Scanning Tool Tutorials
masscan tutorial
NOTICE: All the tutorials on this website are meant to help you find security vulnerabilties on your own network and devices to understand your security posture before black hats do. Penetration testing without a written consent is illegal and you can be prosecuted. Use these tutorials to secure your own networks or those whose permission you have been granted. Keep it ethical and keep it professional.
Table of Contents
- Introduction to Masscan
- Installing Masscan
- Examples of Masscan usage
- Masscan Exclusions
- Masscan cheatsheet
masscan introduction
Kali Linux will have this tool already installed but other distro might not. Run the following command or its equivalent.
masscan installation
sudo apt install masscan
There are a number of port scanners out there but when it comes to fast port scanning especially for large networks, masscan is one of the fastest tools you can use. Thats right, even nmap is slower than masscan.It was created to scan networks as quickly as possible sending out as many packets as possible within a short time frame.
masscan example usage
single port scan
masscan 192.168.43.0/24 -p443
This will scan the class C subnet for port 443. This is a single port scan but the tool can also do multiple ports
multiple port scan
masscan 192.168.43.0/24 -p80,443,20,21
This command will scan the whole class C subnet for ports 20,21,80 and 443. You can separate the ports using commas.
scanning a range of ports
masscan 192.168.43.0/24 -p20-150
This command will scan the whole class C subnet for ports starting from 20 up to 150.
scanning top ports
masscan 192.168.43.0/24 --top-ports 100
The command scans from a pre-written list of top ports. You can change and scan the top 10 ports by modifying the last digit from 100 to 10.
modifying the speed
masscan 192.168.43.0/24 -p80 --rate 100000
The whole point of using masscan is for speed so lets dive into this. The default speed is at about 100 packets per second but we can increase it significantly without much in terms of performance costs. Be careful thought because you are likely to trigger a number of intrusion detection systems and you could face some consequences. You can however use this on a local network especially to stress test some systems.
exclusions
masscan 192.168.43.0/24 --top-ports 10 --excludefile exclude.txt
the "exclude.txt" file can have comma separated port numbers or you could simply list the port number manually like so.
masscan 192.168.43.0/24 --top-ports 10 --excludefile 30,53,80
masscan cheatsheet for nmap functionality
Some nmap functions work in masscan such as the following
-e interface : you can select your network interface
-vv interface : very verbose output
-v interface : verbose output
-S interface : spoof source IP
--exclude : file with excluded ports
-iL filename : read inputs from a file
examples
