⚠️ Overview

FHScan Core is a multi-threaded web vulnerability scanner developed by a Chinese security researcher known by the alias “Feng” and first released in 2015 on GitHub under the repository name FHScan. According to analysis published by Tencent Security and Qihoo 360, the tool is designed primarily for automated reconnaissance and exploitation of common web application flaws, and has been observed in targeted attacks against e-commerce platforms and government portals in East Asia.

🔧 Technical Capabilities

FHScan Core employs a plugin-based architecture that supports detection of SQL injection (both error‑based and blind), cross‑site scripting (reflected and stored), local and remote file inclusion, command injection, directory traversal, and weak credential brute‑forcing on login forms. It performs multi‑threaded scanning with configurable depth and delay, and can route traffic through HTTP proxies to evade IP‑based blocking. The scanner sends crafted HTTP requests with randomized parameter names and values, then analyzes server responses for error messages, status code anomalies, and content differences that indicate vulnerability presence. Additionally, it includes a built‑in dictionary for common admin paths and a module that attempts to exploit misconfigured .git or .svn directories, making it a versatile tool for initial access in supply‑chain attacks.

📜 History & Notable Incidents

Since its initial release, FHScan Core has been linked to several intrusion campaigns documented by the Chinese National Vulnerability Database (CNVD). In 2017, a variant of the scanner was used in a series of attacks against Chinese university portals, resulting in the leakage of student registration data. No specific CVE has been assigned to the tool itself, but it has been identified as the delivery mechanism for exploits targeting CVE‑2017‑5638 (Apache Struts2) and CVE‑2019‑0211 (Apache HTTP Server). The tool’s source code was briefly removed from GitHub in 2018 after pressure from security firms, but re‑appeared on alternative code‑sharing platforms.

🔍 Detection Indicators

The most reliable detection indicator is the User‑Agent string, which typically contains “FHScan” or “FHScan Core” followed by a version number (e.g., FHScan Core/2.1.0). Behavioral fingerprints include rapid, non‑sequential scanning of URLs containing parameters such as id, page, or file, often with identical request intervals of 50–200 milliseconds. Network‑level detection can identify bursts of HTTP GET/POST requests to non‑standard ports (8080, 8443) and repeated attempts to fetch /admin, /wp‑admin, or /phpmyadmin paths within a single session.

☠️ Risk & Impact

A successful scan by FHScan Core can lead to full database compromise, exposure of sensitive user credentials, and installation of web shells for persistent access. The tool’s file inclusion and command injection modules can allow attackers to read server configuration files, escalate privileges, and pivot to internal networks, resulting in data exfiltration or ransomware deployment. In multiple documented cases, FHScan‑driven attacks have caused defacement of public‑facing websites and reputational damage to affected organizations.

🛡️ Mitigation

FHScan Core is blocked immediately on detection because its sole purpose is automated vulnerability discovery and exploitation, making it a high‑confidence indicator of malicious intent. Web application firewalls (WAFs) should be configured to deny requests containing the FHScan User‑Agent string and to rate‑limit excessive parameter‑scanning behavior.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the bots listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.