What does HackerNews think of masscan?

TCP port scanner, spews SYN packets asynchronously, scanning entire Internet in under 5 minutes.

Language: C

Ask HN: Looking for an Old Article | Mar 2023
I'm not sure about the article, but the blazingly-fast IP scanner sounds a lot like Masscan: https://github.com/robertdavidgraham/masscan

It can scan the entire Internet in 5 minutes and has received a lot of press. https://rushter.com/blog/how-masscan-works/ is one of many articles about how it works.

Large scale Internet SSH brute force attacks seem to have stopped here | Aug 2022
Expand Context ↕
"Not hard", to say the least, yeah:

https://github.com/robertdavidgraham/masscan
Who's Attacking My Server? | Mar 2022
Expand Context ↕
masscan with the right setup (namely hardware + drivers but also connection obviously) can scan the entire IPv4 space (+ all ports) in ~5 minutes.

Source Code: https://github.com/robertdavidgraham/masscan

Article from PoC || GTFO with more internal details on how it works: https://www.alchemistowl.org/pocorgtfo/pocorgtfo15.pdf (Page 66) [Note: PDF is both a valid PDF + valid ZIP file with source code]
Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage | Jun 2021
Expand Context ↕
Check out masscan [0]. It’s extremely easy to scan IPv4 very rapidly and find targets in an automated fashion. It advertises scanning the internet in 5 minutes.

[0]: https://github.com/robertdavidgraham/masscan
Some idiot is using your tool to mass scan our network | Oct 2020
Expand Context ↕
The tool that can do it in 6 minutes is massscan, the original repo of which is the link of the post:

https://github.com/robertdavidgraham/masscan

Note that "scan the internet in 6 minutes" only means this tool is capable of generating packets fast enough on the host machine to theoretically do a 6 minute scan. In practice, the NIC, home network, and local ISP connection will bottleneck and the scan will be orders of magnitude slower.
Check if your IP is exposing any ports. If you see 404 page, nothing is exposed | Sep 2020
Expand Context ↕
On a beefy enough host, you could probably run massscan[1] while out at lunch and probably touch every ipv4 host on the internet.

https://github.com/robertdavidgraham/masscan
Moving Your SSH Port Isn’t Security by Obscurity | Sep 2020
> It’s fine that people know you changed your SSH port. But now they have to scan all the ports and find the new one. Sure, that’s not too difficult, but many people are actually going to do that? Not many, because it’s costly in terms of time and effort.

I don't buy it. Scanning the whole IPv4 internet including all ports is not all that costly. Perhaps the effort would deter your proverbial script kiddie running a scan from home, but are those really a threat to your SSH setup?

https://github.com/robertdavidgraham/masscan

Persistant SSH Threats? | Jan 2020
Expand Context ↕
No idea why you are being downvoted, this is a solid advice. Masscan [1] claims to scan whole IPv4 Internet for a single port in 5 minutes. Moving to a random high port would increase scan time 64000-fold, to 7 months.

You'd still be advised to disable password-based auth and/or configure fail2ban, though.

[1] https://github.com/robertdavidgraham/masscan
Cluster SSH – Manage Multiple Linux Servers Simultaneously | Oct 2019
I wrote a similar tool[1] for a cybersecurity competition I was helping to red team for. It would try a dictionary of username and password combos against a list of hosts generated from the results of a masscan[2], once it logged it it would run a bash script on the host to set up our persistence.

From there it would keep a session open on each host and allow you to run commands on a single host, a subset of hosts, or all hosts.

The advantage of this over hydra or some other SSH brute forcer is that it allows us to run our persistence tooling right away after finding a login and keep that SSH session alive so we can re-use it even if the password is changed.

The code is a tire fire, but it worked well for what we needed :)

[1] https://github.com/sdshlanta/ssher

[2] https://github.com/robertdavidgraham/masscan

Show HN: Enter your URL and view CVEs affecting your stack over last 6 months | Sep 2019
Expand Context ↕
In fact, there's a tool that claims to scan the internet in 6 minutes: https://github.com/robertdavidgraham/masscan
I scanned Austria | Feb 2019
great work. Pretty sure you can find a lot more scary stuff online by looking for IoT (CoAP, MQTT, etc).

There was a rather scary talk by Lukas Lundgren at defcon 2016 on unauthenticated MQTT[0][1] ... the things he found exposed were just insane. He also used MASSCAN[2], a phenomenal tool, which isn't just useful to probe endpoints but also to actually send payloads (with all its performance/speed benefits).

[0] https://media.defcon.org/DEF%20CON%2024/DEF%20CON%2024%20pre...

[1] https://www.youtube.com/watch?v=o7qDVZr0t2c

[2] https://github.com/robertdavidgraham/masscan

A honeypot programmed in Micropython for the ESP8266 | Oct 2018
Expand Context ↕
https://zmap.io/ https://github.com/robertdavidgraham/masscan

it will be attacked within minutes, you should start a honeypot and see for yourselves
The Mirai Botnet Architects Are Now Fighting Crime with the FBI | Sep 2018
Expand Context ↕
There are many, many institutions preforming global IPv4 scans daily and many tools that allow you to do it[0][1][2]. The trick is to "Be a good citizen", work with a scan friendly host, signal your benevolence, and limit the rate at which you scan. Also smart to black-list DoD networks. If you don't believe me setup a honey pot and open up a popular udp amplification port. Haven't done so myself but I would expect many instances of scanning would be seen everyday.

[0]:https://zmap.io/ [1]:https://github.com/robertdavidgraham/masscan [2]:https://memcachedscan.shadowserver.org/
How We Found All of Optimizely's Clients | Jan 2017
I wonder if you could use nmap or something like masscan(https://github.com/robertdavidgraham/masscan) to figure the IP addresses of people using a certain software(say mongodb on port 27017). And then reverse looking up those IPs to figure out which companies they belong to and then you contact the said companies to sell something.
This security camera was infected by malware 98 seconds after it was plugged in | Nov 2016
Expand Context ↕
https://github.com/robertdavidgraham/masscan
Ever wondered how many open FTP servers there are? | Sep 2016
Expand Context ↕
masscan: https://github.com/robertdavidgraham/masscan
455 Tb of live streaming were transferred during the Olympic Games Rio 2016 | Aug 2016
Expand Context ↕
Scanning.

See for example: https://github.com/robertdavidgraham/masscan
TOTP SSH port fluxing | May 2016
Expand Context ↕
Line rate for 1gbps ethernet is over 1 million PPS, so you can definitely send the packets that fast. No promises the target will be able to respond that fast.

See https://github.com/robertdavidgraham/masscan
VNC Roulette | Mar 2016
Expand Context ↕
another, newer alternative is https://github.com/robertdavidgraham/masscan

note that doing this is a very good way to get angry letters from your ISP
A Modern App Developer and an Old-Timer System Developer Walk into a Bar | Feb 2016
Pentester: I'll use mass scan, someone else already solved this problem. https://github.com/robertdavidgraham/masscan
Bypassing the Linux kernel for high-performance packet filtering | Sep 2015
Expand Context ↕
One thing to remember is that high-speed packet filtering is an unusual workflow and CloudFlare operates at a much greater scale than most of us see: most Linux devices are not connected to 10G, much less 100G, networks and they're usually doing more work than looking at a packet to decide whether to accept or reject it. The fact that the APIs and the kernel stack were designed many years before those kind of speeds were possible doesn't matter because most sites don't have that much traffic and most server applications will bottleneck at doing other work well before that point.

The example in the article found a single core handling 1.4M packets per second. If you're running a web-server shoveling data out to clients those packets are going to be close to the maximum size which, if I haven't screwed up the math, looks something like this:

1.4M * 1400 bytes (assuming a low MTU) * 8 (bytes -> bits) = 15Gbps

That's not to say that there isn't still plenty of room to improve and, as lukego noted, there's a lot of work in progress (see e.g. https://lwn.net/Articles/615238/ on work to batch operations to avoid paying some of the processing costs for every packet) but for the average server you'd find bottlenecks on something like a database, application logic, request handling, client network capacity, etc. before the network stack overhead is your greatest challenge. The people who encounter this tend to be CDN vendors like CloudFlare and security people who need to filter, analyze, or generate traffic on levels which are at least the the scale of a large company (e.g. https://github.com/robertdavidgraham/masscan).
Finding MongoDB instances without any authentication | Jul 2015
FYI: if you don't want to pay shodan for search results, you could run your own port scan using masscan(https://github.com/robertdavidgraham/masscan) by running the command

  masscan -p27017 0.0.0.0/0 --excludefile data/exclude.conf
Be warned that this will scan the entire IPv4 namespace.
Pin-pointing China's attack against GitHub | Apr 2015
Expand Context ↕
Here ya go: https://github.com/robertdavidgraham/masscan

    @collinrm I just took masscan, changed the HTTP request,
    then tweeked the code to generate a small TTL.
Source: https://twitter.com/ErrataRob/status/583433175302479872
Robdns – A fast DNS server based on C10M principles | Dec 2014
not related to this project, but rob is the instigator for massscan (https://github.com/robertdavidgraham/masscan) as well, whic claims to scan the entire ipv4 space in approx 6 minutes!!!