Scanning a 255.0.0.0 subnet

[Daemon0x90]

So, one thing that I have ran into lately is extremely large networks. Often its a 10.0.0.0/8 255.0.0.0 network that I am pretty sure is used to just deter networking scanning and host discovery. Does anyone have any advice for scanning networks this size?

[digip]

Masscan. Will scan very quickly. Can miss some ports, but general network discovery, it works. Also, nmap, can do it quickly, if you add -n (no dns) and only scan for hardware, ie: arp sweep for nodes only, no ports. Then you can individually port scan each one if needed after you get a list of nodes, just use nmap to output to greppable format to save to file, which can then be scanned with masscan import for port scanning, or just use nmap. If using nmap specifically, be sure to set timeouts, just add -v --open, to catch open ports, as timeouts won't show found ports without it at the end of the scan.

Edited August 4, 2017 by digip

[i8igmac]

Nmap -sP 10.0.0.

Simply ping.

 

Nmap -sS -p 80 -oX scan.xml

This will tcp syn connect scan, only a single port and save it as a xml document. With a large list of host i then import this xml document into metasploit, this will allow me to perform a scan on all host that are online. With metasploit you can do more nmap scanning and set your host list to all clients discovered in the xml or only a select group that match a filter or string of your choice.