bgscan vs WebCheck-OSINT: Two Ways to Run an Engagement Recon Pass

Both tools crossed my desk recently for the same job: recon. After that, they diverge completely. bgscan walks a network from a terminal, chaining ICMP through TCP to HTTP in one run. WebCheck-OSINT takes a single URL and pulls apart everything observable about that site from a browser, self-hosted like a small web service. Pick the wrong one for the wrong phase and you spend the day fighting the tool instead of the target.

curl -fsSL https://raw.githubusercontent.com/MohsenBg/bgscan/refs/heads/main/scripts/install.sh | sh

Most scanners do one protocol well. bgscan chains them: ping a range, connect to survivors, HTTP-probe the open ports, in a single run. (bgscan README)

Criterion 1: Surface covered

bgscan spans layers 3 to 7. ICMP sweep finds live hosts, TCP checks open ports, HTTP probes services over HTTP/1.1, HTTP/2, and HTTP/3 with QUIC. DNS queries run over UDP, TCP, and DNS-over-TLS with fallback and anti-hijacking checks. It also validates DNS tunnels (DNSTT, VayDNS, Slipstream) and speed-tests Xray outbounds. Each probe is a stage, stages chain into pipelines, and results write to CSV that feeds the next run. That covers both halves of discovery in one tool: what is alive, and what answers.

WebCheck-OSINT works a different surface. It is a TypeScript web app (Astro stack) that dissects one website: DNS records, TLS certificate, HTTP headers, redirects, cookies, tech fingerprint, hosting, whatever a single URL leaks publicly. No sweep, no port range. You hand it a domain, it returns a structured read on that host’s external posture.

So bgscan answers “what is on this network?” and WebCheck answers “what does this one site look like from outside?”

Criterion 2: Interaction model

bgscan is a BubbleTea TUI, fully keyboard-driven. Tabbed progress bars, per-stage result tables, live streaming logs, and an in-app settings inspector that reads and writes the same plain TOML files on disk. You shuffle-sample the target list, cap IP count, and adjust config mid-run without leaving the terminal. Built for iterative triage. No browser, no Electron, no web server.

WebCheck-OSINT is a service you deploy with Docker or Docker Compose, or on Fly, Netlify, or Vercel, then visit in the browser. You submit a URL and get a report. It is a batch workflow: submit, read the result, repeat. There is no live probe loop. That is a feature, not a flaw. When you need a reproducible web footprint you can screenshot, hand to a teammate, or append to a delivery report, a report endpoint beats a TUI every time.

Criterion 3: Output and integration

bgscan writes CSV and reuses it as input. Sweep a range, export the survivors, feed them into the TCP stage, then HTTP-probe whatever responds. Config lives in TOML, themes follow Catppuccin palettes, Xray outbounds import from share links or JSON files. It bundles IP lists for Cloudflare, AWS, Azure, Google, Akamai, Fastly, Bunny, G-Core, and public DNS resolvers, so you can scope against known infrastructure instead of hand-typing ranges.

WebCheck-OSINT outputs a browser page, and that changes who can consume the data. An engagement lead, a client, a team that never touches a terminal can all read it. Certificate chains and screenshots render natively. The cost is that you own a deployment. It does not run offline out of the box; you need Docker or an account on one of the supported hosters.

Criterion 4: When each earns its place

Run bgscan in the discovery phase. It tells you what is alive, which DNS resolvers behave, whether tunnels sit in the DNS path, and which proxies pass traffic. That data shapes the test plan. Then move to WebCheck-OSINT for the hosts that matter, one URL at a time, and build the external footprint you will cite later. The tools overlap only at the HTTP layer, and doubling up there costs nothing: bgscan proves the port answers, WebCheck shows what the application looks like behind it.

Conclusion

These are not substitutes. bgscan is a scanner you operate; WebCheck-OSINT is a report generator you deploy. Different phases, different output shapes, different people read the results. If you do external network and web work, both fit in one toolchain. Install bgscan with the command above, stand up WebCheck on Docker Compose, and the recon loop becomes: sweep, drill, document.