mass-scanning-tools

Map services across entire IP ranges, then quantify, inspect, and archive the results.

2026-08-07 UPDATE: Picking this project back up, after many years. This is an old project that I figured could use some TLC.

Pipeline: ASN -> CIDR -> ZMap -> ZGrab2 -> archive

Authorization required. Only scan networks you own or have explicit written permission to test. Unauthorized scanning may be illegal under certain circumstances.

Install

Requires Python 3.10+.

pip install -e .

This installs the mst command.

External tools:

Tool	Role	Install
ZMap	L4 discovery (open ports)	mst doctor / distro packages
ZGrab2	L7 handshakes / banners	mst doctor (builds from source; needs Go 1.23+)

On Windows, use WSL2, then run mst doctor inside WSL.

ASN lookup uses the whois binary when available, otherwise a direct socket query to whois.radb.net.

Quickstart

mst doctor
mst run --asn AS36352 --port 1337 --module banner
mst run --asn AS36352 --port 443 --module tls
mst run --asn AS36352 --port 80 --module http -- --endpoint=/ --max-redirects=1

Commands

mst doctor                              # check whois/zmap/zgrab2; offer installs
mst asn AS36352 -o cidrs.txt            # ASN -> CIDR list
mst scan -w cidrs.txt -p 1337 -o open.json
mst modules                             # list ZGrab2 protocol modules + default ports
mst probe open.json -m banner -p 1337 -o zgrab2.jsonl
mst probe open.json -m http -p 80 -- --endpoint=/
mst probe open.json --zgrab-config multi.ini -o zgrab2.jsonl
mst run --asn AS36352 --port 22 --module ssh

Anything after -- on mst probe / mst run is passed straight through to ZGrab2 (module-specific flags).

ZGrab2 modules

mst supports every protocol ZGrab2 ships, including:

AMQP, AMQP091, BACnet, Banner, CheckPoint, Codesys2, DNP3, DRDA, EtherNet/IP, Fox, FTP, HTTP, IMAP, IPP, JARM, ManageSieve, Memcached, Modbus, MongoDB, MQTT, MSSQL, MySQL, NTP, Omron FINS, Oracle, POP3, PostgreSQL, PPTP, RDP, Redis, Siemens, SMB, SMTP, SOCKS5, SSH, Telnet, TLS.

mst modules lists the built-in catalog; mst modules --installed queries your local zgrab2 binary so newly added upstream modules are picked up automatically.

Optional filters:

• --success-only (default) keeps protocol successes; --all-results keeps every record
• --hit-words / --hit-regex match against the full JSON transcript (not a reduced banner string)

Multiple modules

Use a ZGrab2 .ini with mst probe --zgrab-config multi.ini / mst run --zgrab-config multi.ini. Example:

[Application Options]
[http]
name="http80"
port=80
endpoint="/"
[ssh]
name="ssh22"
port=22

Archive layout (mst run)

runs/20260101T120000Z_AS36352/
  cidrs.txt
  zmap.json
  zgrab2.full.jsonl   # complete ZGrab2 transcripts
  hits.jsonl          # filtered successes / hit matches
  hits.txt
  summary.json

Development

pip install -e .
mst --help

Legacy

The old standalone scripts (asn2cidr, raw_cnc_discovery, telnet_cnc_discovery, zmap_stuff) and the built-in raw/telnet socket prober are replaced by mst + ZMap + ZGrab2.