Connect with us


Masscan: A Mass IP Port Open-source Scanner



Masscan:AMassIPPortOpen sourceScanner
Masscan: A Mass IP Port Open-source Scanner

About Masscan
   Masscan is an Internet-scale port scanner. It can scan the entire Internet in under 6 minutes, transmitting 10 million packets per second, from a single machine.

   It’s input/output is similar to nmap, the most famous port scanner. When in doubt, try one of those features.

   Internally, Masscan uses asynchronous tranmissions, similar to port scanners like scanrand, unicornscan, and ZenMap. It’s more flexible, allowing arbitrary port and address ranges.

   NOTE: Masscan uses a its own custom TCP/IP stack. Anything other than simple port scans may cause conflict with the local TCP/IP stack. This means you need to either the –src-ip option to run from a different IP address, or use –src-port to configure which source ports masscan uses, then also configure the internal firewall (like pf or iptables) to firewall those ports from the rest of the operating system.

   Massan is free, but consider contributing money to its developement: Bitcoin wallet address: 1MASSCANaHUiyTtR3bJ2sLGuMw5kDBaj4T

Masscan demo

Masscan Installation 
Using Masscan
   Usage is similar to nmap. To scan a network segment for some ports: masscan -p80,8000-8100

   That command will:
    * Scan the 10.x.x.x subnet, all 16 million addresses
    * Scans port 80 and the range 8000 to 8100, or 102 addresses total.
    * Print output to <stdout> that can be redirected to a file

   To see the complete list of options, use the –echo feature. This dumps the current configuration and exits. This output can be used as input back into the program:
masscan -p80,8000-8100 –echo > xxx.conf
masscan -c xxx.conf –rate 1000

Getting output on Masscan
   By default, Masscan produces fairly large text files, but it’s easy to convert them into any other format. There are five supported output formats:
    * xml: Just use the parameter -oX <filename>. Or, use the parameters –output-format xml and –output-filename <filename>.
    * binary: This is the Masscan builtin format. It produces much smaller files, so that when I scan the Internet my disk doesn’t fill up. They need to be parsed, though. The command line option –readscan will read binary scan files. Using –readscan with the -oX option will produce a XML version of the results file.
    * grepable: This is an implementation of the Nmap -oG output that can be easily parsed by command-line tools. Just use the parameter -oG <filename>. Or, use the parameters –output-format grepable and –output-filename <filename>.
    * json: This saves the results in JSON format. Just use the parameter -oJ <filename>. Or, use the parameters –output-format json and –output-filename <filename>.
    * list: This is a simple list with one host and port pair per line. Just use the parameter -oL <filename>. Or, use the parameters –output-format list and –output-filename <filename>. The format is:

<port state> <protocol> <port number> <IP address> <POSIX timestamp>  
open tcp 80 XXX.XXX.XXX.XXX 1390380064

Performance testing on Masscan
   To test performance, run something like the following:
masscan -p80 –rate 100000000 –router-mac 66-55-44-33-22-11

   The bogus –router-mac keeps packets on the local network segments so that they won’t go out to the Internet.

    You can also test in “offline” mode, which is how fast the program runs without the transmit overhead:
masscan -p80 –rate 100000000 –offline

   This second benchmark shows roughly how fast the program would run if it were using PF_RING, which has near zero overhead.

Banner checking on Masscan
   Masscan can do more than just detect whether ports are open. It can also complete the TCP connection and interaction with the application at that port in order to grab simple “banner” information.

   The problem with this is that Masscan contains its own TCP/IP stack separate from the system you run it on. When the local system receives a SYN-ACK from the probed target, it responds with a RST packet that kills the connection before masscan can grab the banner.

   The easiest way to prevent this is to assign Masscan a separate IP address. This would look like the following:
masscan -p80 –banners –source-ip

   The address you choose has to be on the local subnet and not otherwise be used by another system.

   In some cases, such as WiFi, this isn’t possible. In those cases, you can firewall the port that Masscan uses. This prevents the local TCP/IP stack from seeing the packet, but masscan still sees it since it bypasses the local stack. For Linux, this would look like:
iptables -A INPUT -p tcp –dport 61000 -j DROP
masscan -p80 –banners –source-port 61000

   You probably want to pick ports that don’t conflict with ports Linux might otherwise choose for source-ports. You can see the range Linux uses, and reconfigure that range, by looking in the file:

   On the latest version of Kali Linux (2018-August), that range is 32768 to 60999, so you should choose ports either below 32768 or 61000 and above.

   Setting an iptables rule only lasts until the next reboot. You need to lookup how to save the configuration depending upon your distro, such as using iptables-save or iptables-persistant.

   On Mac OS X and BSD, there are similar steps. To find out the ranges to avoid, use a command like the following:
sysctl net.inet.ip.portrange.first net.inet.ip.portrange.last

   On FreeBSD and older MacOS, use an ipfw command:
sudo ipfw add 1 deny tcp from any to any 40000 in
masscan -p80 –banners –source-port 40000

   On newer MacOS and OpenBSD, use the pf (packet-filter) utility. Edit the file /etc/pf.conf to add a line like the following:
block in proto tcp from any to any port 40000

   Then to enable the firewall, run the command: pfctrl -E

   If the firewall is already running, then either reboot or reload the rules with the following command: pfctl -f /etc/pf.conf

   Windows doesn’t respond with RST packets, so neither of these techniques are necessary. However, masscan is still designed to work best using its own IP address, so you should run that way when possible, even when its not strictly necessary.

   The same thing is needed for other checks, such as the –heartbleed check, which is just a form of banner checking.

Code Layout on Masscan
   The file main.c contains the main() function, as you’d expect. It also contains the transmit_thread() and receive_thread() functions. These functions have been deliberately flattened and heavily commented so that you can read the design of the program simply by stepping line-by-line through each of these.

   This is an asynchronous design. In other words, it is to nmap what the nginx web-server is to Apache. It has separate transmit and receive threads that are largely independent from each other. It’s the same sort of design found in scanrand, unicornscan, and ZMap.

   Because it’s asynchronous, it runs as fast as the underlying packet transmit allows.

   The code runs well on Linux, Windows, and Mac OS X. All the important bits are in standard C (C90). It therefore compiles on Visual Studio with Microsoft’s compiler, the Clang/LLVM compiler on Mac OS X, and GCC on Linux.

   Windows and Macs aren’t tuned for packet transmit, and get only about 300,000 packets-per-second, whereas Linux can do 1,500,000 packets/second. That’s probably faster than you want anyway.

Safe code on Masscan
   A bounty is offered for vulnerabilities, see the file for more information.

   This project uses safe functions like strcpy_s() instead of unsafe functions like strcpy().

This project has automated unit regression tests (make regress).

Compatibility: A lot of effort has gone into making the input/output look like nmap, which everyone who does port scans is (or should be) familiar with.

About the author of Masscan
   This tool created by Robert Graham:
   Email address:
   Twitter account: @ErrataRob

Continue Reading
Click to comment

Leave a Reply

Your email address will not be published.

This site uses Akismet to reduce spam. Learn how your comment data is processed.


Nitro Pro Enterprise Full Version



Nitro Pro Enterprise Full Version adalah salah satu aplikasi terbaik yang banyak digunakan untuk mengedit atau membuat file dalam format PDF. Dengan menggunakan aplikasi ini, Sobat dapat membuat, mengedit dan memodifikasi file PDF. Aplikasi Nitro Pro Enterprise Full dapat melakukan pengeditan file PDF dengan sangat cepat dan akurat. Sobat dapat menambahkan file PDF pada komentar yang ingin di edit. Sobat dapat mengubah semua jenis format populer menjadi bentuk PDF.
Program Nitro Pro Enterprise Full Version mendukung beragam format file seperti Word, Excel, PowerPoint, Photoshop, HTML, teks, BMP, TIFF, GIF, JPEG, JPEG2000, PNG, dll. Setelah diinstal aplikasi ini ke komputer atau laptop, itu akan secara otomatis muncul pada toolbar khusus perangkat lunak Nitro Pro yang akan memungkinkan untuk mengkonversi berbagai format file ke PDF atau hanya membuat file PDF.
Continue Reading


Gilisoft Screen Recorder Full Version



GiliSoft Screen Recorder adalah salah satu perekam layar PC yang banyak digunakan untuk keperluan vlog atau yang lain. Ini merupakan aplikasi perekam layar yang efektif namun mudah yang memungkinkan Sobat menangkap aktivitas desktop dan membuat tutorial video, demonstrasi, dan presentasi tanpa bakat pemrograman apa pun.

GiliSoft Screen Recorder mencakup semua kemampuan perekam layar tampilan versi trendi. Selanjutnya rekaman video tersebut Sobat dapat untuk membuat film yang diedit dengan sangat baik, memotong dan menjadi bagian dari klip video, amati konsekuensi dan filter video modis, unggah emblem, tune, judul dan banyak lagi!
Gilisoft Screen Recorder
Demikian ulasan mengenai Gilisoft Screen Recorder, mudah-mudahan bermanfaat bagi Sobat semua. Selamat mencoba.
Continue Reading


Time Stopper 3.5 – Remove Time Limit From Trial Software



Time Stopper adalah aplikasi yang menghilangkan batas waktu atau memundurkan waktu yang ada dalam periode penggunaan software trial.
Time Stopper berfungsi dengan file yang dapat dieksekusi perangkat lunak apa pun dan secara praktis akan memperpanjang periode uji coba program untuk waktu yang tidak terbatas.
Time Stopper sangat mudah dipasang dan digunakan: Sobat hanya perlu menelusuri file program uji coba yang dapat dieksekusi (terletak di C: File Program) dan pilih tanggal pemasangan baru.
Cara penggunaan Time Stopper:
  1. Download dan pasang Time Stopper
  2. Buka aplikasi, pilih Browse untuk memilih software yang akan dimundurkan masa trialnya
  3. Di Program file, pilih folder tempat software tersebut yang berakhiran .exe
  4. Buat nama program pintasan, usahakan neda dengan shorcut bawaan
  5. Klik tombol pembuatan shorcut
  6. Hapus shorcut bawaan di dekstop
  7. Selesai

Sekarang, periode uji coba program akan diperpanjang secara otomatis hingga 30/90 hari lagi, tergantung pada perangkat lunaknya.
TimeStopper tidak akan mengubah waktu dan tanggal sistem operasi, oleh karena itu aman digunakan.
Demikian ulasan mengenai Time Stopper, mudah-mudahan bermanfaat bagi Sobat semua. Selamat mencoba.
Continue Reading