MASSIVE NETWORK DISCOVERY

INSTALL & EXCLUDES

#slackware
#ls -lF /var/log/packages/{gcc,git,libcap,make}-[0-9]*

#ubuntu
#apt install gcc git make libpcap-dev

git clone https://github.com/robertdavidgraham/masscan
cd masscan/
grep ^proc /proc/cpuinfo
make -j8 >/dev/null && echo BUILT
make install >/dev/null && echo INSTALLED
which masscan
mkdir -p /etc/masscan/
cp -i data/exclude.conf /etc/masscan/exclude.conf.sample
vi /etc/masscan/exclude.conf

…keep the special address blocks and eventually get rid of the irrelevant complains

you end up with

0.0.0.0/8
10.0.0.0/8
100.64.0.0/10
127.0.0.0/8
169.254.0.0/16
172.16.0.0/12
192.0.0.0/24
192.0.0.0/29
192.0.0.170/32
192.0.0.171/32
192.0.2.0/24
192.88.99.0/24
192.168.0.0/16
198.18.0.0/15
198.51.100.0/24
203.0.113.0/24
240.0.0.0/4
255.255.255.255/32

USAGE

masscan --nmap

Note the defaults are

-sS -Pn -n --randomize-hosts -v --send-eth

LAN

cidr=x.x.x.x/xx
masscan $cidr -p25 --rate=100000 -oG ${cidr/\//_}.smtp.og
masscan $cidr -p0-65535 --rate=100000 -oG ${cidr/\//_}.allports.og

#--open
#--banners
#‐‐top-ports 100

grep -v ^# ${cidr/\//_}.smtp.og | sort -V -k4
grep -v ^# ${cidr/\//_}.allports.og | sort -V -k4

against the public network

screen -S scan
masscan 0.0.0.0/0 -p25 --excludefile /etc/masscan/exclude.conf --rate=500000 -oG massp25.og

#w/o This network exclusion even
masscan 0.0.0.0/0 -p25 --excludefile ~/exclude.conf --rate=500000 -oG massp25.og --banners --open-only > massp25.stdout

ADDITIONAL NOTES / TRASH

ls -lF /etc/masscan/masscan.conf #noexist
vi /etc/masscan/masscan.conf

rate =  100000
output-format = xml
output-status = all
output-filename = scan.xml
ports = 0-65535
range = 0.0.0.0-255.255.255.255
excludefile = /etc/masscan/exclude.conf

RESOURCES

MASSCAN: Mass IP port scanner https://github.com/robertdavidgraham/masscan

Masscan Examples: From Installation to Everyday Use https://danielmiessler.com/study/masscan/

Masscan and massive address lists https://blog.erratasec.com/2018/11/masscan-and-massive-address-lists.html

exclude lists

IANA IPv4 Special-Purpose Address Registry https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml

Special Use IPv4 Addresses https://tools.ietf.org/html/rfc5735

List of assigned /8 IPv4 address blocks https://en.wikipedia.org/wiki/List_of_assigned_/8_IPv4_address_blocks

official https://github.com/robertdavidgraham/masscan/blob/master/data/exclude.conf

br0k3nb1nary/masscan-exclude https://github.com/br0k3nb1nary/masscan-exclude/blob/master/exclude.conf

pie charts

Is there a way to make “sunburst charts” (multi-level pie charts) in LaTeX? https://tex.stackexchange.com/questions/433848/is-there-a-way-to-make-sunburst-charts-multi-level-pie-charts-in-latex


HOME | GUIDES | LECTURES | LAB | SMTP HEALTH | HTML5 | CONTACT
Copyright © 2024 Pierre-Philipp Braun