14 ms·
Masscan: TCP port scanner, scanning entire Internet in under 5 minutes
- marcodiego 5y agoMakes me wonder if there are still some netbus servers alive.
- danilonc 5y agoOld discussing about the tool: https://news.ycombinator.com/item?id=8803498 https://news.ycombinator.com/item?id=8803498
- dang 5y agoThanks! Expanded: Some idiot is using your tool to mass scan our network - https://news.ycombinator.com/item?id=24728123 https://news.ycombinator.com/item?id=24728123 - Oct 2020 (182 comments) MASSCAN: Mass IP port scanner - https://news.ycombinator.com/item?id=12260809 https://news.ycombinator.com/item?id=12260809 - Aug 2016 (33 comments) Masscan: Scan the entire Internet in under 5 minutes - https://news.ycombinator.com/item?id=8803498 https://news.ycombinator.com/item?id=8803498 - Dec 2014 (29 comments) Masscan: scan the entire Internet in under 6 minutes, 10 million packets/second - https://news.ycombinator.com/item?id=6391266 https://news.ycombinator.com/item?id=6391266 - Sept 2013 (30 comments) Masscan: The entire internet in 3 minutes - https://news.ycombinator.com/item?id=6388222 https://news.ycombinator.com/item?id=6388222 - Sept 2013 (12 comments)
- 1-6 5y agoSeems like ports can use a bit of updating. Can't an encoded message be sent to a port before it opens up and exchanges its presence?
- EamonnMR 5y agohttps://en.m.wikipedia.org/wiki/Port_knocking https://en.m.wikipedia.org/wiki/Port_knocking
- mcpherrinm 5y agoThe Wireguard VPN protocol doesn’t reply to any packets that aren’t cryptographically authenticated, so that’s a good option if you want something “unscannable” on the internet. For a regular, publicly accessible server, you do want people to be able to connect to it, so it must be scannable. I don’t know offhand, but with HTTP/3’s udp based protocol, it ought to be possible to at least make scanning a bit trickier. By requiring a valid QUIC client hello packet, with a valid SNI header for that server, the scanner must know the name of the server it’s trying to talk to. I don’t have any experience with HTTP/3 yet so I am probably wrong.
- unixhero 5y agoWarning. Masscan is the best scanner I have ever seen. We have also managed to take down the entire corporate network by using it with a too high rate limit. So tread lightly around massscan and its power. Our pentesters did the same 6 months later. The managed service provider is not able to solve the routing table loop which causes the firewall to DOS when a rapid masscan is triggered.
- sneak 5y agoFWIW I think the late Dan Kaminsky is the person who originally invented this two process userspace TCP scan technique 2001-2002ish in his tool Paketto Keiretsu. It's a good one. I sometimes wonder if it inspired some of the TCP-in-userspace stuff that is done in go (gvisor lib, I think it was). I'm glad Rob is continuing the development of this idea and continues to scan the whole internet. Scanning the whole internet is cool. It's a shame it's de facto illegal these days (and will get most internet connections in the USA terminated near-instantly).
- tptacek 5y agoDecoupled sender/receiver scanners date back to the 1990s (we did one in CASL, our misbegotten packet programming language from 1997, the script for which I think shipped with Ballista --- and we stole the scanner design from someone else, probably from CORE SDI), as do userland TCP libraries (LWIP is a famous one, or at least a library that got used for that purpose, that predates all this stuff).
- OrvalWintermute 5y agoThe other userland discreteTCP/IP stack mass-scanner of note is Unicornscan [1] from Jack C Louis (RIP) [1] https://defcon.org/images/defcon-13/dc13-presentations/DC_13-Lee.pdf https://defcon.org/images/defcon-13/dc13-presentations/DC_13... I know this came a few years later, but it really advanced the state of the art for widescale scanning at that time, particularly once it made its way into Kali.
- tptacek 5y agoFor a long time, unicornscan was the preferred scanner for pentests (nmap is venerable and impressive but it has a lot of weird failure modes on real networks). I had no idea the author had died.
- samstave 5y ago>the late Dan Kaminsky Ehhh... I forgot he was the "the late Dan Kaminsky" :-(
- trutannus 5y agoFunny this would show up here. I keep seeing this on a bot profiling project of mine. Infrequent requests, but persistent.
- ABraidotti 5y agoI enjoy Rob Graham on Twitter too: https://twitter.com/ErrataRob https://twitter.com/ErrataRob He often discusses current events in infosec if you're into that.
- amatecha 5y agoYeah, I appreciate his willingness to share "inconvenient truths" that may run counter to the running narrative of whatever tech/security story of the moment. Lots of interesting perspectives, even if maybe I didn't "want" to hear it ;)
- chaz6 5y agoI am not sure any computer is capable of sending and processing 2^126 packets (assuming global unicast, 1 packet out, 1 packet in) in under 5 minutes.
- jerf 5y agoWell, 5 minutes is about 2^8 seconds, you can get about 2^32 cycles per core per second nowadays, and you can have about 2^6 cores maximum, so with an incredibly, unspeakably generous "scan one IP in one cycle" a 64-core computer should be able to scan about 2^(8+32+6) = 2^46 addresses in a little under five minutes. We seem to be a wee bit short of 2^126, yes.
- gitfan86 5y agoLarge blocks of IPs are not part of the internet. 10. 172. Etc...
- signa11 5y agoall non-routeable addresses, multicast etc. etc.
- deleted 5y ago[deleted]
- jerf 5y agoThe IPv4 internet is merely 2^32, and people have been scanning that whole thing for years now. The /112 is referring to IPv6 addresses. Plus the copy about not hammering other networks won't matter when you're trying to scan entire /64s that are behind one home router or something. That's gonna get noticed. You can't really scan IPv6 like you can scan IPv4, the math I gave is part of why. The code to do it is trivial, but the hardware just isn't there.
- londons_explore 5y agoI'm really surprised shady figures aren't publishing lists of active IPv6 addresses to allow scanning. For example, someone with access to a backbone internet router could easily log src and destination ipv6 addresses, and sell the complete list sorted and compressed. Malware authors could then use the list to portscan for badly firewalled stuff.
- johnnyApplePRNG 5y agoWas curious the other day and couldn't find a real answer... does AWS allow portscanning from their infrastructure? All I could find was statements from them that they do not allow port scanning OF their infrastructure.
- Cantinflas 5y agoThey don't, I got a company acc banned scanning my own local infra from an aws instance
- deleted 5y ago[deleted]
- bowmessage 5y agooof, how was that ultimately resolved? Hopefully a warning from support and a re-enabled account?
- Cantinflas 5y agoNope! Afaik they did not get the account re-enabled, at least for the next few months!
- slenk 5y agoYou used to be able to let them know you were going to do certain kinds of pen-tests, unless port scanning is just one of those things never allowed
- nkellenicki 5y agoYou still can, but that's for pentests _targetting_ AWS hosted infrastructure. They've always frowned upon using AWS to target _other_ services, however.
- samstave 5y agoSort-of. You can port scan your own infra/vpcs etc -- but YOU MUST tell them you are doing so and why you are doing it, else they will block it. again, as with anything AWS (and other providers) have a good rapport with your rep, and SEs in AWS and you have a lot more freedom than you expect just from boilerplate ULA TOS stuff. You may not scan anything other than your own infra. And you can get your external monitors whitelisted as well... Just talk to your rep.
- londons_explore 5y agoImpressive that the bitcoin donation address has received $20k!
- dmos62 5y agoI like that you checked it!
- londons_explore 5y agoI'm always interested how much revenue peoples hobby projects earn. The vast majority of projects seem to take someone months of work, get 50 github stars, and $25 worth of donations... Which is really sad - it basically means the vast majority of opensource authors have to have another job to pay the bills.
- shadycuz 5y agoI just started to try and monetize. I'm a bit early, less than 50 stars. But my expectations are pretty much what you stated. Though my actual plan is to try and build a following like Jeff feeling and then sell training courses and ebooks.
- slim 5y agoThat adress could be used for different transactions unrelated to this project
- quickthrower2 5y agoAnd bitcoin has increased in value in the last 2 years
- sva_ 5y agoMost of it was sent when Bitcoin was worth a lot less.
- Aissen 5y agoAwesome tool. Rob added IPv6 support last year, which can be really useful if you know what you're doing (ex: want to scan a single subnet for given OUI without privacy extensions).
- dheera 5y ago> This increases the rate to 100,000 packets/second, which will scan the entire Internet (minus excludes) in about 10 hours per port (or 655,360 hours if scanning all ports). So 655360 hours, not 5 minutes
- deleted 5y ago[deleted]
- wfn 5y agoWell, keep reading the README, then :) see PF_RING: https://github.com/robertdavidgraham/masscan#pf_ring https://github.com/robertdavidgraham/masscan#pf_ring
- deleted 5y ago[deleted]
- deleted 5y ago[deleted]
- nunez 5y agoPerfect for finding publicly-accessible Kubernetes API servers.
- 1-6 5y agoI created a honeypot once and they started crypto mining on mine.
- wfn 5y agoA very nice and well-built tool. Excellent use of sequence numbers for stateless send/receive (SYN cookies): https://github.com/robertdavidgraham/masscan/blob/master/src/main.c#L526-L534 https://github.com/robertdavidgraham/masscan/blob/master/src... (very well-documented source too, a pleasure to read). I once (2016) used it to scan port 22 on the whole ipv4 (had to experiment with rate limits to not trigger alarms and get complaints forwarded by my VPS provider; the clever ip+port randomization technique helps a lot with that). Then took the ~22m (iirc) IPs which responded and ran ssh-keyscan on them to extract and analyze some ~15m ssh banners and public keys (a bunch of them broken, through debianized PRNG etc.) I think most of the scanning + extraction was done overnight, via ~13 VPS rented hourly (whole thing cost < $10, and very few complaints). Fun times :) I should write it up some time, and do it again.
- dosshell 5y agoWhat is "22m" ? 22 meter? 22 millies of something. I do not follow?
- howenterprisey 5y ago22 million.
- jihadjihad 5y agoIf masscan is of interest to you, be sure to check out zmap [0] as well. It can scan the entire IPv4 address space in around 45 minutes. 0: https://github.com/zmap/zmap https://github.com/zmap/zmap
- WelcomeShorty 5y agoI love zdns! Super fast and cool options. 0: https://github.com/zmap/zdns https://github.com/zmap/zdns
- lazyeye 5y agoIm sure the primary use for this tool will be ethical /s
- _wldu 5y agoI wrote netscan years ago and still use it. It's pretty fast too: https://github.com/62726164/netscan https://github.com/62726164/netscan
- LeonidBugaev 5y agoQuestion: how do you actually run it without getting banned? I've got banned pretty hard by both my local home ISP and using Linode servers, when tried such scanners. Mass port scanning is easy to track, and it usually forbidden all ISP ToC.
- prox 5y agoQuestion: why would you run this?
- itslennysfault 5y agoTo hack a gibson, baby.
- Godel_unicode 5y agoResearch. Ever wonder how many telnet servers are exposed to the internet (hint: way too many)?
- nebulous1 5y agoI did a CTF a while back and it was used to find the real IP of a missconfigured .onion site. I didn't actually do it as I was worried about burning a VPS provider.
- mike_d 5y agoA quick plug for my friends over at GreyNoise... they have honeypots all over the internet and identify various scanners as well as their observed intentions. Here is everyone running masscan against the internet: https://www.greynoise.io/viz/query/?gnql=tags%3A%22Masscan%20Client%22 https://www.greynoise.io/viz/query/?gnql=tags%3A%22Masscan%2...
- deleted 5y ago[deleted]
- mod 5y agoAll the results on the first page (as much as it would show me) are just VPS providers.
- cyber_sm 5y agoHey there I manager our Community at GreyNoise - those are the Organizations that the IP is originating from! Our "Actor" Classification gives better insight into /who/ is actually conducting the activity (i.e. https://www.greynoise.io/viz/ip/92.154.95.236 https://www.greynoise.io/viz/ip/92.154.95.236) You can look up IPs in GreyNoise to know if they are scanning the internet (if no results are returned, the answer is likely no or not at scale.) Happy to answer any q's :)
- mod 5y agoI knew, of course, that they were originating from those VPS providers. That makes perfect sense--I wouldn't run masscan on my residential IP, either. I went back to the page linked by the GP post. I clicked through all 10 items and the actor was "Unknown" on all of them. I don't really expect you guys to be able to know who is renting AWS servers or something. I don't know how that would be possible, honestly. It's a cool site, though.
- bogomipz 5y agoThe author states: >"A mutex on the fast path of a program severely limits scalability. Instead, Masscan uses "rings" to synchronize things, such as when the user-mode TCP stack in the receive thread needs to transmit a packet without interfering with the transmit thread." Is "rings" here referring to PF_RING mentioned in the preceding paragraph or is it referring to a specific synchronization primitive?
- dropalltables 5y agoI love this project and Robert is one of the most awesome, thoughtful people in the security world.
- SavantIdiot 5y agoRather than have everyone who can run this (without getting banned) actually run it, couldn't someone just post the results to a file for us once per day or week? Seems inefficient to have millions of people run this when it results in (mostly) the same data.
- nbk_2000 5y agoNot as a file but as a searchable index, yes. Here's a few: shodan.io spyse.com zoomeye.org
- palebluedot 5y agotry https://search.censys.io https://search.censys.io
- emerged 5y agoI would have fun optimizing this. The performance discussion toward the end of the readme was pretty basic, no assembly language or multi threading optimizations, etc. But I have told myself to stop spending time optimizing things for no reason..
- bobek 5y agoMassacan is awesome. One of the usecases is to periodically scan your own servers to see if you have not accidentally opened some new ports in firewalls. https://github.com/bobek/masscan_as_a_service https://github.com/bobek/masscan_as_a_service