Masscan

Masscan

Purpose

Use this skill only when a very large approved address space requires a fast first-pass port inventory.

Phase Fit

• Primary: Discovery and Reconnaissance
• Secondary: Threat Modeling and Test Planning

Use When

• Need a quick initial view of exposed ports across a large target range.
• Need to narrow candidates before deeper nmap validation.
• Need to work within a limited discovery window.

Avoid When

• The environment is fragile or rate-sensitive.
• Scope, rate limits, or outage ownership are unclear.

Inputs

• Approved CIDR or target list
• Narrow port set and explicit rate ceiling
• Exclusions and fragile segments

Procedure

1. Start with the lowest rate that still fits the window.
2. Limit the port set to the current hypothesis.
3. Treat results as discovery candidates, not final findings.
4. Hand interesting results to nmap for confirmation.
5. Document the exact rate and port set used.

Command Syntax

Replace sample targets with approved in-scope assets and conservative rates.

# Scan common ports on a subnet
masscan -p 80,443,22,8080,8443 10.10.10.0/24 --rate=1000 -oG contoso-masscan.gnmap

# Full port range on a single host
masscan -p 0-65535 10.10.10.100 --rate=5000 -oJ contoso-masscan.json

# Scan from a target list with exclusions
masscan -iL targets.txt -p 22,3389 --excludefile exclude.txt --rate=500 -oL contoso-masscan.txt

# Conservative rate for fragile environments
masscan -p 22,80,443,3389 10.10.10.0/24 --rate=100 -oG contoso-masscan.gnmap

# HTTP banner grabbing
masscan -p 80,443 10.10.10.0/24 --rate=1000 --banners -oJ contoso-http.json

Evidence to Capture

• First-pass exposed port inventory
• Candidate hosts selected for deeper validation
• Scan rate, time window, and target boundaries

Safety Boundaries

• Use only with explicit approval for the chosen rate.
• Stop immediately if the environment shows instability or packet loss symptoms.