Port Scanning

Masscan is known for its speed, making it possible to scan the entire Internet in minutes. It uses asynchronous transmission to achieve high speeds, making it ideal for large-scale scanning operations. You can find Masscan here.

masscan -p1-65535 10.1.1.1 --rate=1000                     #Scans all TCP ports on the target IP with a rate of 1000 packets per second.
masscan 10.1.1.1/24 -p80,443,22 --rate 5000                #Scans common ports on a subnet
masscan -iL targets.txt -p1-1000 --rate 10000              #Read target IPs from file
masscan 10.1.1.1/24 -p80 --source-ip 10.1.1.1              #Spoof source IP
masscan 10.1.1.1/24 -p80 --spoof-mac 00:11:22:33:44:55     #Spoof MAC address

Here is a list of common commands I use with Masscan and the most common ports I’ve seen on engagements.

sudo masscan -p 21,22,23,53,80,111,135,445,139,443,389,1521,3306,8080,8081,1433,8200,8500,8999,9000,10000,8443 10.1.1.0/24 --rate 1500
sudo masscan 10.1.1.0/22 -p 1-65535 --banners --rate 1000
sudo masscan -iL External_IPs.txt -p 1-65535 --rate 500 --http-user-agent "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:67.0) Gecko/20100101 Firefox/67.0"

You can use the following script to take in Masscan results and produce an output which can be fed into Nmap:

# This script will take in Masscan results and produce an output which can be fed into NMap
# Save your Masscan result as mscan.txt then run this script to produce nmap.txt then you can run:
# while read item; do sudo nmap -sV -sA -sU $item; done < nmap.txt

# If you want to export to .xml file you can use the following command and then later use this script to merge files: https://github.com/sidaf/scripts/blob/master/nmap_merge.py
# while read item; do filename=$(echo $item | grep -o "^\S*"); sudo nmap -sV -sA -sU -vv $item -oX $filename.xml; done < nmap.txt

import re
import socket

regex = re.compile(r"Discovered open port (\d+)\/(udp|tcp) on (\d+\.\d+\.\d+\.\d+)", re.I)

ip_list = {}

with open('mscan.txt') as f:
    lines = f.readlines()
    for line in lines:
        port = regex.match(line).group(1)
        protocol = regex.match(line).group(2)
        ip = regex.match(line).group(3)

        # Add the IP to dictionary if it's not already
        try:
            ip_list[ip]
        except KeyError:
            ip_list[ip] = {}

        # Add protocol to dictionary if it's not already
        try:
            ip_list[ip][protocol]
        except KeyError:
            ip_list[ip][protocol] = []

        # Append the port to the list
        ip_list[ip][protocol].append(port)

with open('nmap.txt', 'a') as f:
    sorted_ips = sorted(ip_list.items(), key=lambda item: socket.inet_aton(item[0]))
    for ip,protocols in sorted_ips:
        udp_ports = ""
        tcp_ports = ""

        # Check to see if any UDP ports were found
        try:
            for port in protocols['udp']:
                udp_ports += port + ','
        except KeyError:
            pass
        
        # Check to see if any TCP ports were found
        try:
            for port in protocols['tcp']:
                tcp_ports += port + ','
        except KeyError:
            pass

        # Print IP and ports to file ready for NMap scan
        if udp_ports and tcp_ports:
            line = ip + ' -p U:' + udp_ports + 'T:' + tcp_ports
        elif udp_ports:
            line = ip + ' -p U:' + udp_ports
        elif tcp_ports:
            line = ip + ' -p T:' + tcp_ports
        f.write(line + '\n')

Save your Masscan result as mscan.txt, and then run this script to produce nmap.txt. Then you can run:

while read item; do filename=$(echo $item | grep -o "^\S*"); sudo nmap -sCV -T4 -O --version-light -vv $item -oX $filename.xml; done < ../nmap.txt
while read item; do filename=$(echo $item | grep -o "^\S*"); sudo nmap -sCV -T4 -O -F --version-light -vv $item -oX $filename.xml; done < nmap.txt

Scanning the whole internet

You can scan the whole internet for port 80 for example using the following:

sudo masscan -p 80  0.0.0.0/0 --rate 1000000 --exclude 255.255.255.255 > port80.txt

Once you have a list of IP addresses with port 80 open you can run it through a tool like HTTPX to get the title of the web page running on the port.

httpx -l port80.txt -ports 80 -title -no-color  > port80_titles.txt 
httpx -list Web_Ports.txt -p 80,443 -silent -sc -location -title -server -mc 200 -fr