Information Gathering

masscan

masscan does one thing and does it faster than anything else: it sends TCP SYN packets asynchronously, so it can sweep enormous address ranges — up to the whole internet, in principle — in the time nmap would spend on a single subnet. It doesn’t do service detection or scripting; the workflow is to let masscan find the open ports across a huge space, then hand the hits to nmap for the careful look.

It’s an official-repo package and lives at Security → Information Gathering → masscan. It needs raw-socket privileges, so real scans run under sudo.

The help it prints

MASSCAN is a fast port scanner. The primary input parameters are the
IP addresses/ranges you want to scan, and the port numbers. An example
is the following, which scans the 10.x.x.x network for web servers:
 masscan 10.0.0.0/8 -p80
The program auto-detects network interface/adapter settings. If this
fails, you'll have to set these manually. The following is an
example of all the parameters that are needed:
 --adapter-ip 192.168.10.123
 --adapter-mac 00-11-22-33-44-55
 --router-mac 66-55-44-33-22-11
Parameters can be set either via the command-line or config-file. The
names are the same for both. Thus, the above adapter settings would
appear as follows in a configuration file:
 adapter-ip = 192.168.10.123
 adapter-mac = 00-11-22-33-44-55
 router-mac = 66-55-44-33-22-11
All single-dash parameters have a spelled out double-dash equivalent,
so '-p80' is the same as '--ports 80' (or 'ports = 80' in config file).
To use the config file, type:
 masscan -c <filename>
To generate a config-file from the current settings, use the --echo
option. This stops the program from actually running, and just echoes
the current configuration instead. This is a useful way to generate
your first config file, or see a list of parameters you didn't know
about. I suggest you try it now:
 masscan -p1234 --echo

Examples

# Scan a /8 for web servers
sudo masscan 10.0.0.0/8 -p80

# Several ports across a range, capped at a polite rate
sudo masscan 10.0.0.0/16 -p22,80,443,3389 --rate 1000

# Whole port range on one host, output to a file for nmap to chew on
sudo masscan 10.0.0.5 -p1-65535 --rate 10000 -oL masscan.txt

# Feed the found ports into nmap for versions and scripts
sudo nmap -sV -p $(grep open masscan.txt | awk '{print $3}' | paste -sd,) 10.0.0.5

Turn --rate down on networks you don’t own — the default is aggressive, and a high rate is exactly what an IDS is watching for.