Sweshi's Tutorials

Scanning Tool Tutorials


masscan tutorial

NOTICE: All the tutorials on this website are meant to help you find security vulnerabilties on your own network and devices to understand your security posture before black hats do. Penetration testing without a written consent is illegal and you can be prosecuted. Use these tutorials to secure your own networks or those whose permission you have been granted. Keep it ethical and keep it professional.
Table of Contents
masscan introduction

Kali Linux will have this tool already installed but other distro might not. Run the following command or its equivalent.

masscan installation
sudo apt install masscan

There are a number of port scanners out there but when it comes to fast port scanning especially for large networks, masscan is one of the fastest tools you can use. Thats right, even nmap is slower than masscan.It was created to scan networks as quickly as possible sending out as many packets as possible within a short time frame.

masscan example usage
single port scan
masscan 192.168.43.0/24 -p443

This will scan the class C subnet for port 443. This is a single port scan but the tool can also do multiple ports

multiple port scan
masscan 192.168.43.0/24 -p80,443,20,21

This command will scan the whole class C subnet for ports 20,21,80 and 443. You can separate the ports using commas.

scanning a range of ports
masscan 192.168.43.0/24 -p20-150

This command will scan the whole class C subnet for ports starting from 20 up to 150.

scanning top ports
masscan 192.168.43.0/24 --top-ports 100

The command scans from a pre-written list of top ports. You can change and scan the top 10 ports by modifying the last digit from 100 to 10.

modifying the speed
masscan 192.168.43.0/24 -p80 --rate 100000

The whole point of using masscan is for speed so lets dive into this. The default speed is at about 100 packets per second but we can increase it significantly without much in terms of performance costs. Be careful thought because you are likely to trigger a number of intrusion detection systems and you could face some consequences. You can however use this on a local network especially to stress test some systems.

exclusions
masscan 192.168.43.0/24 --top-ports 10 --excludefile exclude.txt

the "exclude.txt" file can have comma separated port numbers or you could simply list the port number manually like so.

masscan 192.168.43.0/24 --top-ports 10 --excludefile 30,53,80
masscan cheatsheet for nmap functionality

Some nmap functions work in masscan such as the following

-e interface : you can select your network interface -vv interface : very verbose output -v interface : verbose output -S interface : spoof source IP --exclude : file with excluded ports -iL filename : read inputs from a file
examples
masscan cheatsheet: range of ports. masscan cheatsheet: scanning subnet.