port-mass-scan

Scan single hosts and large IP ranges using RustScan, Masscan, and Nmap.

1.1k|191|Updated Jun 24, 2026
One-click install
npx skills add https://github.com/uphiago/recon-skills --skill port-mass-scan
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: port-mass-scan
Source: https://github.com/uphiago/recon-skills/tree/main/recon/port-mass-scan
Command: npx skills add https://github.com/uphiago/recon-skills --skill port-mass-scan

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Traditional port scanning tools like Nmap are prohibitively slow for large IP ranges (/8-/24) and full single-host port scans can take 5-10 minutes, creating bottlenecks in reconnaissance and penetration testing workflows.

Core Features & Use Cases

  • High-speed single host scanning: RustScan delivers 400x faster 1000-port scans than Nmap (3-10 seconds vs 5-10 minutes) for quick initial port discovery.
  • Large range scanning: Masscan handles /8 and /16 IP ranges that Nmap cannot process in reasonable timeframes, enabling ISP and government network-scale reconnaissance.
  • Service identification: Integrated banner grabbing and Nmap pass-through deliver accurate service version detection for discovered open ports.
  • Use Case: For a client pentest engagement, scan a /24 client subnet in 2-5 minutes to map all active services, or quickly enumerate all 65535 ports on a single high-value target in under 10 seconds before deeper service testing.

Quick Start

Use the port-mass-scan skill to run a high-speed full port scan on a target IP and get a list of all open ports with associated service versions.

Frequently Asked Questions about port-mass-scan

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan all 65535 ports on a single host faster than Nmap?

Full single-host port scanning uses RustScan to discover open ports in 3-10 seconds instead of the 5-10 minutes Nmap requires. This rapid port scanning delivers quick initial discovery before deeper service testing begins.

What is the best way to port scan a large /24 or /16 IP range for penetration testing?

Large IP range port scanning across /8 to /24 subnets uses Masscan to overcome Nmap's performance limits. It maps active services on ISP or government network scales within 2-5 minutes for a /24 client subnet.

How does port scanning integrate with Nmap for service version enumeration?

After high-speed port discovery via RustScan or Masscan, the workflow passes open ports to Nmap. Nmap performs accurate banner grabbing and service version detection for discovered TCP services.

Can I use fast port scanning for IoT device hunting and subdomain enumeration?

High-speed port scanning applies directly to IoT device hunting and post-subdomain enumeration. It discovers non-HTTP TCP services and expands the attack surface after initial web assessments.

Why does traditional Nmap port scanning create bottlenecks during reconnaissance?

Traditional Nmap port scanning is prohibitively slow for large IP ranges and full single-host scans. This creates reconnaissance bottlenecks that high-speed scanning overcomes by integrating RustScan and Masscan.

Does this port scanning approach work for both single hosts and large network ranges?

Port scanning supports both single hosts and large IP ranges from /8 to /24. RustScan handles rapid single-host discovery while Masscan enables network-scale reconnaissance across massive subnets.