10 ms·
MASSCAN: Mass IP port scanner
- rocgf 10y agoDon't get me wrong, I think this is some great coding, but I'm just wondering... what might be a legal/ethical use this? I'm thinking that most companies own at most a couple thousand machines, so something more traditional like nmap might do just fine.
- zorked 10y agoThere's nothing unethical in port scanning.
- Intermernet 10y agoI agree with you, although many years ago I got an official warning from the head of IT security at the university I was attending (and working at the computer labs) for allowing a friend of mine to run a port scanning script across a large portion of the allocated IPv4 address space. Apparently they'd had complaints... They saw the ethics of port scanning as a grey area, tending towards black.
- eumoria 10y agoI don't really see that. An open port is a door on your house. I'm free to walk down the street and look at your door as I please. I may also knock on it as long as I'm not banging on it for 10 minutes or something. However if I then try to pick the lock and enter your house, well then... EDIT: It's not a perfect analogy but if you have a system that can be publicly accessed, just seeing that it's publicly available isn't a grey area to me that's all.
- modoc 10y agoTo be fair, if you come to my house, and turn my door knob to see if it's open or locked, and then start checking all my windows to see if they open or are locked, then we're going to have trouble...
- eumoria 10y agoCan I drive my car through the side? What would be the digital version of that?
- res0nat0r 10y agoYou will get in trouble for port scanning without permissions so I would be careful. For example on AWS you can do so but need permission first. https://aws.amazon.com/security/penetration-testing/ https://aws.amazon.com/security/penetration-testing/
- teddyh 10y agoThe ports = doors analogy fails: For doors you are supposed to enter, like shops, there are signs to let you know that it’s OK to enter them. There are no such things for ports. There were, once upon a time, such a thing; an enumerated list, in a DNS “WKS” record, of ports you were expected to use. As part of the deprecation of the WKS record, RFC 1123 states “To confirm that a service is present, simply attempt to use it.”.
- cmdrfred 10y ago“To confirm that a service is present, simply attempt to use it.” Isn't the inverse of that true as well? If you don't want someone using a port, close it.
- teddyh 10y agoIf you by “close it” mean “don’t have something listening on it”, then yes.
- cmdrfred 10y agoI feel close is a better word. Not only is it far more concise. The port still may have a listener that can be accessed over a VPN or internal network you might just prevent access at the edge firewall for example.
- Intermernet 10y agoI think (hope) attitudes are changing on this. 15 to 20 years ago it was assumed in management circles that scanning for open ports was nefarious. These were the people who believed in security by obscurity. These days I hope people realize that the equivalent of "lock the front door, but leave the back door open" isn't viable. Also, the door analogy is (as other commenters have pointed out) flawed. Should an open port be translated as a door you can knock at or ring the bell, a door you can open, or just a door you can see. I personally agree that "An open port is a door on your house" but others see it as one you've just knocked on, and others see it as one you've willfully tried to break into. The informedness of the port owner will define how they interpret the port scan.
- d0ugie 10y agoWhy the need every time this comes up to compare it to looking at doors from the sidewalk while walking our dogs? We're geeks, we understand what portscanning is well enough to form our own conclusions as to whether it is more right than wrong. Conversely, we don't need a pedestrian ethicist to conceptualize looking at doors by asking us to think about walking around and observing houses innocently as being somehow congruent to portscanning. Analogies offer similarities, not equations.
- dcuthbertson 10y agoHow about an art gallery analogy? Consider the internet a giant art gallery, where open ports are doorways that one may walk through. Closed ports are closed doors, perhaps only open to certain patrons. Still others are closed to everyone.
- cmdrfred 10y agoIf knowing that a certain port is open at a certian ip address compromises your security, you have already lost in my opinion. Anything that deofuscates secuity though obscurity is a good thing.
- stevekemp 10y agoAgreed. The last time I was involved in anything like this I used zmap to scan for open rsync shares. Without wanting to be click-baity the results shocked me! https://blog.steve.fi/Secure_your_rsync_shares__please_.html https://blog.steve.fi/Secure_your_rsync_shares__please_.html
- zimbatm 10y agoVulnerable devices are vulnerable. It doesn't matter if this tool exists they are eventually going to found out. Just look at shodan.io to get an idea. What this does is allow security researchers to better assess the vulnerability of the Internet as a whole. We need a better understanding of what's going on. You could be a white knight and patch vulnerable devices using that very same security hole. In fact I would really enjoy having our governments offering this as a service instead of spending so much energy on attacking the others (or at least notify the owner).
- libeclipse 10y agoWhy is this just making its way to HN front page right now?
- el_duderino 10y agohttps://news.ycombinator.com/item?id=8803498 https://news.ycombinator.com/item?id=8803498 https://news.ycombinator.com/item?id=6391266 https://news.ycombinator.com/item?id=6391266
- jaytaylor 10y agoIt's probably been submitted again now on the heels of DefCon and Blackhat, where Robert Graham usually gives cool talks and presentations about his security research and work, e.g. MASSCAN.
- ntumlin 10y agoThat might explain the popularity of it, but I actually found it from poking around on jvns.ca from the recent post about how gdb works.
- dannypgh 10y agoEntire IPv4 Internet, I think they mean.
- coldcode 10y agoIs it even possible to scan IPv6 internet? Or simply too many IPs (theoretically) to try?
- chatmasta 10y agoSince IPv6 addresses are allocated in large blocks, and organizations tend to assign IP addresses sequentially, you could probably scan a decent portion of the IPv6 space by doing a binary search on the addresses within each block of a certain size to identify the max active address in each block.
- cmdrfred 10y agoOn its face I believe not but, now I'm not positive on the specifics but I believe there are ip4 to ip6 bridges that index ip6 addresses and allow you to only scan active addresses.
- dannypgh 10y agoNo. There are 2^128 or so possible IP addresses. Such an index wouldn't fit anywhere. I think you're thinking of 6to4, which maps a /64 onto every v4 address. But allocation within the /64 may still be super sparse...
- ranger207 10y agoAlthough I think it's practically infeasible to scan the entire IPv6 range, it is possible to see who's on v6 through other methods, like when Shodan added a bunch of its servers to the NTP pool to find v6 users. http://arstechnica.com/security/2016/02/using-ipv6-with-linux-youve-likely-been-visited-by-shodan-and-other-scanners/ http://arstechnica.com/security/2016/02/using-ipv6-with-linu...
- CSDude 10y agoIt is great. My mobile career exposed a huge /8 network and we could even scan it to find some lonely IoT devices with default root passwords with masscan in minutes.
- erelde 10y agoI love the pull requests and the messages in data/exclude.conf
- voltagex_ 10y agoYep, worth a read, especially if you're considering doing this kind of scan for yourself. https://github.com/robertdavidgraham/masscan/blob/master/data/exclude.conf#L41 https://github.com/robertdavidgraham/masscan/blob/master/dat...
- Kephael 10y agoI don't understand why anyone bothers to send abuse emails for port scans. Just block the scanning source and move on, they are far too frequent to be concerned about.
- deleted 10y ago[deleted]
- RIMR 10y agoBeen using this software as well as Zmap for Internet-wide scans for the past three years. This kind of software is scary powerful.
- billmalarky 10y agoWhat do you use it for? Academic research?