# QingScan runs its scanners as a ThinkPHP service with a scheduler

> QingScan is a self-hosted security operations platform written in PHP that combines asset inventory, vulnerability scanning, code audit and ticket handling in one web application, with no external scanner binaries. It fits teams that want one login and one asset list, and the fixed Ubuntu 24.04 install path plus an ambiguous licence are what to check before adopting it.

**78778443/QingScan** — 一个漏洞扫描器粘合剂,添加目标后30款工具自动调用；支持 web扫描、系统扫描、子域名收集、目录扫描、主机扫描、主机发现、组件识别、URL爬虫、XRAY扫描、AWVS自动扫描、POC批量验证，SSH批量测试、vulmap。

- Repository: https://github.com/78778443/QingScan
- Stars: 1,835 · Forks: 288
- Language: PHP
- License: not declared
- Published: 2026-10-16 · Updated: 2026-10-16 · Language: en
- Canonical page: https://hysenlabs.com/projects/78778443-qingscan

## The engines are now written in PHP, not shelled out to

The repository description describes QingScan as glue that calls around thirty third-party tools once you add a target. The README describes something different and more recent: a platform whose port scanning, subdomain enumeration, directory scanning, fingerprinting, SQL injection detection, weak password testing, WAF detection, crawler and code audit are all built in, in pure PHP, with no external scanner dependency. That is a meaningful change in what the software is, and the README is the current description, so treat the tool-invocation framing as out of date.

Written from scratch, the engines also mean the checks are only as current as the PHP that implements them. There is no template feed, no CVE lookup and no signature update service documented anywhere in the README, so detection coverage is fixed by the version you deploy. The stated rule set for code audit is syntax-aware taint analysis across ten or more categories including SQL injection, XSS and command execution.

The backend is ThinkPHP 8 with MySQL and a resident task scheduler, and the frontend is React 19 with TypeScript, Vite, shadcn/ui and ECharts for the statistics dashboard. It is a web application you operate, not a command line utility you run per target.

## Installing on Ubuntu 24.04 with composer, npm and two SQL dumps

The install is documented for Ubuntu 24.04 only, and the README says other systems are on you. The PHP extensions and the Composer dependency install come first:

```bash
apt install php php-xml php-gd php-mysqli php-dom php-cli php-zip unzip php-curl composer
cd QingScan/code && composer install
```

The frontend is built rather than served from a CDN, which matters because the web root it produces is served by the ThinkPHP process:

```bash
cd QingScan/code/web && npm install && npm run build
```

The database is created and then filled from two files in the deploy directory:

```bash
mysql -uroot -p -e "CREATE DATABASE QingScan DEFAULT CHARACTER SET utf8mb4;"
mysql -uroot -p QingScan < deploy/qingscan.sql
mysql -uroot -p QingScan < deploy/insert.sql
```

The README flags a real gotcha here: qingscan.sql contains no USE statement, so the database name has to be given on the command line exactly as above or the import lands nowhere useful. Connection details go into code/.env, in INI style rather than the dotenv KEY=value format people expect:

```ini
[DATABASE]
HOSTNAME = 127.0.0.1
DATABASE = QingScan
USERNAME = root
PASSWORD = your password
```

Note that the documented example uses the MySQL root account. That is fine for a first run on a throwaway VM and a poor idea on anything else.

## ./script.sh starts the web service and the scheduler together

QingScan runs as two processes. The convenience path starts both:

```bash
./script.sh
```

The README describes that script as the web service plus the resident scan scheduler, which generates and executes scan tasks. Run them separately instead and you get the same two pieces in more control:

```bash
php think run -p 8080
php think schedule
```

The scheduler is the half that matters operationally. It automatically generates tasks, runs them, and skips failures, so scan progress is observed from the website scan task queue rather than from a terminal. That design also means the tool keeps sending traffic on its own once it is started. There is no documented way to set a concurrency ceiling, a request rate, or a scan window, so on a shared network the only control you have is which targets you have added.

After startup the console lives at the /web/ path, not at the root:

```bash
http://127.0.0.1:8080/web/
```

The README gives the initial credentials as admin / 2111. That is a fixed, published password in the documentation, so change it before the port listens on anything other than loopback.

## From adding a URL to a ticket, in five steps

The workflow the README describes starts with adding targets: multiple URLs pasted at once, plus checkboxes selecting which scan tasks apply to them. Nothing is launched by hand after that. The scheduler picks the work up and the website scan task queue shows progress, and results appear grouped by category, with Web vulnerabilities, SQL injection, directory scan and fingerprint identification named separately.

Code audit is a parallel track rather than a mode of the web scanner. You add a code repository and the platform pulls it and audits it with the taint rules described earlier. Whether that pull uses an SSH key, an HTTPS token or a local path is not documented, which matters if your repositories are private.

The last step is process rather than detection: confirm a finding, then create a ticket from it in one action, and move it through a five-state flow until it is closed. That is the piece that distinguishes QingScan from a plain scanner. Vulnerability scanners produce lists; this one assumes someone will triage them, and the asset inventory module for hosts, ports, domains, subdomains and URLs is the shared context both tracks sit on.

There is no CLI, no documented API and no export format in the README, so results leave the console through the UI or through direct database access.

## Licence terms written as a warning, not as permissions

The repository has no licence identifier that GitHub recognises, and the README's Licenses section is written as terms of use rather than as a grant. It forbids unauthorised commercial use, including unauthorised commercial use after modification, limits the tool to legally authorised enterprise security work, and puts liability on the user. The README also states that using the software constitutes acceptance of the terms.

That is not the same thing as an open source licence, and it is the first question to settle. A team that intends to run QingScan as part of a commercial security service, or to fork it into an internal product, needs a direct answer from the author rather than an inference. Contact details for custom development are in the README, including a WeChat id.

From an engineering side, the code sits on the default branch main with the repository split into code/ and deploy/, and the newest tagged release is v1.8.0 from 2022-12-01 while the last push was on 2026-08-04. The gap between those two facts is the honest signal here: commits are landing, but the releases you can pin to are old.

## Where QingScan sits against the tool-collection approach

The obvious comparison is the pattern QingScan itself grew out of: run nmap, subfinder, nuclei, sqlmap and a directory fuzzer separately, then merge the output by hand. That approach wins on freshness, because each upstream tool has its own maintainers and its own template updates, and it wins on granularity, since you choose exactly which tool touches which target. Its cost is the merge, and that merge is precisely what this platform's ticket and asset modules are designed to absorb.

A second comparison is a commercial scanner console. Those products arrive with vendor support, defined coverage and a licence that permits what it permits. QingScan trades all of that for the fact that it runs on a host you own, on a stack you can read, with a licence that permits far less than the code would technically allow.

The specific gap between the two approaches is update cadence. External tools get new checks from their upstream projects; QingScan's PHP engines get new checks only when someone rewrites them in this repository, and no signature update mechanism is documented.

## Conclusion

QingScan suits a team that wants scanning, asset inventory and ticket flow in one console and is willing to run it on a single Ubuntu 24.04 host it controls. It is the wrong choice for an engineer who needs a documented licence, for a macOS or Windows workstation, or for anyone expecting it to drive nmap, xray or AWVS, since the README now states every engine is implemented in PHP. Before you start./script.sh, read the licence terms yourself, because they restrict unauthorised commercial use, and confirm the bundled admin / 2111 credentials are changed before the port is reachable by anything but localhost.

## FAQ

### What operating system does QingScan need?

The README documents the install for Ubuntu 24.04 only, and says other systems require the user to install the dependencies themselves. The documented steps use apt, composer install and npm run build.

### Does QingScan call nmap, xray or other external scanners?

The repository description frames it as glue that invokes around thirty tools, but the README states that all scanning capabilities are built-in engines written in pure PHP with no dependency on external scanning tools. Its detection coverage therefore comes from code inside this repository rather than from upstream template updates.

### What are the default login credentials for QingScan?

The README gives admin / 2111 for the console at http://127.0.0.1:8080/web/. Because the password is published in the documentation, change it before exposing the port beyond loopback.

### Why did my database import fail?

The README warns that qingscan.sql contains no USE statement, so the database name must be passed on the mysql command line, as in mysql -uroot -p QingScan < deploy/qingscan.sql. A second import of deploy/insert.sql follows the same pattern.

### How do scan tasks get started in QingScan?

You add URLs and tick the scan tasks you want, then the resident scheduler generates and executes them. Progress is visible in the website scan task queue, and failures are skipped automatically. The scheduler can be started alone with php think schedule.

## Sources

- [78778443/QingScan on GitHub](https://github.com/78778443/QingScan)
- [Issues](https://github.com/78778443/QingScan/issues)
- [README](https://github.com/78778443/QingScan/blob/main/README.md)
- [Releases](https://github.com/78778443/QingScan/releases)

---

Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/78778443-qingscan