Compare commits

...
Author SHA1 Message Date
Brandon 08904c0bf2 initial changes 2020-09-12 01:49:16 +01:00
Brandon bc5b2eea7e added release drafter 2020-09-11 00:59:55 +01:00
Bee bda392c9a7 Merge pull request #200 from RustScan/ba-add-cidr-support
Add CIDR support
2020-09-10 00:46:19 +01:00
Bernardo Chaves 3836480486 Add CIDR support
Add CIDR support for ips_or_hosts argument. This will allow our users to
specify multiple IPs within a network at once which is pretty
convenient.
2020-09-09 19:21:43 -04:00
Bee 2291ba73d2 Update FUNDING.yml 2020-09-07 23:00:14 +01:00
Bee e0af8a306a Merge pull request #198 from RustScan/all-contributors/add-buermarc
docs: add buermarc as a contributor
2020-09-07 22:22:52 +01:00
Bee cb0f4f7a92 Merge branch 'master' into all-contributors/add-buermarc 2020-09-07 22:17:59 +01:00
Bee 402bea4b06 Merge pull request #195 from buermarc/master
Check '.config/rustscan/config.toml' for config
2020-09-07 22:15:47 +01:00
allcontributors[bot] f44dda0360 docs: update .all-contributorsrc [skip ci] 2020-09-07 21:15:35 +00:00
allcontributors[bot] 965a173032 docs: update README.md [skip ci] 2020-09-07 21:15:34 +00:00
Bee d95cae6677 Merge branch 'master' into master 2020-09-07 21:41:27 +01:00
Bee 2f92d5583a Merge pull request #197 from RustScan/ba-no-nmap-option
Introduce the -no-nmap option
2020-09-07 21:41:09 +01:00
Bee 8d8da79640 Merge branch 'master' into ba-no-nmap-option 2020-09-07 21:29:23 +01:00
Bee e5b4a2f443 Merge branch 'master' into master 2020-09-07 21:23:18 +01:00
Bernardo Araujo a0b877729e Merge pull request #194 from usrGabriel/patch-1
Update README.md
2020-09-07 11:20:25 -04:00
Bernardo Chaves 743fa1cad6 Introduce the -no-nmap option
As the name implies this will allow RustScan to to run the scan without
starting an nmap scan with ports that are found.
2020-09-06 22:22:17 -04:00
mulc a0561d4728 Check '.config/rustscan/config.toml' for config
When reading the config file '$CONFIG_DIR/.config/rustscan/config.toml'
should also be checked. If both '~/.rustscan.toml' and
'$CONFIG_DIR/.config/rustscan/config.toml' exist, then later will be
used.
2020-09-05 18:32:08 +02:00
Gabriel b2a1bd2e7a Update README.md
Typo fix in the Debian / Kali install section.
2020-09-05 12:23:18 -04:00
9 changed files with 226 additions and 425 deletions

No files matched your search

+9
View File
@@ -173,6 +173,15 @@
"contributions": [
"platform"
]
},
{
"login": "buermarc",
"name": "buermarc",
"avatar_url": "https://avatars2.githubusercontent.com/u/44375277?v=4",
"profile": "https://github.com/buermarc",
"contributions": [
"code"
]
}
],
"contributorsPerLine": 7,
+1 -1
View File
@@ -1,4 +1,4 @@
github: brandonskerritt
github: bee-san
patreon: brandonskerritt
ko_fi: hacker
custom: ["https://monzo.me/bee", "https://paypal.me/brandonskerritt"]
+4
View File
@@ -0,0 +1,4 @@
template: |
## What’s Changed
$CHANGES
+16 -16
View File
@@ -14,22 +14,22 @@ appearance, race, religion, or sexual identity and orientation.
Examples of behavior that contributes to creating a positive environment
include:
* Using welcoming and inclusive language
* Being respectful of differing viewpoints and experiences
* Gracefully accepting constructive criticism
* Focusing on what is best for the community
* Showing empathy towards other community members
- Using welcoming and inclusive language
- Being respectful of differing viewpoints and experiences
- Gracefully accepting constructive criticism
- Focusing on what is best for the community
- Showing empathy towards other community members
Examples of unacceptable behavior by participants include:
* The use of sexualized language or imagery and unwelcome sexual attention or
advances
* Trolling, insulting/derogatory comments, and personal or political attacks
* Public or private harassment
* Publishing others' private information, such as a physical or electronic
address, without explicit permission
* Other conduct which could reasonably be considered inappropriate in a
professional setting
- The use of sexualized language or imagery and unwelcome sexual attention or
advances
- Trolling, insulting/derogatory comments, and personal or political attacks
- Public or private harassment
- Publishing others' private information, such as a physical or electronic
address, without explicit permission
- Other conduct which could reasonably be considered inappropriate in a
professional setting
## Our Responsibilities
@@ -55,7 +55,7 @@ further defined and clarified by project maintainers.
## Enforcement
Instances of abusive, harassing, or otherwise unacceptable behavior may be
reported by contacting the project team at brandon@skerritt.blog. All
reported by contacting the project team at our discord via a private message to any of the owners. All
complaints will be reviewed and investigated and will result in a response that
is deemed necessary and appropriate to the circumstances. The project team is
obligated to maintain confidentiality with regard to the reporter of an incident.
@@ -67,10 +67,10 @@ members of the project's leadership.
## Attribution
This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4,
This Code of Conduct is adapted from the Contributor Covenant homepage, version 1.4,
available at https://www.contributor-covenant.org/version/1/4/code-of-conduct.html
[homepage]: https://www.contributor-covenant.org
homepage: https://www.contributor-covenant.org
For answers to common questions about this code of conduct, see
https://www.contributor-covenant.org/faq
Generated
+50
View File
@@ -208,6 +208,19 @@ version = "0.1.10"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "4785bdd1c96b2a846b2bd7cc02e86b6b3dbf14e7e53446c4f54c92a361040822"
[[package]]
name = "cidr-utils"
version = "0.5.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "89f7b6372f3c783f6d44c0da283d3694af4104967bf2371cb3bdc9d09e1cfe00"
dependencies = [
"debug-helper",
"num-bigint",
"num-traits",
"once_cell",
"regex",
]
[[package]]
name = "clap"
version = "2.33.2"
@@ -266,6 +279,12 @@ dependencies = [
"lazy_static",
]
[[package]]
name = "debug-helper"
version = "0.3.10"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "9a8a5bb894f24f42c247f19b25928a88e31867c0f84552c05df41a9dd527435e"
[[package]]
name = "dirs"
version = "3.0.1"
@@ -521,6 +540,36 @@ dependencies = [
"fastrand",
]
[[package]]
name = "num-bigint"
version = "0.3.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "b7f3fc75e3697059fb1bc465e3d8cca6cf92f56854f201158b3f9c77d5a3cfa0"
dependencies = [
"autocfg",
"num-integer",
"num-traits",
]
[[package]]
name = "num-integer"
version = "0.1.43"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "8d59457e662d541ba17869cf51cf177c0b5f0cbf476c66bdc90bf1edac4f875b"
dependencies = [
"autocfg",
"num-traits",
]
[[package]]
name = "num-traits"
version = "0.2.12"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "ac267bcc07f48ee5f8935ab0d24f316fb722d7a1292e2913f0cc196b29ffd611"
dependencies = [
"autocfg",
]
[[package]]
name = "num_cpus"
version = "1.13.0"
@@ -763,6 +812,7 @@ version = "1.8.0"
dependencies = [
"ansi_term 0.12.1",
"async-std",
"cidr-utils",
"colored",
"colorful",
"dirs",
+1
View File
@@ -33,6 +33,7 @@ ansi_term = "0.12.1"
toml = "0.5.6"
serde = "1.0.115"
serde_derive = "1.0.115"
cidr-utils = "0.5.0"
[package.metadata.deb]
depends = "$auto, nmap"
+17 -340
View File
@@ -8,12 +8,11 @@
<img src="pictures/rustscan.png" height=400px width=400px>
</p>
<p align="center">
<u><b> Turns a 17 minutes Nmap scan into 19 seconds. </b></u><br> Find all open ports <b>fast</b> with RustScan, automatically pipe them into Nmap.
<u><b> 👽 The Modern Day Port Scanner 👽
</p>
<p align="center">
<img alt="AUR version" src="https://img.shields.io/aur/version/rustscan">
<img src="https://img.shields.io/badge/Built%20with-Rust-Purple">
<img alt="GitHub commit activity" src="https://img.shields.io/github/commit-activity/w/brandonskerritt/rustscan">
<img alt="GitHub All Releases" src="https://img.shields.io/github/downloads/rustscan/rustscan/total?label=GitHub%20Downloads">
<img alt="Crates.io" src="https://img.shields.io/crates/d/rustscan?label=Cargo%20Downloads">
<img alt="Discord" src="https://img.shields.io/discord/736614461313515576">
@@ -21,49 +20,27 @@
</p>
<hr>
| <p align="center"><a href="https://hub.docker.com/r/cmnatic/rustscan">🐋 Docker (Recommended) </a></p> | <p align="center"><a href="https://github.com/RustScan/RustScan/releases">👩‍💻 Kali / Debian </p> | <p align="center"><a href="https://aur.archlinux.org/packages/rustscan/">🏗️ Arch </a></p> | <p align="center"><a href="https://crates.io/crates/rustscan">🔧 Cargo (Universal) </a></p> |
| ----------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------- |
| <p align="center"><img src="https://github.com/RustScan/RustScan/blob/master/pictures/docker.png?raw=true" /></p> | <p align="center"><img src="https://github.com/RustScan/RustScan/blob/master/pictures/kali.png?raw=true" /></p> | <p align="center"><img src="https://github.com/RustScan/RustScan/blob/master/pictures/arch.png?raw=true" /></p> | <p align="center"><img src="https://github.com/RustScan/RustScan/blob/master/pictures/rust.png?raw=true" /></p> |
| `docker pull rustscan/rustscan:alpine` <p>[Usage](https://github.com/RustScan/RustScan#docker-whale) | [Read the install guide](https://github.com/brandonskerritt/RustScan/blob/master/README.md#%EF%B8%8F-debian--kali) | `yay -S rustscan` | `cargo install rustscan` |
| <p align="center"><a href="https://hub.docker.com/r/cmnatic/rustscan">🐋 Docker (Recommended) </a></p> | <p align="center"><a href="https://github.com/RustScan/RustScan/releases">👩‍💻 Kali / Debian </p> | <p align="center"><a href="https://aur.archlinux.org/packages/rustscan/">🏗️ Arch </a></p> | <p align="center"><a href="https://crates.io/crates/rustscan">🔧 Cargo (Universal) </a></p> |
| ----------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------- |
| <p align="center"><img src="https://github.com/RustScan/RustScan/blob/master/pictures/docker.png?raw=true" /></p> | <p align="center"><img src="https://github.com/RustScan/RustScan/blob/master/pictures/kali.png?raw=true" /></p> | <p align="center"><img src="https://github.com/RustScan/RustScan/blob/master/pictures/arch.png?raw=true" /></p> | <p align="center"><img src="https://github.com/RustScan/RustScan/blob/master/pictures/rust.png?raw=true" /></p> |
| `docker pull rustscan/rustscan:alpine` <p>[Usage](https://github.com/RustScan/RustScan#docker-whale) | [Read the install guide](https://github.com/Rustscan/RustScan/blob/master/README.md#%EF%B8%8F-debian--kali) | `yay -S rustscan` | `cargo install rustscan` |
<hr>
# 🤔 What is this?
1. Find ports quickly using Rustscan (**3 seconds at its fastest**).
2. Automatically runs `nmap` on those ports.
3. ???
4. Profit!
RustScan is the port scanner for the modern world. Built with speed & you in mind.
<table>
<tr>
<th>Name</th>
<th>⚡ Nmap <b>with RustScan</b> ⚡ </th>
<th>🐢 Nmap 🐢</th>
</tr>
<tr>
<th>Gif</th>
<td><img src="https://github.com/RustScan/RustScan/blob/master/pictures/with_rustscan.gif?raw=true" alt="The guy she tells you not to worry about"></td>
<td><img src="https://github.com/RustScan/RustScan/blob/master/pictures/without_rustscan.gif?raw=true" alt="You"></td>
</tr>
<tr>
<th>Time</th>
<td><b>39 seconds</b></td>
<td><b>17 minutes and 41 seconds</b></td>
</tr>
</table>
![pictures](pictures/with_rustscan.gif)
<sub><b>Note</b> This is an older gif. RustScan's current top speed is 3 seconds for all 65k ports. This gif is 26 seconds.</sub><br>
RustScans **only** job is to reduce the friction between finding open ports and inputting them into nmap.
# ✨ Features
- Scans all 65k ports in **8 seconds** (on 10k batch size).
- Scans all 65k ports in **3 seconds** (max speed) **or as slow as you'd like**
- Saves you time by automatically piping it into Nmap. No more manual copying and pasting!
- Does one thing and does it well. **Only** purpose is to improve Nmap, not replace it!
- Let's you choose what Nmap commands to run, or uses the default.
- IPv6 Support
- Adaptive Learning System. The scanner learns how _you_ use it and improves itself over time.
- Intuitive Scripting Engine support. Write scripts in Python!
- IPv6, CIDR, top ports, multiple IP scanning, host resolution, and more!
## ‼️ Important Links
@@ -71,322 +48,21 @@ RustScans **only** job is to reduce the friction between finding open ports and
| -------------------------------------------------------------------------------------- | -------------------------------------------------------- | ---------------------------------------- |
| 📖 [Installation Guide](https://github.com/RustScan/RustScan#-full-installation-guide) | 📚 [Documentation](https://rustscan.github.io/RustScan/) | 🦜 [Discord](https://discord.gg/GFrQsGy) |
## 🙋 Table of Contents
- 📖 [Installation Guide](https://github.com/RustScan/RustScan#-full-installation-guide)
- 🐋 [Docker Usage](https://github.com/RustScan/RustScan#docker-whale)
- 🦜 [Discord](https://discord.gg/GFrQsGy)
- 🤸 [Usage](https://github.com/RustScan/RustScan#-usage)
- 🎪 [Community](https://github.com/RustScan/RustScan#-community)
# 🔭 Why RustScan?
Why spend time running fast scans and manually copying the ports, or waiting for a 20 minute scan to finish when you can just do all 65k ports in less than a minute?
RustScan is a port scanner built for the modern day world. Initially created to aid in CTFs, but now expanded to real world usage.
![gif](https://github.com/RustScan/RustScan/blob/master/pictures/8seconds.gif?raw=true)
One of RustScan's most popular features is the Nmap extension. Quickly scan ports with RustScan, run Nmap on the found ports.
**RustScan running in 8 seconds and finding all open ports out of 65k.**
## 📊 RustScan vs Nmap vs MassScan
![gif](https://github.com/RustScan/RustScan/blob/master/pictures/8seconds.gif?raw=true)
| **Name** | RustScan | Nmap | Masscan |
| ------------------------------------------------------------------------------------------ | -------- | ---- | ------- |
| Fast | ✅ | ❌ | ✅ |
| Actually useful | ❌ | ✅ | ❌ |
| Realises it's not useful, and pipes the only useful data into the only useful port scanner | ✅ | ❌ | ❌ |
# 📖 Full Installation Guide
**You need Nmap**. If you have Kali Linux or Parrot OS installed, you already have Nmap. If not, [follow the nmap install guide](https://nmap.org/download.html).
The easiest way to install RustScan is to use one of the packages provided for your system, such as HomeBrew or Yay for Arch Linux.
The most universal way is to use `cargo`, Rust's built in package manager (think Pip but for Rust). [Follow this guide to installing Rust & Cargo](https://doc.rust-lang.org/cargo/getting-started/installation.html).
If you face any issues at all, please leave a GitHub issue. I have only tested this on Linux, so there may be issues for Mac OS or Windows.
Note: sometimes Rust doesn't add Cargo to the path. Please see [this issue](https://github.com/rust-lang/rustup/issues/2436) for how to fix that.
## 🖥️ Debian / Kali
Download the .deb file from the releases page:
[https://github.com/brandonskerritt/RustScan/releases](https://github.com/brandonskerritt/RustScan/releases)
Run the commpand `dpkg -i` on the file.
Note: sometimes you can double click the file to achieve the same result.
## Docker :whale:
Docker is the recommended way of installing RustScan. This is because:
- It has a high open file descriptor limit, which is one of the [main problems](https://github.com/RustScan/RustScan/issues/40) with RustScan. Now you don't have to fiddle around trying to understand your OS.
- It works on all systems, regardless of OS. Even Windows, which we don't officially support.
- The Docker image uses the latest build from Cargo, our main source-of-truth package. This means that you will always be using the latest version.
- No need to install Rust, Cargo, or Nmap.
To install Docker, [follow their guide](https://docs.docker.com/engine/install/).
**Once Docker is installed, you can either build your own image using the `Dockerfile` (alpine) provided in the repo, or alternatively, use the published Docker image like below (most convenient)**
Please see our [DockerHub](https://hub.docker.com/repository/docker/rustscan/rustscan) for further info, however, note that we have two Docker images:
```
rustscan/rustscan:alpine
rustscan/rustscan:latest
```
We strongly recommend using the `alpine` tag, as this is the latest major - stable - release of RustScan. This READMDE uses the `alpine` image by default, however, note that the`latest` image is considered experimental.
#### To get started:
Simply run this command against the IP you want to target:
```bash
docker run -it --rm --name rustscan rustscan/rustscan:alpine <rustscan arguments here> <ip address to scan>
```
Note: this will scan the Docker's localhost, not your own.
Once done, you will no longer need to re-download the image (except when RustScan updates) and can use RustScan like a normal application.
You will have to run this command every time, so we suggest aliasing it to something memorable.
```bash
alias rustscan='docker run -it --rm --name rustscan rustscan/rustscan:alpine'
```
Then we can:
```bash
rustscan 127.0.0.1 -t 500 -b 1500 -- -A
```
#### To build your own image:
Download the repo:
```bash
git clone https://github.com/RustScan/RustScan.git
```
Ensure you navigate to the download location of the repo:
```bash
cd /path/to/download/RustScan
```
Build away!
```bash
docker build -t <yourimagename> .
```
## 🍺 HomeBrew
**Note for Mac users** Mac OS has a very, very small ulimit size. This will negatively impact RustScan by a significant amount. Please use the Docker container, or tell RustScan to up the ulimit size on every run.
Tap the brew:
```bash
brew tap brandonskerritt/rustscan
```
Install it:
```bash
brew install rustscan
```
## 🔧 Building it yourself
1. Git clone the repo.
2. Install Rust. You can do this with `curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh` which I took from the Rust website https://www.rust-lang.org/tools/install
3. cd into the Git repo, and run `cargo build --release`
4. The binary is located at `target/release/rustscan`
5. Symlink to the binary or something. Whatever you want!
## 🦊 Community Distributions
Here are all of RustScan's community distributions.
If you maintain a community distribution and want it listed here, leave an issue / pull request / Discord message or however you want to let us know.
- [OpenSuse](https://software.opensuse.org/package/rustscan?search_term=rustscan)
- [Fedora/CentOS](https://copr.fedorainfracloud.org/coprs/atim/rustscan/)
# Packages
[![Packaging status](https://repology.org/badge/vertical-allrepos/rustscan.svg)](https://repology.org/project/rustscan/versions)
# 🤸 Usage
```console
$ rustscan -h
Fast Port Scanner built in Rust. WARNING Do not use this program against sensitive infrastructure since the specified
server may not be able to handle this many socket connections at once. - Discord https://discord.gg/GFrQsGy - GitHub
https://github.com/RustScan/RustScan
USAGE:
rustscan [FLAGS] [OPTIONS] [ips-or-hosts]... [-- <command>...]
FLAGS:
--accessible Accessible mode. Turns off features which negatively affect screen readers
-h, --help Prints help information
-i, --ignore-config Whether to ignore the configuration file or not
-q, --quiet Quiet mode. Only output the ports. No Nmap. Useful for grep or outputting to a file
-V, --version Prints version information
OPTIONS:
-b, --batch-size <batch-size> The batch size for port scanning, it increases or slows the speed of scanning.
Depends on the open file limit of your OS. If you do 65535 it will do every port
at the same time. Although, your OS may not support this [default: 4500]
-p, --ports <ports>... A list of comma separed ports to be scanned. Example: 80,443,8080
-r, --range <range> A range of ports with format start-end. Example: 1-1000
--scan-order <scan-order> The order of scanning to be performed. The "serial" option will scan ports in
ascending order while the "random" option will scan ports randomly [default:
serial] [possible values: Serial, Random]
-t, --timeout <timeout> The timeout in milliseconds before a port is assumed to be closed [default: 1500]
-u, --ulimit <ulimit> Automatically ups the ULIMIT with the value you provided
ARGS:
<ips-or-hosts>... A list of comma separated IP addresses or hosts to be scanned
<command>... The Nmap arguments to run. To use the argument -A, end RustScan's args with '-- -A'.
Example: 'rustscan -T 1500 127.0.0.1 -- -A -sC'. This command adds -Pn -vvv -p $PORTS
automatically to nmap. For things like --script '(safe and vuln)' enclose it in quotations
marks \"'(safe and vuln)'\"")
```
The format is `rustscan -b 500 -T 1500 192.168.0.1` to scan 192.168.0.1 with 500 batch size with a timeout of 1500ms. The timeout is how long RustScan waits for a response until it assumes the port is closed.
The batch size determines how fast RustScan is. Set it to 65k, and it will scan all 65k ports at the same time. This means at at 65k batch size, RustScan will take TIMEOUT long to scan all ports. Essentially, if timeout is 1000ms, **RustScan can scan in 1 second**.
Your operating system may not support this, but it is worth it to play around and see where your open file limit is. Shortly I will be releasing a dockerised version with a much larger open file limit, so this will be possible.
## Configuration file
This binary accepts a configuration file that is read from the home directory of the user. It follows the TOML format
and accepts the following fields:
- `ips_or_hosts`
- `ports`
- `range`
- `scan_order`
- `command`
- `accessible`
- `quiet`
- `batch-size`
- `timeout`
- `ulimit`
### Format example
```toml
ips_or_hosts = ["127.0.0.1", "192.168.0.1", "www.google.com"]
command = ["-A"]
ports = [80, 443, 8080]
range = { start = 1, end = 10 }
quiet = false
accessible = true
scan_order = "Serial"
batch_size = 1000
timeout = 1000
ulimit = 1000
```
## ⚠️ WARNING
This program, by default, scans 5000 ports at a time (5000 per second).
This may cause damage to a server, or may make it incredibly obvious you are scanning the server.
There are 2 ways to deal with this;
1. Decrease batch size
`rustscan -b 10` will run 10 port scans for 1 second, and then another 10 for 1 second and so on.
2. Increase timeout
`rustscan -T 5000` will mean RustScan waits 5 seconds until it scans the next ports.
You can also use both of these at the same time, to make it as slow or as fast as you want. A fun favourite is 65535 batch size with 1 second timeout. Theoretically, this scans all 65535 ports in 1 second.
**Please** do not use this tool against sensitive servers. It is designed mainly for Capture the Flag events, not real world servers with sensitive data.
## 🚨 Thread Panicked at Main: Too Many Open Files
This is the most common error found in RustScan.
The open file limit is how many open sockets you can have at any given time.
This limit changes from OS to OS.
RustScan does not automatically create defaults (other than 5000) like Nmap does with their -T1, -T2 system.
By figuring out for yourself the optimal batch size, you will know that RustScan is the most optimised port scanner for your system.
There are 2 things you can do:
1. Decrease batch size
2. Increase open file limit
Decreasing batch size slows down the program, so as long as it isn't too drastic, this is a good option.
Run these 3 commands:
```bash
ulimit -a
ulimit -Hn
ulimit -Sn
```
They will give you an idea on the open file limit of your OS.
If it says "250", run `rustscan -b 240` for a batch size of 240.
Increasing the open file limit increases speed, but poses danger. Although, **opening more file sockets on the specified IP address may damage it**.
To open more, set the ulimit to a higher number:
```bash
ulimit -n 5000
```
**Mac OS**
Mac OS has, from what I can tell, a naturally very low open file descriptor limit. The limit for Ubuntu is 8800. The limit for Mac OS is 255!
In this case, I would say it is safe to increase the open file limit. As most Linux based OS' have limits in the thousands.
Although, if this breaks anything, please don't blame me.
**Windows Subsystem for Linux**
Windows Subsystem for Linux does not support ulimit (see issue #39).
The best way is to use it on a host computer, in Docker, or in a VM that isn't WSL.
**Automatic Ulimit updating**
We are currently working on automatic Ulimit updating. If it is too high, it will lower itself. If it is too low, it will suggest a higher Ulimit. Watch [this issue](https://github.com/brandonskerritt/RustScan/issues/25) for more.
## 🔌 Nmap Custom Flags
To run your own nmap commands, end the RustScan command with `-- -A` where `--` indicates "end of RustScan flags, please do not parse anything further" and any flags after that will be entered into nmap.
RustScan automatically runs `nmap -vvv -p $PORTS $IP`. To make it run `-A`, execute the command `rustscan 127.0.0.1 -- -A`.
If you want to run commands such as `--script (vuln and safe)`, you will need to enclose it in quotations like so `--script '"(vuln and safe) or default"'`.
## 🎯 Increasing speed / accuracy
- Batch size
This increases speed, by allowing us to process more at once. Something experimental I am working on is changing the open file limit. You can do this manually with `ulimit -n 70000` and then running rustscan with `-b 65535`. This _should_ scan all 65535 ports at the exact same time. But this is extremely experimental.
For non-experimental speed increases, slowly increase the batch size until it no longer gets open ports, or it breaks.
- Accuracy (and some speed)
To increase accuracy, the easiest way is to increase the timeout. The default is 1.5 seconds, by setting it to 4 seconds (4000) we are telling RustScan "if we do not hear back from a port in 4 seconds, assume it is closed".
Decreasing accuracy gives some speed bonus, but my testing found that batch size dramatically changed the speed whereas timeout did, but not so much.
# 🎪 Community
@@ -433,7 +109,7 @@ Please read the [contributing.md file](contributing.md)
<!-- ALL-CONTRIBUTORS-BADGE:START - Do not remove or modify this section -->
[![All Contributors](https://img.shields.io/badge/all_contributors-17-orange.svg?style=flat-square)](#contributors-)
[![All Contributors](https://img.shields.io/badge/all_contributors-18-orange.svg?style=flat-square)](#contributors-)
<!-- ALL-CONTRIBUTORS-BADGE:END -->
@@ -465,6 +141,7 @@ Thanks goes to these wonderful people ([emoji key](https://allcontributors.org/d
<td align="center"><a href="https://swag.lgbt"><img src="https://avatars2.githubusercontent.com/u/25358963?v=4" width="100px;" alt=""/><br /><sub><b>Cass</b></sub></a><br /><a href="#platform-caass" title="Packaging/porting to new platform">📦</a> <a href="https://github.com/RustScan/RustScan/commits?author=caass" title="Code">💻</a> <a href="https://github.com/RustScan/RustScan/issues?q=author%3Acaass" title="Bug reports">🐛</a></td>
<td align="center"><a href="https://github.com/niklasmohrin"><img src="https://avatars0.githubusercontent.com/u/47574893?v=4" width="100px;" alt=""/><br /><sub><b>Niklas Mohrin</b></sub></a><br /><a href="https://github.com/RustScan/RustScan/commits?author=niklasmohrin" title="Documentation">📖</a></td>
<td align="center"><a href="https://liberapay.com/Artem4/"><img src="https://avatars0.githubusercontent.com/u/5614476?v=4" width="100px;" alt=""/><br /><sub><b>Artem Polishchuk</b></sub></a><br /><a href="#platform-tim77" title="Packaging/porting to new platform">📦</a></td>
<td align="center"><a href="https://github.com/buermarc"><img src="https://avatars2.githubusercontent.com/u/44375277?v=4" width="100px;" alt=""/><br /><sub><b>buermarc</b></sub></a><br /><a href="https://github.com/RustScan/RustScan/commits?author=buermarc" title="Code">💻</a></td>
</tr>
</table>
+55 -35
View File
@@ -54,9 +54,9 @@ fn parse_range(input: &str) -> Result<PortRange, String> {
/// - Discord https://discord.gg/GFrQsGy
/// - GitHub https://github.com/RustScan/RustScan
pub struct Opts {
/// A list of comma separated IP addresses or hosts to be scanned.
/// A list of comma separated CIDRs, IPs, or hosts to be scanned.
#[structopt(use_delimiter = true)]
pub ips_or_hosts: Vec<String>,
pub addresses: Vec<String>,
/// A list of comma separed ports to be scanned. Example: 80,443,8080.
#[structopt(short, long, use_delimiter = true)]
@@ -68,7 +68,7 @@ pub struct Opts {
/// Whether to ignore the configuration file or not.
#[structopt(short, long)]
pub ignore_config: bool,
pub no_config: bool,
/// Quiet mode. Only output the ports. No Nmap. Useful for grep or outputting to a file.
#[structopt(short, long)]
@@ -78,6 +78,10 @@ pub struct Opts {
#[structopt(long)]
pub accessible: bool,
/// Turns off Nmap.
#[structopt(long)]
pub no_nmap: bool,
/// The batch size for port scanning, it increases or slows the speed of
/// scanning. Depends on the open file limit of your OS. If you do 65535
/// it will do every port at the same time. Although, your OS may not
@@ -125,7 +129,7 @@ impl Opts {
/// Reads the command line arguments into an Opts struct and merge
/// values found within the user configuration file.
pub fn merge(&mut self, config: &Config) {
if !self.ignore_config {
if !self.no_config {
self.merge_required(&config);
self.merge_optional(&config);
}
@@ -142,15 +146,7 @@ impl Opts {
}
}
merge_required!(
ips_or_hosts,
quiet,
accessible,
batch_size,
timeout,
scan_order,
command
);
merge_required!(addresses, quiet, accessible, batch_size, timeout, scan_order, command);
}
fn merge_optional(&mut self, config: &Config) {
@@ -173,13 +169,14 @@ impl Opts {
/// generate the final Opts struct.
#[derive(Debug, Deserialize)]
pub struct Config {
ips_or_hosts: Option<Vec<String>>,
addresses: Option<Vec<String>>,
ports: Option<Vec<u16>>,
range: Option<PortRange>,
quiet: Option<bool>,
accessible: Option<bool>,
batch_size: Option<u16>,
timeout: Option<u32>,
no_nmap: Option<bool>,
ulimit: Option<rlimit::rlim>,
scan_order: Option<ScanOrder>,
command: Option<Vec<String>>,
@@ -191,29 +188,46 @@ impl Config {
///
/// # Format
///
/// ips_or_hosts = ["127.0.0.1", "127.0.0.1"]
/// addresses = ["127.0.0.1", "127.0.0.1"]
/// ports = [80, 443, 8080]
/// quiet = true
/// scan_order: "Serial"
///
pub fn read() -> Self {
let path = match dirs::home_dir() {
let mut paths = Vec::new();
paths.push(match dirs::home_dir() {
Some(mut path) => {
path.push(".rustscan.toml");
path
}
None => panic!("Could not infer config file path."),
};
});
let contents = match fs::read_to_string(&path) {
Ok(content) => content,
Err(_) => {
println!("Could not find configation file at {:?}", &path);
String::new()
paths.push(match dirs::config_dir() {
Some(mut path) => {
path.push("rustscan");
path.push("config.toml");
path
}
};
None => panic!("Could not infer config file path."),
});
let config: Config = match toml::from_str(&contents) {
let mut contents: Option<String> = None;
for path in paths.iter().rev() {
contents = match fs::read_to_string(path) {
Ok(content) => {
contents = Some(content);
break;
}
Err(_) => None,
};
}
if contents.is_none() {
contents = Some(String::new());
}
let config: Config = match toml::from_str(&contents.unwrap()) {
Ok(config) => config,
Err(e) => {
println!("Found {} in configuration file.\nAborting scan.\n", e);
@@ -232,7 +246,7 @@ mod tests {
#[test]
fn opts_no_merge_when_config_is_ignored() {
let mut opts = Opts {
ips_or_hosts: vec![],
addresses: vec![],
ports: None,
range: None,
quiet: false,
@@ -241,18 +255,20 @@ mod tests {
ulimit: None,
command: vec![],
accessible: false,
no_nmap: false,
scan_order: ScanOrder::Serial,
ignore_config: true,
no_config: true,
};
let config = Config {
ips_or_hosts: Some(vec!["127.0.0.1".to_owned()]),
addresses: Some(vec!["127.0.0.1".to_owned()]),
ports: None,
range: None,
quiet: Some(true),
batch_size: Some(25_000),
timeout: Some(1_000),
ulimit: None,
no_nmap: Some(false),
command: Some(vec!["-A".to_owned()]),
accessible: Some(true),
scan_order: Some(ScanOrder::Random),
@@ -260,7 +276,7 @@ mod tests {
opts.merge(&config);
assert_eq!(opts.ips_or_hosts, vec![] as Vec<String>);
assert_eq!(opts.addresses, vec![] as Vec<String>);
assert_eq!(opts.quiet, false);
assert_eq!(opts.accessible, false);
assert_eq!(opts.timeout, 0);
@@ -271,7 +287,7 @@ mod tests {
#[test]
fn opts_merge_required_arguments() {
let mut opts = Opts {
ips_or_hosts: vec![],
addresses: vec![],
ports: None,
range: None,
quiet: false,
@@ -281,12 +297,14 @@ mod tests {
command: vec![],
accessible: false,
scan_order: ScanOrder::Serial,
ignore_config: false,
no_nmap: false,
no_config: false,
};
let config = Config {
ips_or_hosts: Some(vec!["127.0.0.1".to_owned()]),
addresses: Some(vec!["127.0.0.1".to_owned()]),
ports: None,
no_nmap: Some(false),
range: None,
quiet: Some(true),
batch_size: Some(25_000),
@@ -299,7 +317,7 @@ mod tests {
opts.merge_required(&config);
assert_eq!(opts.ips_or_hosts, config.ips_or_hosts.unwrap());
assert_eq!(opts.addresses, config.addresses.unwrap());
assert_eq!(opts.quiet, config.quiet.unwrap());
assert_eq!(opts.timeout, config.timeout.unwrap());
assert_eq!(opts.command, config.command.unwrap());
@@ -310,7 +328,7 @@ mod tests {
#[test]
fn opts_merge_optional_arguments() {
let mut opts = Opts {
ips_or_hosts: vec![],
addresses: vec![],
ports: None,
range: None,
quiet: false,
@@ -320,11 +338,12 @@ mod tests {
command: vec![],
accessible: false,
scan_order: ScanOrder::Serial,
ignore_config: false,
no_nmap: false,
no_config: false,
};
let config = Config {
ips_or_hosts: None,
addresses: None,
ports: Some(vec![80, 403]),
range: Some(PortRange {
start: 1,
@@ -333,6 +352,7 @@ mod tests {
quiet: None,
batch_size: None,
timeout: None,
no_nmap: Some(false),
ulimit: Some(1_000),
command: None,
accessible: None,
+73 -33
View File
@@ -11,16 +11,15 @@ use scanner::Scanner;
mod port_strategy;
use port_strategy::PortStrategy;
use cidr_utils::cidr::IpCidr;
use colorful::Color;
use colorful::Colorful;
use futures::executor::block_on;
use rlimit::Resource;
use rlimit::{getrlimit, setrlimit};
use std::collections::HashMap;
use std::net::ToSocketAddrs;
use std::process::Command;
use std::str::FromStr;
use std::{net::IpAddr, time::Duration};
extern crate colorful;
@@ -51,7 +50,7 @@ fn main() {
print_opening();
}
let ips: Vec<IpAddr> = parse_ips(&opts);
let ips: Vec<IpAddr> = parse_addresses(&opts);
if ips.is_empty() {
warning!("No IPs could be resolved, aborting scan.", false);
@@ -183,12 +182,12 @@ fn build_nmap_arguments<'a>(
arguments
}
fn parse_ips(opts: &Opts) -> Vec<IpAddr> {
fn parse_addresses(opts: &Opts) -> Vec<IpAddr> {
let mut ips: Vec<IpAddr> = Vec::new();
for ip_or_host in &opts.ips_or_hosts {
match IpAddr::from_str(ip_or_host) {
Ok(ip) => ips.push(ip),
for ip_or_host in &opts.addresses {
match IpCidr::from_str(ip_or_host) {
Ok(cidr) => cidr.iter().for_each(|ip| ips.push(ip)),
_ => match format!("{}:{}", &ip_or_host, 80).to_socket_addrs() {
Ok(mut iter) => ips.push(iter.nth(0).unwrap().ip()),
_ => {
@@ -262,12 +261,15 @@ fn infer_batch_size(opts: &Opts, ulimit: rlimit::rlim) -> u16 {
#[cfg(test)]
mod tests {
use crate::{adjust_ulimit_size, infer_batch_size, parse_ips, print_opening, Opts, ScanOrder};
use crate::{
adjust_ulimit_size, infer_batch_size, parse_addresses, print_opening, Opts, ScanOrder,
};
use std::net::Ipv4Addr;
#[test]
fn batch_size_lowered() {
let opts = Opts {
ips_or_hosts: vec!["127.0.0.1".to_owned()],
addresses: vec!["127.0.0.1".to_owned()],
ports: None,
range: None,
quiet: true,
@@ -277,7 +279,8 @@ mod tests {
command: Vec::new(),
accessible: false,
scan_order: ScanOrder::Serial,
ignore_config: false,
no_config: false,
no_nmap: false,
};
let batch_size = infer_batch_size(&opts, 120);
@@ -287,7 +290,7 @@ mod tests {
#[test]
fn batch_size_lowered_average_size() {
let opts = Opts {
ips_or_hosts: vec!["127.0.0.1".to_owned()],
addresses: vec!["127.0.0.1".to_owned()],
ports: None,
range: None,
quiet: true,
@@ -297,7 +300,8 @@ mod tests {
command: Vec::new(),
accessible: false,
scan_order: ScanOrder::Serial,
ignore_config: false,
no_config: false,
no_nmap: false,
};
let batch_size = infer_batch_size(&opts, 9_000);
@@ -308,7 +312,7 @@ mod tests {
// because ulimit and batch size are same size, batch size is lowered
// to ULIMIT - 100
let opts = Opts {
ips_or_hosts: vec!["127.0.0.1".to_owned()],
addresses: vec!["127.0.0.1".to_owned()],
ports: None,
range: None,
quiet: true,
@@ -318,7 +322,8 @@ mod tests {
command: Vec::new(),
accessible: false,
scan_order: ScanOrder::Serial,
ignore_config: false,
no_config: false,
no_nmap: false,
};
let batch_size = infer_batch_size(&opts, 5_000);
@@ -328,7 +333,7 @@ mod tests {
fn batch_size_adjusted_2000() {
// ulimit == batch_size
let opts = Opts {
ips_or_hosts: vec!["127.0.0.1".to_owned()],
addresses: vec!["127.0.0.1".to_owned()],
ports: None,
range: None,
quiet: true,
@@ -338,7 +343,8 @@ mod tests {
command: Vec::new(),
accessible: false,
scan_order: ScanOrder::Serial,
ignore_config: false,
no_config: false,
no_nmap: false,
};
let batch_size = adjust_ulimit_size(&opts);
@@ -353,7 +359,7 @@ mod tests {
#[test]
fn test_high_ulimit_no_quiet_mode() {
let opts = Opts {
ips_or_hosts: vec!["127.0.0.1".to_owned()],
addresses: vec!["127.0.0.1".to_owned()],
ports: None,
range: None,
quiet: false,
@@ -363,7 +369,8 @@ mod tests {
command: Vec::new(),
accessible: true,
scan_order: ScanOrder::Serial,
ignore_config: false,
no_config: false,
no_nmap: false,
};
infer_batch_size(&opts, 1_000_000);
@@ -372,9 +379,9 @@ mod tests {
}
#[test]
fn parse_correct_ips_or_hosts() {
fn parse_correct_addresses() {
let opts = Opts {
ips_or_hosts: vec!["127.0.0.1".to_owned(), "google.com".to_owned()],
addresses: vec!["127.0.0.1".to_owned(), "192.168.0.0/30".to_owned()],
ports: None,
range: None,
quiet: true,
@@ -384,17 +391,27 @@ mod tests {
command: Vec::new(),
accessible: false,
scan_order: ScanOrder::Serial,
ignore_config: false,
no_config: false,
no_nmap: false,
};
let ips = parse_ips(&opts);
let ips = parse_addresses(&opts);
assert_eq!(2, ips.len());
assert_eq!(
ips,
[
Ipv4Addr::new(127, 0, 0, 1),
Ipv4Addr::new(192, 168, 0, 0),
Ipv4Addr::new(192, 168, 0, 1),
Ipv4Addr::new(192, 168, 0, 2),
Ipv4Addr::new(192, 168, 0, 3)
]
);
}
#[test]
fn parse_correct_and_incorrect_ips_or_hosts() {
fn parse_correct_host_addresses() {
let opts = Opts {
ips_or_hosts: vec!["127.0.0.1".to_owned(), "im_wrong".to_owned()],
addresses: vec!["google.com".to_owned()],
ports: None,
range: None,
quiet: true,
@@ -404,17 +421,18 @@ mod tests {
command: Vec::new(),
accessible: false,
scan_order: ScanOrder::Serial,
ignore_config: false,
no_config: false,
no_nmap: false,
};
let ips = parse_ips(&opts);
let ips = parse_addresses(&opts);
assert_eq!(1, ips.len());
assert_eq!(ips.len(), 1);
}
#[test]
fn parse_incorrect_ips_or_hosts() {
fn parse_correct_and_incorrect_addresses() {
let opts = Opts {
ips_or_hosts: vec!["im_wrong".to_owned(), "300.10.1.1".to_owned()],
addresses: vec!["127.0.0.1".to_owned(), "im_wrong".to_owned()],
ports: None,
range: None,
quiet: true,
@@ -424,10 +442,32 @@ mod tests {
command: Vec::new(),
accessible: false,
scan_order: ScanOrder::Serial,
ignore_config: false,
no_config: false,
no_nmap: false,
};
let ips = parse_ips(&opts);
let ips = parse_addresses(&opts);
assert_eq!(0, ips.len());
assert_eq!(ips, [Ipv4Addr::new(127, 0, 0, 1),]);
}
#[test]
fn parse_incorrect_addresses() {
let opts = Opts {
addresses: vec!["im_wrong".to_owned(), "300.10.1.1".to_owned()],
ports: None,
range: None,
quiet: true,
batch_size: 10,
timeout: 1_000,
ulimit: Some(2_000),
command: Vec::new(),
accessible: false,
scan_order: ScanOrder::Serial,
no_config: false,
no_nmap: false,
};
let ips = parse_addresses(&opts);
assert_eq!(ips.is_empty(), true);
}
}