o3set/dsh-mapscan: DeepSeek Harness Cyberspace Mapping Comprehensive Query Across Five Platforms

Introduction¶

DeepSeek Harness (DSH) is a plugin-centric system that can inject tools into sessions through dynamic Cordis plugins. During asset mapping, penetration testing, or attack surface enumeration, it is often necessary to query five platforms simultaneously: FOFA, Shodan, YingTu Hunter, ZoomEye, and Quake. These platforms have different search syntax, authentication methods, and data structures. o3set/dsh-mapscan is designed to address this pain point by wrapping the five platforms into a unified toolset, providing normalized output and persistent API key management capabilities, enabling the penetration testing workflow to be driven directly through natural language.

Core Capabilities¶

This plugin provides the following main functions:

• Unified five-platform search: Supports FOFA, Shodan, YingTu Hunter, ZoomEye, and Quake.
• Single IP mapping details: Queries detailed fingerprint information for a specified IP across platforms.
• Aggregated statistics: Performs field-level aggregation analysis on query results.
• Account and quota queries: Queries the account balance, remaining credits, and other status for each platform.
• Shodan DNS tools: Provides batch domain resolution (domain→IP) and subdomain enumeration (A/CNAME records).
• Persistent API key management: Supports credential vault storage and deletion, and references via environment variables.
• Normalized output: Unified output fields include ip, port, protocol, domain, title, banner, certificate, geo information, components, and risk level.
• Zero runtime dependencies: Depends only on DSH sandbox capabilities (ctx.shell and web.fetch), with no additional npm dependencies.
• Sandbox friendly: Supports custom headers (such as ZoomEye API-KEY) and POST request bodies (such as Quake X-QuakeToken).
• Concurrency and cancellation: Declared as a concurrency-safe tool and supports caller cancellation via exec.signal.

Installation and Prerequisites¶

Installing this plugin requires only one command. It is a DSH bundle plugin. After installation, the corresponding tools are registered in the current session or global assembly tree.

O3SET/dsh-mapscan

Prerequisites:
* DeepSeek Harness: Version must satisfy >= 0.1.7-rc.2.
* Zero runtime dependencies: The plugin itself does not depend on external Node.js libraries; building and running only use the sandbox capabilities provided by DSH.

Configuration and Usage¶

Before using it, configure the API keys for each platform. The plugin supports writing keys to the credential vault, or referencing them through environment variables.

1. Configure API Key¶

Use the map_set_keys tool to set keys. The platform parameter (platform) can be omitted, and the system will automatically route to platforms that have been configured with keys.

// 配置 FOFA 和 Shodan 的 Key
map_set_keys { "fofa": "你的Key", "shodan": "你的Key" }

2. Unified Search¶

Use map_search to perform searches. It also supports omitting the platform parameter for multi-platform combined search.

// 搜索 CN 地区的 Nginx
map_search { 
    "platform": "fofa", 
    "query": "app=\"nginx\" && country=\"CN\"", 
    "size": 20 
}

// Shodan 搜索示例
map_search { 
    "platform": "shodan", 
    "query": "nginx port:443 country:CN" 
}

3. Single IP Details and Statistics¶

Query specific asset information or perform data aggregation.

// 查询单个 IP 的详情（自动并行查询已填 Key 的平台）
map_ip_detail { "platform": "shodan", "ip": "1.1.1.1" }

// 聚合统计（自动统计已填 Key 的平台）
map_stats { 
    "platform": "fofa", 
    "query": "app=\"nginx\"", 
    "fields": "title,port" 
}

4. Account Query¶

View the account status of each configured platform.

map_account { "platform": "fofa" }

Sandbox and Runtime Characteristics¶

Because it only uses DSH sandbox capabilities, the plugin runs more securely in isolated environments.

• Concurrent execution: The tool declares isConcurrencySafe and supports concurrent calls.
• Caller cancellation: It supports forwarding exec.signal to underlying shell requests, allowing the process to terminate when the user interrupts.
• Zero runtime dependencies: There are no node_modules dependencies, resulting in a small installation size and fast loading.
• Sandbox friendly: Supports custom configuration of HTTP headers (Header) and POST data to meet different platform authentication requirements.

Notes¶

• Config Schema: Plugin configuration items must conform to the schemastery schema specification.
• Persistence scope: Key writing and storage are performed only on the local loopback address.
• Automatic parameter routing: When the platform parameter is omitted, the tool only takes effect for platforms with configured API keys; platforms without configured keys are automatically skipped.

Summary¶

o3set/dsh-mapscan provides DSH users with a unified network space mapping interface. By encapsulating the differences among five mainstream mapping platforms internally, users only need to focus on generic search syntax and result parsing to complete the full workflow from asset discovery to detail queries and statistical analysis. Its zero-dependency and sandbox-friendly characteristics make it suitable for various security testing environments.

• Project homepage: https://github.com/O3SET/dsh-mapscan
• Ecosystem listing: https://www.skillhub.cn/plugins/O3SET/dsh-mapscan