Tool introduction: masscan
When performing a port scan against an IT infrastructure, we must assume that services can be accessed via any IP address. As a result, we must scan every IT system, even if we have received a server list from the client. Documentation can be incomplete, especially if the network has grown historically and was managed by multiple administrators. However, since we usually have limited time for a pentest, the choice of port scanner depends on the size of the network. While Nmap can be used to efficiently identify all services on an IT system, the tool is not optimized for a wide scan of several thousand IP addresses. However, this size is often used for internal IT infrastructures because the three private IPv4 address ranges can be used:
- 10.0.0.0/8 (16.777.216 IPs)
- 172.16.0.0/12 (1.048.576 IPs)
- 192.168.0.0/16 (65.536 IPs)
For such cases, tools like masscan have been developed, which, according to their own statement, can scan the entire Internet for the accessibility of one port in only 3 minutes (see man page). This statement can be quite realistic if one would have an exceptionally good routing and network connection. As an example, web servers on the 192.168.0.0/16 network can be identified within a few minutes using the following command, since 2000 SYN packets are sent per second:
sudo masscan -p80,443 --rate=2000 -e tun0 192.168.0.0/16
-p: specifies the port(s) to be scanned
--rate: specifies the desired rate for transmitting packets per second.
-e: use the named raw network interface, such as "eth0" or "dna1"
However, care must be taken when configuring the rate limit, as we may negatively affect the availability of firewalls or other network devices. With masscan we are basically able to identify common services such as DNS servers, web servers, SSH servers, etc. in large network areas in a foreseeable time, while we can then use Nmap to carry out a complete port scan for the active IP addresses.
Pentest Training
Take a look at the pentest training chapters and learn penetration testing:
- Preface
- Introduction
- Legal Framework
- Hacking vs. Penetration Testing
- Classification
- Meaningfulness of Penetration Tests
- Penetration Testing Standards
- The Hacking Guide
- Hacking I: Scanning networks
- Hacking II: Password attacks
- Hacking III: Web application attacks
- Hacking IV: Privilege Escalation
- Hacking V: Tunnelling Techniques
- Hacking VI: Vulnerability scanner and penetration testing frameworks
- Demonstration of a Penetration Test
- Risk Assessment of Identified Vulnerabilities
- Structure of Documentation and Reporting
- Insider stories: Tales from Dubius Payment Ltd.
binsec academy GmbH - Online IT Security Training with Practical Focus
binsec academy GmbH is provider of online IT security training, offering practical, lab-based courses for professionals. The academy provides hands-on training in areas such as penetration testing and secure software development. Participants gain practical experience through realistic lab environments, including simulations of company networks and applications. Courses are available in multiple programming languages and align with standards like OWASP Top 10 and PCI DSS. Upon successful completion, participants receive certifications such as the Binsec Academy Certified Pentest Professional (BACPP) and Binsec Academy Certified Secure Coding Professional (BACSCP), demonstrating their ability to identify and remediate security vulnerabilities.
Goto binsec acadmy GmbH
binsec GmbH – Experts in Penetration Testing
binsec GmbH is a German IT security company focused on professional penetration testing. With over 10 years of experience, the team conducts in-depth penetration tests on networks, web applications, APIs, and mobile apps. Certified experts systematically identify and document security vulnerabilities to support organizations in improving their security and meeting compliance requirements.
Goto binsec GmbH