What does HackerNews think of masscan?

TCP port scanner, spews SYN packets asynchronously, scanning entire Internet in under 5 minutes.

Language: C

I'm not sure about the article, but the blazingly-fast IP scanner sounds a lot like Masscan: https://github.com/robertdavidgraham/masscan

It can scan the entire Internet in 5 minutes and has received a lot of press. https://rushter.com/blog/how-masscan-works/ is one of many articles about how it works.

masscan with the right setup (namely hardware + drivers but also connection obviously) can scan the entire IPv4 space (+ all ports) in ~5 minutes.

Source Code: https://github.com/robertdavidgraham/masscan

Article from PoC || GTFO with more internal details on how it works: https://www.alchemistowl.org/pocorgtfo/pocorgtfo15.pdf (Page 66) [Note: PDF is both a valid PDF + valid ZIP file with source code]

Check out masscan [0]. It’s extremely easy to scan IPv4 very rapidly and find targets in an automated fashion. It advertises scanning the internet in 5 minutes.

[0]: https://github.com/robertdavidgraham/masscan

The tool that can do it in 6 minutes is massscan, the original repo of which is the link of the post:

https://github.com/robertdavidgraham/masscan

Note that "scan the internet in 6 minutes" only means this tool is capable of generating packets fast enough on the host machine to theoretically do a 6 minute scan. In practice, the NIC, home network, and local ISP connection will bottleneck and the scan will be orders of magnitude slower.

On a beefy enough host, you could probably run massscan[1] while out at lunch and probably touch every ipv4 host on the internet.

https://github.com/robertdavidgraham/masscan

> It’s fine that people know you changed your SSH port. But now they have to scan all the ports and find the new one. Sure, that’s not too difficult, but many people are actually going to do that? Not many, because it’s costly in terms of time and effort.

I don't buy it. Scanning the whole IPv4 internet including all ports is not all that costly. Perhaps the effort would deter your proverbial script kiddie running a scan from home, but are those really a threat to your SSH setup?

https://github.com/robertdavidgraham/masscan

No idea why you are being downvoted, this is a solid advice. Masscan [1] claims to scan whole IPv4 Internet for a single port in 5 minutes. Moving to a random high port would increase scan time 64000-fold, to 7 months.

You'd still be advised to disable password-based auth and/or configure fail2ban, though.

[1] https://github.com/robertdavidgraham/masscan

I wrote a similar tool[1] for a cybersecurity competition I was helping to red team for. It would try a dictionary of username and password combos against a list of hosts generated from the results of a masscan[2], once it logged it it would run a bash script on the host to set up our persistence.

From there it would keep a session open on each host and allow you to run commands on a single host, a subset of hosts, or all hosts.

The advantage of this over hydra or some other SSH brute forcer is that it allows us to run our persistence tooling right away after finding a login and keep that SSH session alive so we can re-use it even if the password is changed.

The code is a tire fire, but it worked well for what we needed :)

[1] https://github.com/sdshlanta/ssher

[2] https://github.com/robertdavidgraham/masscan

great work. Pretty sure you can find a lot more scary stuff online by looking for IoT (CoAP, MQTT, etc).

There was a rather scary talk by Lukas Lundgren at defcon 2016 on unauthenticated MQTT[0][1] ... the things he found exposed were just insane. He also used MASSCAN[2], a phenomenal tool, which isn't just useful to probe endpoints but also to actually send payloads (with all its performance/speed benefits).

[0] https://media.defcon.org/DEF%20CON%2024/DEF%20CON%2024%20pre...

[1] https://www.youtube.com/watch?v=o7qDVZr0t2c

[2] https://github.com/robertdavidgraham/masscan

https://zmap.io/ https://github.com/robertdavidgraham/masscan

it will be attacked within minutes, you should start a honeypot and see for yourselves

There are many, many institutions preforming global IPv4 scans daily and many tools that allow you to do it[0][1][2]. The trick is to "Be a good citizen", work with a scan friendly host, signal your benevolence, and limit the rate at which you scan. Also smart to black-list DoD networks. If you don't believe me setup a honey pot and open up a popular udp amplification port. Haven't done so myself but I would expect many instances of scanning would be seen everyday.

[0]:https://zmap.io/ [1]:https://github.com/robertdavidgraham/masscan [2]:https://memcachedscan.shadowserver.org/

I wonder if you could use nmap or something like masscan(https://github.com/robertdavidgraham/masscan) to figure the IP addresses of people using a certain software(say mongodb on port 27017). And then reverse looking up those IPs to figure out which companies they belong to and then you contact the said companies to sell something.
Line rate for 1gbps ethernet is over 1 million PPS, so you can definitely send the packets that fast. No promises the target will be able to respond that fast.

See https://github.com/robertdavidgraham/masscan

another, newer alternative is https://github.com/robertdavidgraham/masscan

note that doing this is a very good way to get angry letters from your ISP

One thing to remember is that high-speed packet filtering is an unusual workflow and CloudFlare operates at a much greater scale than most of us see: most Linux devices are not connected to 10G, much less 100G, networks and they're usually doing more work than looking at a packet to decide whether to accept or reject it. The fact that the APIs and the kernel stack were designed many years before those kind of speeds were possible doesn't matter because most sites don't have that much traffic and most server applications will bottleneck at doing other work well before that point.

The example in the article found a single core handling 1.4M packets per second. If you're running a web-server shoveling data out to clients those packets are going to be close to the maximum size which, if I haven't screwed up the math, looks something like this:

1.4M * 1400 bytes (assuming a low MTU) * 8 (bytes -> bits) = 15Gbps

That's not to say that there isn't still plenty of room to improve and, as lukego noted, there's a lot of work in progress (see e.g. https://lwn.net/Articles/615238/ on work to batch operations to avoid paying some of the processing costs for every packet) but for the average server you'd find bottlenecks on something like a database, application logic, request handling, client network capacity, etc. before the network stack overhead is your greatest challenge. The people who encounter this tend to be CDN vendors like CloudFlare and security people who need to filter, analyze, or generate traffic on levels which are at least the the scale of a large company (e.g. https://github.com/robertdavidgraham/masscan).

FYI: if you don't want to pay shodan for search results, you could run your own port scan using masscan(https://github.com/robertdavidgraham/masscan) by running the command

  masscan -p27017 0.0.0.0/0 --excludefile data/exclude.conf
Be warned that this will scan the entire IPv4 namespace.
Here ya go: https://github.com/robertdavidgraham/masscan

    @collinrm I just took masscan, changed the HTTP request,
    then tweeked the code to generate a small TTL.
Source: https://twitter.com/ErrataRob/status/583433175302479872
not related to this project, but rob is the instigator for massscan (https://github.com/robertdavidgraham/masscan) as well, whic claims to scan the entire ipv4 space in approx 6 minutes!!!