ScanCannon combines masscan speed with nmap accuracy to enumerate credentials-based attack surfaces across massive external ranges, built for authorized reconnaissance and monitoring workflows.
| Tool | johnnyxmas/ScanCannon — Bash orchestration layer that chains masscan and nmap for large-scale, credentials-focused external reconnaissance |
| Category | Network reconnaissance and attack surface enumeration shell scripting |
| Primary Use | Mapping exposed credential-based services (SSH, FTP, SMB, HTTP APIs) across very large authorized external ranges, with per-project scan diffing for attack-surface monitoring |
| Safe Use | Intended for penetration testers and security teams with written authorization over the scanned ranges, asset inventory in owned lab or enterprise environments, and defensive exposure audits |
| Telemetry Note | Relies on masscan raw-packet emission at configurable rate, which is loud and easily flagged by IDS/IPS and NetFlow monitoring; subsequent nmap NSE probing and curl API checks add detectable service-level fingerprints |
ScanCannon is a Bash script, currently at v1.9, that solves a persistent operational problem in external reconnaissance: enumerating extremely large network ranges quickly while still producing accurate, detailed service intelligence. The core design is a two-stage pipeline. masscan fires first at whatever packet rate your infrastructure tolerates, identifying open ports across the target space; nmap then runs only against responsive hosts to compensate for masscan's well-known accuracy gaps, capturing service versions, hostnames, and scriptable detail. This division of labor is not novel in itself, but the script wraps it in project management, resumability, and change detection that turn a one-off scan into a repeatable monitoring process.
The scope-defining logic is where the tool gets interesting from a tradecraft perspective. The -d flag accepts a domain, resolves all its A records, queries whois for the owning CIDR and ASN, and then pulls every prefix that ASN announces via RADB, presenting an interactive range-selection menu. The -c flag applies the same ASN expansion to a seed CIDR, while -f reads curated CIDR lists from a file and — sensibly — skips expansion by default so that carefully scoped lists don't balloon into parent prefixes or trigger interactive prompts mid-run. Passing -F forces ASN discovery on file entries when you want the opposite behavior. For authorized engagements, this matters: scope control is baked into the input model rather than bolted on.
The target service list reveals the tool's stated intent — finding credentials-based attack surfaces and APIs. TCP coverage focuses on ports 21 (FTP), 22 (SSH), 23 (Telnet), 53 (DNS), 80/443 (HTTP/HTTPS), 135/139/445 (the Microsoft RPC/NetBIOS/SMB cluster), 990, 1701, and 1723 (PPTP). The optional -u flag adds UDP probing of 53, 161 (SNMP), and 500 (ISAKMP) via nmap, at a documented speed penalty. Restricting the port set to credential-relevant services is an explicit performance decision, dramatically cutting scan time compared to full-range enumeration while still surfacing the exposure classes that matter for brute-force and credential-stuffing assessments.
Detection features extend beyond raw port discovery. With -a, the script performs API endpoint detection on HTTP/HTTPS services using nmap NSE scripts plus targeted curl probing, and harvests TLS certificate SANs, feeding newly discovered hostnames back into the discovery loop — a nice iterative touch that often pulls in forgotten virtual hosts. The -V flag runs nmap's vulners NSE against detected service versions for CVE hinting. Results are categorized into per-service text files (ssh_, http_, api_servers.txt, cert_sans.txt), plus resolved_subdomains.txt and resolved_root_domains.csv with WHOIS details, all designed to be loaded directly into whatever tool comes next in your authorized workflow.
The project system is arguably the most operationally mature part of the design. Every run belongs to a project whose results live under ./projects/<name>/results/, with historical snapshots in ./projects/<name>/history/. Each new run is diffed against the project's previous scan, and the generated report.html includes a "Changes Since Last Scan" section listing new and disappeared host:port services. This effectively converts the script into a lightweight attack-surface monitoring platform — run it weekly against your own external estate and the diff becomes your exposure drift report. A self-contained report.html and flat findings.csv are written per run, alongside raw masscan and nmap output for auditability.
Resilience details suggest real field use. Completed CIDRs are checkpointed and skipped on re-run, and masscan state is preserved on interrupt, which matters when a multi-range scan dies halfway through at 3 a.m. Parallelism is tunable via environment variables: NMAP_MAX_PARALLEL (default 4 hosts per CIDR), DNS_MAX_PARALLEL (default 8), CIDR_MAX_PARALLEL (default 1), and WHOIS_CACHE_TTL (default 86400 seconds) with retry/backoff on whois queries. Completion notifications via -n support macOS desktop alerts, notify-send, or webhook POSTs to ntfy/Slack-style endpoints — useful for long-running unattended scans against owned infrastructure.
The README is unusually candid about masscan's network-level requirements, dedicating substantial space to adapter configuration. On every run the script offers to detect interfaces, set adapter-ip, adapter-mac, and router-mac, and write them into scancannon.conf, because masscan bypasses the kernel network stack with raw packets and gets its best throughput when it can address the gateway's MAC directly. One documented gotcha: masscan wants MAC addresses in dash format, and the automatic configuration handles the conversion. The default rate of 5000 packets per second in scancannon.conf comes with an explicit warning to start low, which is sound advice — misjudged rates saturate uplinks and draw abuse complaints even in fully authorized engagements.
Prerequisites are modest and standard: root privileges for raw packet manipulation, masscan v1.0.3+, nmap v7.0.1+, and common Unix tools (dig, whois, wget, awk, sed), with curl optional for -a and webhook notifications. Cross-platform support covers Linux, macOS, and WSL2, and the script deliberately maintains Bash 3.2 compatibility for macOS's ancient default shell. Basic invocation follows the pattern sudo ./scancannon.sh -d example.com or sudo ./scancannon.sh -c 203.0.113.0/24, with all input flags repeatable and combinable — domain, CIDR, and file seeds can be mixed in a single run.
Configuration hygiene deserves attention before first use. The bundled exclude.txt ships with private ranges (10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, 127.0.0.0/8) commented as examples, and the excludefile setting in scancannon.conf points at it. Responsible operators should treat exclusion lists as mandatory plumbing, not optional: the tool is explicitly designed to scan "extremely large networks (such as The Internet)," and the README includes a Safety & Legal Considerations section acknowledging the sensitivity of that capability. Only point it at ranges you are contractually authorized to assess.
From a defensive standpoint, everything here is loud. masscan's raw SYN emission at thousands of pps is trivially detectable via NetFlow, rate-based IDS rules, and darknet monitoring; the follow-on nmap service probes and curl API checks leave standard tool fingerprints. That cuts both ways: blue teams can detect misuse of this exact pattern easily, and asset owners running it against their own estate will want to coordinate with network monitoring teams beforehand to avoid tripping their own defenses.
The repository shows 482 stars, is written in Shell, and carries no standard license (NOASSERTION), which practitioners should note before redistributing or embedding it in commercial engagements — the README's License section is the authoritative reference. The active topic tagging and the structured documentation depth, including troubleshooting, FAQ, and known-issues sections, indicate a maintained, field-tested tool rather than a weekend experiment. For authorized external attack surface enumeration at scale, ScanCannon is a competent, well-documented entry worth a slot in the reconnaissance toolkit.
johnnyxmas/ScanCannon.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.