┼──────────────────────────────────────────────────────────────────────────────┤
│ -exclude-hosts │ hosts to exclude from the open port scan and supports comma separated values │
├───────────────────┼──────────────────────────────────────────────────────────────────────────────┤
│ -resume, --resume │ resume file generated by khonshu to continue the port scanning │
╰───────────────────┴──────────────────────────────────────────────────────────────────────────────╯
[PORT]
╭─────────────────────────┬────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮
│ Flag │ Description │
├─────────────────────────┼────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ -port, --port │ ports to scan (80,443 1-65535) │
├─────────────────────────┼────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ -top-ports, --top-ports │ top port numbers to scan (100,1000,full-port) │
├─────────────────────────┼────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ -port-file, --port-file │ file that contains list of port numbers to scan │
├─────────────────────────┼────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ -ep, --exclude-ports │ port numbers to exclude from port scanning and supports comma separated values │
├─────────────────────────┼────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ -tcpt, --tcp-ports │ comma-separated TCP port(s) to use for checking host availability via TCP SYN/ACK pings (e.g., 80,443,8080) │
├─────────────────────────┼────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ -pst, --port-state │ show only ports matching the specified state (e.g. open,closed,filtered,unfiltered,open|filtered) (default: open). │
╰─────────────────────────┴────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯
[OUTPUT]
╭──────────────┬─────────────────────────────────────────────╮
│ Flag │ Description │
├──────────────┼─────────────────────────────────────────────┤
│ -o, --output │ filename to save the open port scan results │
├──────────────┼─────────────────────────────────────────────┤
│ -j, --json │ enabled the output in json format │
╰──────────────┴─────────────────────────────────────────────╯
[RATE-LIMIT]
╭───────────────────┬──────────────────────────────────────────────────────────────────────────────────────╮
│ Flag │ Description │
├───────────────────┼──────────────────────────────────────────────────────────────────────────────────────┤
│ -c, --concurrency │ set the concurrency level for concurrent port scanning (default: 100) │
├───────────────────┼──────────────────────────────────────────────────────────────────────────────────────┤
│ -rt, --rate-limit │ set a rate limit for sending a maximum number of requests per second (default: 1000) │
╰───────────────────┴──────────────────────────────────────────────────────────────────────────────────────╯
[UPDATES]
╭──────────────────────┬──────────────────────────────────────────╮
│ Flag │ Description │
├──────────────────────┼──────────────────────────────────────────┤
│ -up, --update │ update the khonshu to the latest version │
├──────────────────────┼──────────────────────────────────────────┤
│ -sup, --show-updates │ show the latest updates of khonshu │
╰──────────────────────┴──────────────────────────────────────────╯
[HOST-DISCOVERY]
╭─────────────────────────────────────┬──────────────────────────────────────────────────────────────────────────────────╮
│ Flag │ Description │
├─────────────────────────────────────┼──────────────────────────────────────────────────────────────────────────────────┤
│ -Sn, --host-discovery │ perform only host discovery and skips the port scan │
├─────────────────────────────────────┼──────────────────────────────────────────────────────────────────────────────────┤
│ -Pn, --skip-discovery │ skip the host discovery and directly perform port scan │
├─────────────────────────────────────┼──────────────────────────────────────────────────────────────────────────────────┤
│ -En, --enable-discovery │ enable the host discovery before port scanning │
├─────────────────────────────────────┼───────
