# Masscan

> Use for high-speed network exposure discovery during authorized pentests. Trigger on very large approved address spaces, strict discovery windows, and cases where a fast first-pass port inventory is needed before deeper validation.

- Skill: `timsonner/masscan` (Agent Skill)
- Install (CLI): `npx skillmds@latest add timsonner/masscan`
- Raw SKILL.md: https://api.skillmd.com/api/skills/timsonner/masscan/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Product & Planning
- License: MIT
- Author: timsonner (https://skillmd.com/u/timsonner)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/timsonner/masscan

---


# Masscan

## Purpose

Use this skill only when a very large approved address space requires a fast first-pass port inventory.

## Phase Fit

- Primary: Discovery and Reconnaissance
- Secondary: Threat Modeling and Test Planning

## Use When

- Need a quick initial view of exposed ports across a large target range.
- Need to narrow candidates before deeper `nmap` validation.
- Need to work within a limited discovery window.

## Avoid When

- The environment is fragile or rate-sensitive.
- Scope, rate limits, or outage ownership are unclear.

## Inputs

- Approved CIDR or target list
- Narrow port set and explicit rate ceiling
- Exclusions and fragile segments

## Procedure

1. Start with the lowest rate that still fits the window.
2. Limit the port set to the current hypothesis.
3. Treat results as discovery candidates, not final findings.
4. Hand interesting results to `nmap` for confirmation.
5. Document the exact rate and port set used.

## Command Syntax

Replace sample targets with approved in-scope assets and conservative rates.

```bash
# Scan common ports on a subnet
masscan -p 80,443,22,8080,8443 10.10.10.0/24 --rate=1000 -oG contoso-masscan.gnmap

# Full port range on a single host
masscan -p 0-65535 10.10.10.100 --rate=5000 -oJ contoso-masscan.json

# Scan from a target list with exclusions
masscan -iL targets.txt -p 22,3389 --excludefile exclude.txt --rate=500 -oL contoso-masscan.txt

# Conservative rate for fragile environments
masscan -p 22,80,443,3389 10.10.10.0/24 --rate=100 -oG contoso-masscan.gnmap

# HTTP banner grabbing
masscan -p 80,443 10.10.10.0/24 --rate=1000 --banners -oJ contoso-http.json
```

## Evidence to Capture

- First-pass exposed port inventory
- Candidate hosts selected for deeper validation
- Scan rate, time window, and target boundaries

## Safety Boundaries

- Use only with explicit approval for the chosen rate.
- Stop immediately if the environment shows instability or packet loss symptoms.