在线进程分析 · 快速摸清目标主机软件环境
粘贴进程列表（tasklist / ps aux / ps -ef / top / NetExec 等），自动识别浏览器、杀毒软件 / EDR、远程控制、隧道代理、 数据库、Web 服务、开发工具等常见软件特征，一键生成可用于渗透测试前期信息收集与资产盘点的软件画像。
Online Process Analyzer · know the target's software at a glance
Paste a process list (tasklist / ps aux / ps -ef / top / NetExec logs) and instantly identify browsers, AV/EDR, remote-control tools, tunnels, databases, web services and developer tools — a software profile for pentest recon and asset inventory, generated in one click.
支持 Windows & Linux
签名库 500+ 条
纯浏览器本地运行 · 数据不上传
自动清洗 NetExec/CME 日志前缀
可下载后 离线使用
Supports Windows & Linux
500+ signatures
Runs locally · no data uploaded
Cleans NetExec/CME log prefixes
Offline-ready
① 粘贴进程列表
🔒 所有分析均在浏览器本地完成，输入内容不会上传到任何服务器；页面无任何第三方依赖，也可下载后完全离线使用。
📋 识别明细
📖 支持的输入格式与使用建议
工具会自动识别粘贴内容的格式与操作系统，通常无需手动指定平台。获取更完整的进程信息有助于提升识别率：
Windows · 推荐命令
tasklist # 默认表格 tasklist /fo csv # CSV 格式(推荐, 字段完整) tasklist /svc # 附带服务信息 sc query type= service state= all # 服务清单(自动识别内置/第三方服务) powershell "Get-Process" # PowerShell 输出
Linux · 推荐命令
ps auxf # 进程树, 含完整命令行(推荐) ps -ef # System V 风格 top -bn1 # 非交互式 top 输出
NetExec / CrackMapExec · 直接粘贴日志即可
nxc smb 192.168.1.0/24 -u user -p pass -x "tasklist" # 或 atexec / wmiexec 等执行 tasklist 后, 直接粘贴带前缀的输出 SMB 192.168.1.10 445 PC-01 Image Name PID Session Name ... SMB 192.168.1.10 445 PC-01 svchost.exe 804 Services 0 ... # ↑ 工具会自动剥离 [协议 IP 端口 主机名] 前缀, 并丢弃 [+] 类状态行
识别能力说明
- 软件识别：浏览器、杀毒软件 / EDR / HIDS、远程控制、内网穿透、VPN / 零信任、数据库、Web 服务、容器 / K8s、开发工具、办公通讯、云厂商 Agent 等。
- 命令行关键字：对 java / python 等宿主进程，会进一步扫描完整命令行识别 Burp Suite、SQLMap、Metasploit、宝塔面板等。
- 可疑启发式：仿冒系统进程名（如 svch0st.exe / scvhost.exe）、双扩展名、非 ASCII 同形字、从临时 / 公共目录运行等。
- Windows 服务名：支持
sc query/Get-Service/ 服务名清单，160+ 个内置服务归入系统服务，并单独标识 Sense(Defender)、W3SVC(IIS)、MSMQ、TermService(RDP)、VSS、ssh-agent 等。 - 主机画像：综合识别结果推断服务器角色、办公终端、企业域环境、云主机、虚拟化等环境线索。
Formats and the operating system are auto-detected — no need to pick a platform manually. Fuller command lines give better detection:
Windows · recommended commands
tasklist # default table tasklist /fo csv # CSV (recommended, full fields) tasklist /svc # include service names sc query type= service state= all # service list (built-in / third-party services) powershell "Get-Process" # PowerShell output
Linux · recommended commands
ps auxf # process tree with full command lines (recommended) ps -ef # System V style top -bn1 # non-interactive top output
NetExec / CrackMapExec · paste the log directly
nxc smb 192.168.1.0/24 -u user -p pass -x "tasklist" # or capture tasklist via atexec / wmiexec and paste the prefixed output SMB 192.168.1.10 445 PC-01 Image Name PID Session Name ... SMB 192.168.1.10 445 PC-01 svchost.exe 804 Services 0 ... # The [protocol ip port host] prefix is stripped automatically; [+] status lines are dropped
Detection capabilities
- Software identification: browsers, AV/EDR/HIDS, remote control, tunnels, VPN/zero-trust, databases, web services, containers/K8s, dev tools, office/IM suites, cloud agents and more.
- Command-line keywords: for hosts like java / python, the full command line is scanned to spot Burp Suite, SQLMap, Metasploit, BT Panel etc.
- Suspicious heuristics: typosquatted system process names (svch0st.exe / scvhost.exe), double extensions, non-ASCII homoglyphs, execution from temp/public directories.
- Windows service names: supports
sc query/Get-Service/ service-name lists — 160+ built-in services map to system services, while Sense (Defender), W3SVC (IIS), MSMQ, TermService (RDP), VSS and ssh-agent are called out individually. - Host profiling: infers server role, office workstation, enterprise domain environment, cloud instance, virtualization and more.