Garia.Net

1.14.0 – 11 September 2026

A command line that scans, writes the result and exits

For a script, an RMM or a scheduled job – no browser, no web server, no port, no key:

gscan.com --scan C:\ --out c.json                 the whole result as JSON
gscan.com --scan C:\ --out c.csv --what advice    the findings as CSV
gscan.com --scan D:\Data --out -                  JSON to standard output

• The JSON is what /api/result returns, the CSV what /api/export returns – the same code builds both now. --format json|csv follows the file name unless given.
• Exit code 0 is done, 1 the scan or writing failed, with the reason on standard error, 2 wrong arguments. The command line is strict on purpose: an unknown argument, a missing value or --what with JSON ends in 2 rather than in something else than was asked for.
• Never a message box on this path. It usually runs as System from an RMM agent, in a session where nobody can click OK, and a box there would hang the script for good.
• The file is written next to the target and renamed into place, so a reader never sees half a file, and a symbolic link planted at the target is replaced, not followed.
• C: means the drive, not the current folder on it. And "C:\", which Windows hands over as C:", is put right when it is the last argument.

gscan.com

gscan.exe is a program without a console, and neither cmd nor PowerShell waits for one: a script carried on while the scan still ran, and the exit code was lost. gscan.com, a 148 KB console program next to gscan.exe in both installers, starts it with the same arguments and the same input and output, waits, and passes the exit code on. In cmd, typing gscan in the installation folder picks it; in PowerShell it is .\gscan.com or the full path, because PowerShell runs nothing from the current folder by itself.

It starts gscan.exe from its own folder, never through the search path, and puts it in a job that closes with it: break it off, or let an RMM kill the script on a time-out, and the scan stops too instead of writing a file later.

Scripts for NinjaOne

docs\ninjaone, also in the installation folder, has three scripts and a README:

• GScan-DiskReport.ps1 fills custom fields: a summary, free space in percent, what the three safe clean-ups free, and an HTML report of the largest folders and the findings.
• GScan-DiskAlert.ps1 asks Windows for the free space first and only scans when it is low; then it ends with exit code 1 and an output that says where the space went.
• GScan-Export.ps1 writes the largest files, the file types and the findings as CSV to a folder it locks down to SYSTEM and Administrators, optionally copied to a share.

They run under Windows PowerShell 5.1, contain nothing but ASCII, and read G-Scan’s output as UTF-8 whatever the console code page is.

Security

Found while going over the new input for abuse. The first two were in earlier versions too.

• Other websites could use the page on a workstation. Without a key G-Scan listens on 127.0.0.1, and every website open in the same browser can send a form there – to /api/delete, for instance – and with DNS rebinding even read the answer. API requests are now refused with 403 when the browser marks them as coming from another site (Sec-Fetch-Site), or, without a key, when Host or Origin is not the loopback. Scripts, curl, PowerShell and Postman send none of these headers.
• An SSH target could carry options. The host went onto ssh.exe’s command line unquoted, so -oProxyCommand=... would have started a program on this machine; the path went into find on the far machine unquoted, so /var -delete would have deleted instead of listed. The host may now only hold letters, digits and . - _ @ \ [ ] : %, not starting with -; the path must start with / and goes into the remote command between single quotes. A path with spaces works as a result. A relative path such as user@host:data is refused with sshTarget.
• A DLL next to the exe. gscan.exe and gscan.com now load their system DLLs from System32 only, so a version.dll waiting in Downloads next to a copied gscan.exe is no longer picked up.
• The command line takes no SSH password, only the key of the account it runs as: a password on a command line is readable for every local user.
• Output written as System: a link higher up the path is not something a program can rule out by itself. The README says to use standard output or a folder only administrators can write to, and GScan-Export.ps1 checks its folder before writing.

Verified

As an administrator on Windows 11, with three test suites that are now in tools\tests:

• Command line, 43 tests. JSON and CSV to a file and to standard output, counted against Get-ChildItem (4 files, 120,586,246 bytes), including a file name with accents and a euro sign. Every exit code with its message on standard error: ten kinds of wrong arguments give 2 and write nothing. An existing file is replaced without leftovers; a symbolic link at the target is replaced while the file it pointed to stays untouched. gscan.exe started without any console finishes and shows no window. Killing gscan.com mid-scan stops gscan.exe and leaves no file. /api/export gives the same CSV as the command line, byte for byte apart from the time line.
• All of C:, 1,508,895 files: 1.6 seconds from the command to the JSON on disk (190 KB), in turbo mode.
• Windows PowerShell 5.1: $LASTEXITCODE is right, and the JSON of C: reads with ConvertFrom-Json in 30 ms.
• NinjaOne scripts, 27 tests, under Windows PowerShell 5.1 with a stand-in for Ninja-Property-Set-Piped: all four fields in the right form – a whole percentage, GB with a decimal point whatever the regional settings, HTML with both tables; an empty field name skips its field; the alert on both sides of the threshold and through a script variable; the export folder ends up with SYSTEM and Administrators only, without inheritance; only the script’s own old CSV files are removed; a folder under a junction is refused with nothing written. The suite caught one bug first: a share that does not exist made Copy-Item write a file of that name and report success. Now that is exit code 1.
• Abuse, 30 tests, with raw HTTP requests so the headers are exactly what the test says. A delete from another site, from an old browser that only sends Origin, with Origin: null, and through DNS rebinding (Host: evil.example) all get 403, and the file stays. The page itself, localhost, [::1] and a script without browser headers get 200. Six malformed SSH targets give sshTarget without starting ssh. A stand-in ssh.exe shows the host as one argument and the path quoted: find '/var/met spatie -delete' -xdev .... DependentLoadFlag is 0x800 on both binaries. Photographed afterwards, the page still loads its scans.
• The MSI unpacked with msiexec /a: gscan.exe and gscan.com (both 1.14.0.0), Readme.html, API.md, the Postman collection, service-account.md and the four files in docs\ninjaone are identical to the build and the sources.
• Installed by him: gscan.com sits next to gscan.exe in the installation folder.

Not tested

• Inside NinjaOne itself. If a field stays empty: the field name, its type, and whether automations may write to it.
• Running as System. Scheduled tasks do not work on this machine, so everything ran as an administrator.
• Server and agent mode with the origin check live. They listen on the network, which could put a firewall prompt on the screen. The part of the check they use, Sec-Fetch-Site, is the same code the workstation tests went through.

1.13.0 – 11 September 2026

Find duplicates: always there, and you choose what it compares

Duplicates across every scan is now Find duplicates, and it stands in the sidebar with one scan as well as with several. Every choice is on that page:

• Look in – tick the scans to search. Scans over SSH are shown but cannot be ticked; their files cannot be read from here.
• Kind of files – Photos, video & audio, Documents, Archives & disk images, Installers, All files, or My own extensions (*.PDF, jpg works as well as .pdf .jpg). Each kind brings its own smallest size: 1 MB for media and installers, 100 KB for documents, 10 MB for archives, 50 MB for everything.
• From – that smallest size, from 100 KB to 1 GB.
• Same name, really. By default a duplicate has the same name and the same content; case does not count, so FOTO.JPG and foto.jpg are one name. Also copies with another name compares content alone, the way it worked until now.

The kind, the size and the switch are remembered in the browser. Above a result the page says what it searched, and warns when the choices have changed since. Find duplicates → on a scan’s own Duplicates finding opens the page with only that scan ticked.

Faster, because it reads less

A scan keeps its files of 50 MB and up. Below that, the search lists the chosen kind of file once more per scan – through the turbo reader where it can, a folder walk otherwise – and reads only within groups that share a name and size. Measured on C: (1,482,050 files, scanned in 2.2 seconds): photos, video and audio from 1 MB with the same name took 4.6 seconds in all, found 170 groups with 992.9 MB of extra copies, and read 1.57 GB to prove it.

API

POST /api/dupsacross takes ids, exts, min and names. Without them it behaves as before: every finished scan, from 50 MB, names ignored. The result carries opts with the choices it ran with, plus ssh_skipped. Progress has a phase 0 for listing, in which the counters count scans. API.md, the Postman collection, the README, Readme.html and Administrator.md describe it.

Fixed

• The across-scans page drew nothing once a result existed: a number was calculated from the groups before the groups were.
• capped was never reset, so after one search that hit the 40 GB reading limit every later result still said it was incomplete.
• Deleting across scans matched a path to a scan by text alone, so a scan of D:\Data also claimed D:\Data2\.... A scan’s root now has to be followed by \ or /.
• "in 1 scans" now reads "in 1 scan".

Verified

On a test instance with two small test folders and C:, through the API:

• Media from 1 MB, same name, two scans: foto.jpg three times (A, B, D\FOTO.JPG); with the switch on four times, the renamed vakantie.jpg included. The same size with other content was left out.
• Media from 100 KB adds klein.jpg twice; documents from 100 KB find rapport.pdf twice; archives from 10 MB find groot.iso across both scans; one scan alone finds nothing.
• Without any field: the old behaviour, from the files the scan already held.
• On the page: the choices, the searched-line and the warning after a change (light); deleting one extra copy from each of the two scans in one go put both in the Recycle Bin and in the log.
• On the 1.13.0 build: a search in one scan reads "in 1 scan"; a path under duptest belongs to scan 1, under duptest2 to scan 2, and under a folder duptest3 that was never scanned to no scan at all.
• The MSI unpacked with msiexec /a: gscan.exe (1.13.0.0), Readme.html, API.md, service-account.md and the Postman collection are identical to the build and the sources.
• Installed and tried by him: works.
• Not tested: the dark theme of the new page.

1.12.1 – 11 September 2026

The colours per level are back, now on both sides

The first attempt at a clearer explorer had a colour per folder level; the two panes of 1.12.0 left it out. He asked for it back – and with two panes it does more than it did in one list, because the same colour now ties the left to the right.

• Left: every folder icon has the colour of its level – Program Files blue, a folder in it orange, then green, purple, pink and yellow – and a line in that colour runs along everything below an open folder. The open folder’s row is tinted in its own colour.
• Right: the header and the rows carry a tint in the colour of the open folder, each step of the path has a small square in its level’s colour, and the subfolders have their icon in the colour they have on the left.
• The root of the scan has no colour. Hover, selection and the marks from a finding stay stronger than the tint. In the dark theme the tints are stronger, because the light theme’s would disappear there.

The Advice button on the overview is filled

Advice → under the findings on the overview is now a filled button, like New scan – it is the step most people take next.

Verified

• On C: (1,421,489 files), Program Files and three levels down to StarCitizen, light and dark: blue, orange and green match between the tree, the path and the contents; no script errors.
• The overview of a fresh scan (1,429,153 files): Advice → under the findings is filled blue, the same as New scan in the header.
• The MSI unpacked with msiexec /a: gscan.exe (1.12.1.0), Readme.html, API.md and the Postman collection are identical to the build and the sources.