Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.bytejmp.com/llms.txt

Use this file to discover all available pages before exploring further.

Install

apt install masscan

Basic Scan

masscan -p 80 10.10.10.0/24
masscan -p 0-65535 TARGET
masscan -p 80,443,8080 TARGET

Rate Tuning

masscan -p- TARGET --rate 1000        # 1k packets/sec
masscan -p- TARGET --rate 10000       # 10k packets/sec (aggressive)
masscan -p- TARGET --rate 100000      # 100k packets/sec (very aggressive)
High rates can crash targets or trigger IDS. Start low, increase gradually.

Common Scans

Full Port Scan — Single Target

masscan -p 0-65535 TARGET --rate 1000 -oL ports.txt

Subnet Scan — Common Ports

masscan -p 21,22,23,25,53,80,110,139,143,443,445,993,995,1433,3306,3389,5432,5985,8080,8443 10.10.10.0/24 --rate 1000

Exclude Hosts

masscan -p- 10.10.10.0/24 --rate 1000 --excludefile exclude.txt

Output Formats

masscan -p- TARGET --rate 1000 -oL output.txt    # List
masscan -p- TARGET --rate 1000 -oX output.xml    # XML
masscan -p- TARGET --rate 1000 -oG output.gnmap  # Grepable
masscan -p- TARGET --rate 1000 -oJ output.json   # JSON

Parse & Feed to Nmap

Extract Open Ports

masscan -p- TARGET --rate 1000 -oL ports.txt
grep "open" ports.txt | cut -d' ' -f3 | sort -n | tr '\n' ',' | sed 's/,$//'

Pipe to Nmap

ports=$(masscan -p- TARGET --rate 1000 -oL - | grep "open" | cut -d' ' -f3 | sort -n | tr '\n' ',' | sed 's/,$//')
nmap -sV -sC -p $ports TARGET -oA targeted

Options

FlagDescription
-pPort(s) to scan
--ratePackets per second
--bannersGrab banners
--source-portSpoof source port
--source-ipSpoof source IP
--adapter-ipUse specific interface IP
--excludefileExclude hosts from file
--wait 5Wait 5 sec after scan for late replies

Quick Reference

TaskCommand
Full scanmasscan -p- TARGET --rate 1000
Subnetmasscan -p 80,443 10.10.10.0/24 --rate 500
With bannersmasscan -p 80 TARGET --banners --rate 1000
To NmapParse masscan output → nmap -sV -sC -p PORTS