Installing Masscan on Raspberry Pi

[Anonymous123]

I installed masscan by typing in these commands on my Pi 2B and they installed just fine but I can't seem to find masscan. I typed in cd masscan/bin but my pi told me that masscan/bin isn't a file or directory. Here is a link to the masscan github page https://github.com/robertdavidgraham/masscan and here are the commands I typed

sudo apt-get install git gcc make libpcap-dev
$ git clone https://github.com/robertdavidgraham/masscan
$ cd masscan
$ make

[Anonymous123]

I fixed that problem but I discovered I have a new problem with masscan. Masscan has it's own tcp/ip stack thank the machine it runs on. This interferes with my banner checking using masscan. So how do I give masscan a different ip address from my pi's ip? My pi is connected via ethernet.

Edited July 21, 2015 by rpiswag

[Anonymous123]

I have two ways that I know of to fix this banner scanning problem. I can give masscan it's own ip address or I can set a ip tables rule like this

iptables -A INPUT -p tcp --dport 60000 -j DROP

. What does that iptables rule do and how can I run that command on boot?

[cooper]

You need to clone your network device.

Wherever it may be that you define your network settings, include a duplicate where the device name has ":1" tacked onto it. So if your actual device is eth0 you should set up an eth0:1 and it will do just that. You can operate this secondary device as you would any other ethernet device. Once it's got its unique IP you tell masscan about it and be on your merry way.

Note that if your device talks to the internet via your router, this funky tcp/ip stack is going to mess up your router's stack instead of your own. In other words, only scan your own network, which is a bit of general advice that particularly applies here.

Edited July 21, 2015 by Cooper

[Anonymous123]

Can you answer my questions about ip tables?

Edited July 21, 2015 by rpiswag

[cooper]

All incoming TCP traffic destined for port 60000 should be dropped.

And how you start a program on boot is distro-specific, but check out what's in /etc/rc.*

[fugu]

just a quick question, why masscan and not nmap? I'm pretty sure nmap should be able to most types of scans, i think anyway. And will most likely be maintained well for some time to come.

[Anonymous123]

masscan is great if you want to scan several hundred computers but nmap is great if you are scanning a small number of computers.

[Anonymous123]

Can you list the commands I need to type to give masscan it's own ip address. I do want to scan outside of my local network but on the masscan github page it states that it was works best when masscan has it's own ip?

[cooper]

I can't give you the commands because I don't own a Pi nor do I run Debian anywhere.

And really, if you're hacking with a device it really, REALLY helps to know these basic things. I've told you what you need to alter so all you have to do is figure out how you initially set up the networking bits and duplicate those bits for the additional network device.