port-mass-scan

Scan single hosts and large IP ranges using RustScan, Masscan, and Nmap.

1.1k|191|Updated Jun 24, 2026
One-click install
npx skills add https://github.com/uphiago/recon-skills --skill port-mass-scan
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: port-mass-scan
Source: https://github.com/uphiago/recon-skills/tree/main/recon/port-mass-scan
Command: npx skills add https://github.com/uphiago/recon-skills --skill port-mass-scan

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Traditional port scanning tools like Nmap are prohibitively slow for large IP ranges (/8-/24) and full single-host port scans can take 5-10 minutes, creating bottlenecks in reconnaissance and penetration testing workflows.

Core Features & Use Cases

  • High-speed single host scanning: RustScan delivers 400x faster 1000-port scans than Nmap (3-10 seconds vs 5-10 minutes) for quick initial port discovery.
  • Large range scanning: Masscan handles /8 and /16 IP ranges that Nmap cannot process in reasonable timeframes, enabling ISP and government network-scale reconnaissance.
  • Service identification: Integrated banner grabbing and Nmap pass-through deliver accurate service version detection for discovered open ports.
  • Use Case: For a client pentest engagement, scan a /24 client subnet in 2-5 minutes to map all active services, or quickly enumerate all 65535 ports on a single high-value target in under 10 seconds before deeper service testing.

Quick Start

Use the port-mass-scan skill to run a high-speed full port scan on a target IP and get a list of all open ports with associated service versions.

Frequently Asked Questions about port-mass-scan

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan all 65535 ports on a single host faster than Nmap?▼

Full single-host port scanning uses RustScan to discover open ports in 3-10 seconds instead of the 5-10 minutes Nmap requires. This rapid port scanning delivers quick initial discovery before deeper service testing begins.

What is the best way to port scan a large /24 or /16 IP range for penetration testing?▼

Large IP range port scanning across /8 to /24 subnets uses Masscan to overcome Nmap's performance limits. It maps active services on ISP or government network scales within 2-5 minutes for a /24 client subnet.

How does port scanning integrate with Nmap for service version enumeration?▼

After high-speed port discovery via RustScan or Masscan, the workflow passes open ports to Nmap. Nmap performs accurate banner grabbing and service version detection for discovered TCP services.

Can I use fast port scanning for IoT device hunting and subdomain enumeration?▼

High-speed port scanning applies directly to IoT device hunting and post-subdomain enumeration. It discovers non-HTTP TCP services and expands the attack surface after initial web assessments.

Why does traditional Nmap port scanning create bottlenecks during reconnaissance?▼

Traditional Nmap port scanning is prohibitively slow for large IP ranges and full single-host scans. This creates reconnaissance bottlenecks that high-speed scanning overcomes by integrating RustScan and Masscan.

Does this port scanning approach work for both single hosts and large network ranges?▼

Port scanning supports both single hosts and large IP ranges from /8 to /24. RustScan handles rapid single-host discovery while Masscan enables network-scale reconnaissance across massive subnets.