> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/reconnaissance/active-reconnaissance-approach/masscan.md).

# Masscan

**Masscan** is a **fast port scanner**, designed to **scan the entire internet in minutes**. It achieves this by leveraging **asynchronous transmission** similar to `scanrand`, `unicornscan`, and `ZMap`.

**Features:**

* **Ultra-fast scanning** (10+ million packets per second)
* **Customizable scan rate** to control performance
* **Supports both IP and range-based scanning**
* **Banner grabbing** for service detection
* **Output compatibility** with `Nmap`

***

### **Installation**

You can install Masscan using the following methods:

#### **On Debian/Ubuntu**

```bash
sudo apt install masscan -y
```

#### **On Arch Linux**

```bash
sudo pacman -S masscan
```

#### **Build from Source**

```bash
git clone https://github.com/robertdavidgraham/masscan
cd masscan
make
sudo make install
```

***

### **Syntax**

```bash
masscan [OPTIONS] -p <ports> <target>
```

#### **Common Flags & Options**

| **Flag**    | **Description**                     | **Example**       |
| ----------- | ----------------------------------- | ----------------- |
| `-p`        | Specify ports to scan               | `-p80,443,22`     |
| `-p1-65535` | Scan all 65,535 ports               | `-p1-65535`       |
| `--rate`    | Set scan speed (packets per second) | `--rate 100000`   |
| `-oL`       | Save output in list format          | `-oL result.txt`  |
| `-oX`       | Save output in XML format           | `-oX result.xml`  |
| `-oJ`       | Save output in JSON format          | `-oJ result.json` |
| `-iL`       | Read targets from a file            | `-iL targets.txt` |
| `--banners` | Grab service banners                | `--banners`       |
| `--open`    | Show only open ports                | `--open`          |

***

### **Examples**

* **Scan a single target on port 80**

  ```bash
  masscan -p80 192.168.1.1
  ```
* **Scan a subnet for open ports 22, 80, and 443**

  ```bash
  masscan -p22,80,443 192.168.1.0/24
  ```
* **Scan all ports on a target**

  ```bash
  masscan -p1-65535 192.168.1.1
  ```
* **Scan with a custom rate limit**

  ```bash
  masscan -p80 192.168.1.1 --rate 100000
  ```

  *(Limits scan speed to 100,000 packets per second to avoid overwhelming the network.)*
* **Read targets from a file and scan port 443**

  ```bash
  masscan -p443 -iL targets.txt
  ```

  *(Each target should be on a new line in `targets.txt`.)*
* **Save scan results to a file in list format**

  ```bash
  masscan -p80,443 192.168.1.1 -oL results.txt
  ```
* **Save scan results in JSON format**

  ```bash
  masscan -p22,80,443 192.168.1.1 -oJ results.json
  ```
* **Perform banner grabbing on discovered services**

  ```bash
  masscan -p80,443,22 192.168.1.1 --banners
  ```
* **Scan only for open ports**

  ```bash
  masscan -p80,443 192.168.1.1 --open
  ```
* **Exclude certain IPs or subnets from scanning**

  ```bash
  masscan -p80,443 192.168.1.1 --exclude 192.168.1.2,192.168.1.3/24
  ```
* **Run Masscan and pipe the results into Nmap for deeper analysis**

  ```bash
  masscan -p80,443 192.168.1.1 -oL results.txt
  cat results.txt | awk '{print $4}' | nmap -sV -iL -
  ```

  *(Uses Masscan to discover open ports and then scans them with Nmap for service detection.)*

***

🔗 **More Info & Documentation:**

* [GitHub Repository](https://github.com/robertdavidgraham/masscan)