256 lines
8.3 KiB
HTML
256 lines
8.3 KiB
HTML
<!DOCTYPE html>
|
|
<html lang="en">
|
|
<head>
|
|
<meta charset="UTF-8">
|
|
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
|
<meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self'; style-src 'self'; font-src 'self' data:; img-src 'self' data:; connect-src 'self'; base-uri 'self'; form-action 'self' https://defcon.social https://bsky.app;">
|
|
<meta http-equiv="X-Content-Type-Options" content="nosniff">
|
|
<link rel="stylesheet" href="../assets/css/style.css">
|
|
<link rel="icon" type="image/x-icon" href="../favicon.ico">
|
|
<script>
|
|
// Apply theme immediately to prevent flash
|
|
(function() {
|
|
const theme = localStorage.getItem('theme') ||
|
|
(window.matchMedia && window.matchMedia('(prefers-color-scheme: dark)').matches ? 'dark' : 'light');
|
|
document.documentElement.setAttribute('data-theme', theme);
|
|
})();
|
|
</script>
|
|
<title>masscan Cheatsheet - Cheatsheets - Launch Pad</title>
|
|
</head>
|
|
<body>
|
|
<button class="theme-toggle" id="themeToggle" aria-label="Toggle dark mode">
|
|
<svg class="theme-icon theme-icon-moon" xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 12.79A9 9 0 1 1 11.21 3 7 7 0 0 0 21 12.79z"></path></svg>
|
|
<svg class="theme-icon theme-icon-sun" xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" style="display: none;"><circle cx="12" cy="12" r="5"></circle><line x1="12" y1="1" x2="12" y2="3"></line><line x1="12" y1="21" x2="12" y2="23"></line><line x1="4.22" y1="4.22" x2="5.64" y2="5.64"></line><line x1="18.36" y1="18.36" x2="19.78" y2="19.78"></line><line x1="1" y1="12" x2="3" y2="12"></line><line x1="21" y1="12" x2="23" y2="12"></line><line x1="4.22" y1="19.78" x2="5.64" y2="18.36"></line><line x1="18.36" y1="5.64" x2="19.78" y2="4.22"></line></svg>
|
|
</button>
|
|
<br/><br/>
|
|
<div class="name">
|
|
__ _______________________ _________._________________________
|
|
\_ _____/ \______ \ / _ \ / _____/ / _____/ | | \_ _____/
|
|
| __) | _/ / /_\ \ / \ ___ / \ ___ | | | __)_
|
|
| \ | | \ / | \ \ \_\ \ \ \_\ \ | |___ | \
|
|
\___ / |____|_ / \____|__ / \______ / \______ / |_______ \ /_______ /
|
|
\/ \/ \/ \/ \/ \/ \/
|
|
</div>
|
|
<div class="blog-page-header">
|
|
<div class="blog-header-content">
|
|
<a href="/cheatsheets" class="back-link" title="Back to Cheatsheets">
|
|
<svg xmlns="http://www.w3.org/2000/svg" width="42" height="42" viewBox="0 0 24 24" class="home-icon"><path fill="currentColor" d="M10 20v-6h4v6h5v-8h3L12 3 2 12h3v8z"/></svg>
|
|
</a>
|
|
<h1 class="blog-page-title">masscan Cheatsheet</h1>
|
|
</div>
|
|
</div>
|
|
<div class="blog-post-container">
|
|
<div class="blog-posts-container" style="max-width: 900px; margin: 0 auto;">
|
|
<div class="blog-post">
|
|
<div class="blog-post-content">
|
|
<p><a href="index.html">← Back to cheatsheets</a></p>
|
|
<p><a href="../index.html">← Home</a></p>
|
|
<hr>
|
|
<p>Masscan is the fastest Internet port scanner. It can scan the entire Internet in under 6 minutes, transmitting 10 million packets per second. Uses asynchronous transmission for extreme speed.</p>
|
|
<hr>
|
|
<h2>Basic Usage</h2>
|
|
<ul>
|
|
<li>masscan <target> -p<ports> - Basic port scan</li>
|
|
</ul>
|
|
<ul>
|
|
<li>masscan 0.0.0.0/0 -p0-65535 - Scan entire internet (don't do this)</li>
|
|
</ul>
|
|
<hr>
|
|
<h2>Target Specification</h2>
|
|
<ul>
|
|
<li>masscan 192.168.1.0/24 - CIDR notation</li>
|
|
</ul>
|
|
<ul>
|
|
<li>masscan 192.168.1.1-192.168.1.254 - IP range</li>
|
|
</ul>
|
|
<ul>
|
|
<li>masscan -iL targets.txt - Read from file</li>
|
|
</ul>
|
|
<ul>
|
|
<li>masscan --exclude 192.168.1.1 - Exclude IP</li>
|
|
</ul>
|
|
<ul>
|
|
<li>masscan --excludefile exclude.txt - Exclude from file</li>
|
|
</ul>
|
|
<hr>
|
|
<h2>Port Specification</h2>
|
|
<ul>
|
|
<li>-p80 - Single port</li>
|
|
</ul>
|
|
<ul>
|
|
<li>-p80,443,8080 - Multiple ports</li>
|
|
</ul>
|
|
<ul>
|
|
<li>-p1-1000 - Port range</li>
|
|
</ul>
|
|
<ul>
|
|
<li>-p0-65535 - All ports</li>
|
|
</ul>
|
|
<ul>
|
|
<li>-pU:53 - UDP port</li>
|
|
</ul>
|
|
<ul>
|
|
<li>-p80,U:53 - Mixed TCP/UDP</li>
|
|
</ul>
|
|
<hr>
|
|
<h2>Rate Control</h2>
|
|
<ul>
|
|
<li>--rate 1000 - Packets per second (default 100)</li>
|
|
</ul>
|
|
<ul>
|
|
<li>--rate 10000 - 10k packets/sec</li>
|
|
</ul>
|
|
<ul>
|
|
<li>--rate 100000 - 100k packets/sec (needs tuning)</li>
|
|
</ul>
|
|
<ul>
|
|
<li>--max-rate 1000000 - Maximum rate limit</li>
|
|
</ul>
|
|
<hr>
|
|
<h2>Output Options</h2>
|
|
<ul>
|
|
<li>-oL output.txt - List output (default)</li>
|
|
</ul>
|
|
<ul>
|
|
<li>-oX output.xml - XML output</li>
|
|
</ul>
|
|
<ul>
|
|
<li>-oG output.gnmap - Grepable output</li>
|
|
</ul>
|
|
<ul>
|
|
<li>-oJ output.json - JSON output</li>
|
|
</ul>
|
|
<ul>
|
|
<li>-oB output.binary - Binary output</li>
|
|
</ul>
|
|
<ul>
|
|
<li>--open - Only show open ports</li>
|
|
</ul>
|
|
<hr>
|
|
<h2>Banner Grabbing</h2>
|
|
<ul>
|
|
<li>--banners - Grab service banners</li>
|
|
</ul>
|
|
<ul>
|
|
<li>--hello-string <base64> - Custom hello string</li>
|
|
</ul>
|
|
<ul>
|
|
<li>--source-port 61000 - Set source port</li>
|
|
</ul>
|
|
<hr>
|
|
<h2>Network Options</h2>
|
|
<ul>
|
|
<li>-e eth0 - Specify interface</li>
|
|
</ul>
|
|
<ul>
|
|
<li>--adapter-ip 192.168.1.100 - Source IP</li>
|
|
</ul>
|
|
<ul>
|
|
<li>--adapter-mac 00:11:22:33:44:55 - Source MAC</li>
|
|
</ul>
|
|
<ul>
|
|
<li>--router-mac 00:11:22:33:44:55 - Gateway MAC</li>
|
|
</ul>
|
|
<ul>
|
|
<li>--ttl 64 - Set TTL value</li>
|
|
</ul>
|
|
<hr>
|
|
<h2>Timing Options</h2>
|
|
<ul>
|
|
<li>--wait 10 - Seconds to wait for replies (default 10)</li>
|
|
</ul>
|
|
<ul>
|
|
<li>--retries 2 - Number of retries</li>
|
|
</ul>
|
|
<ul>
|
|
<li>--seed <number> - Random seed for reproducibility</li>
|
|
</ul>
|
|
<hr>
|
|
<h2>Resume and Config</h2>
|
|
<ul>
|
|
<li>--resume paused.conf - Resume interrupted scan</li>
|
|
</ul>
|
|
<ul>
|
|
<li>-c config.conf - Use config file</li>
|
|
</ul>
|
|
<ul>
|
|
<li>--echo > config.conf - Save current settings to config</li>
|
|
</ul>
|
|
<hr>
|
|
<h2>Common Examples</h2>
|
|
<h3>Quick Web Scan</h3>
|
|
<pre><code>masscan 192.168.1.0/24 -p80,443,8080 --rate 1000</code></pre>
|
|
<p>Scan for web servers on local network.</p>
|
|
<h3>Full Port Scan</h3>
|
|
<pre><code>masscan 192.168.1.0/24 -p1-65535 --rate 10000 -oL results.txt</code></pre>
|
|
<p>All ports on network, save to file.</p>
|
|
<h3>Banner Grabbing</h3>
|
|
<pre><code>masscan 192.168.1.0/24 -p22,80,443 --banners --rate 1000</code></pre>
|
|
<p>Grab banners from common services.</p>
|
|
<h3>Fast Class B Scan</h3>
|
|
<pre><code>masscan 10.0.0.0/16 -p80 --rate 100000 -oJ output.json</code></pre>
|
|
<p>High-speed scan of large network.</p>
|
|
<h3>UDP Scan</h3>
|
|
<pre><code>masscan 192.168.1.0/24 -pU:53,161,500 --rate 1000</code></pre>
|
|
<p>Scan common UDP ports.</p>
|
|
<h3>With Exclusions</h3>
|
|
<pre><code>masscan 10.0.0.0/8 -p80 --excludefile exclude.txt --rate 50000</code></pre>
|
|
<p>Scan large range with exclusions.</p>
|
|
<hr>
|
|
<h2>Performance Tuning</h2>
|
|
<h3>For High-Speed Scanning</h3>
|
|
<pre><code># Increase system limits
|
|
echo 1 > /proc/sys/net/core/somaxconn
|
|
sysctl -w net.core.rmem_max=16777216
|
|
sysctl -w net.core.wmem_max=16777216
|
|
|
|
# Use PF_RING for 10M+ packets/sec
|
|
masscan --adapter-ip 192.168.1.100 --rate 1000000</code></pre>
|
|
<hr>
|
|
<h2>Output Parsing</h2>
|
|
<h3>List Format</h3>
|
|
<pre><code># Format: status state port proto ip timestamp
|
|
open tcp 80 192.168.1.1 1234567890</code></pre>
|
|
<h3>Extract IPs from List</h3>
|
|
<pre><code>cat output.txt | grep open | awk '{print $4}'</code></pre>
|
|
<hr>
|
|
<h2>Tips</h2>
|
|
<ul>
|
|
<li>Start with low rates (1000) and increase gradually</li>
|
|
</ul>
|
|
<ul>
|
|
<li>Use --wait to ensure you catch slow responses</li>
|
|
</ul>
|
|
<ul>
|
|
<li>Always exclude sensitive/critical systems</li>
|
|
</ul>
|
|
<ul>
|
|
<li>Use --resume for long scans that might interrupt</li>
|
|
</ul>
|
|
<ul>
|
|
<li>Combine with nmap for detailed service detection</li>
|
|
</ul>
|
|
<ul>
|
|
<li>masscan finds ports fast, nmap enumerates them</li>
|
|
</ul>
|
|
<ul>
|
|
<li>May need root/sudo for raw socket access</li>
|
|
</ul>
|
|
<ul>
|
|
<li>High rates can overwhelm networks - be careful</li>
|
|
</ul>
|
|
<ul>
|
|
<li>Always get authorization before scanning</li>
|
|
</ul>
|
|
<hr>
|
|
<p><a href="index.html">← Back to cheatsheets</a></p>
|
|
<p><a href="../index.html">← Home</a></p>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
<script async type="text/javascript" src="../blog/analytics.js"></script>
|
|
<script src="../theme.js"></script>
|
|
</body>
|
|
</html>
|