Masscan Banner Grabbing on Common Web Ports with JSON Output

Masscan's --banners flag changes its mode of operation fundamentally: instead of fire-and-forget SYN probes, it completes the TCP three-way handshake and, for certain ports, sends protocol-specific probes to elicit a response. For HTTP ports (80, 8080, 8000), masscan sends a minimal GET request and captures the Server header; for HTTPS it initiates a TLS ClientHello and captures the certificate; for FTP/SMTP it reads the greeting banner. Output as JSON via -oJ gives you structured records with ip, ports, and service data, which is trivially ingested by jq, Elasticsearch, or a SIEM. Internally, masscan keeps a per-connection state machine for banner scans, which is why the achievable rate drops by 1-2 orders of magnitude compared to stateless SYN scanning.

Production use cases include building an asset inventory for internet-facing web services, detecting outdated Server headers (e.g., Apache/2.2) that indicate unpatched systems, and populating a CMDB with TLS certificate CN/SAN data to identify shadow IT. Threat intelligence teams scan known-bad IP ranges and use banner data to cluster infrastructure. Bug bounty hunters run this against in-scope ranges to spot admin panels (Server: nginx + WWW-Authenticate) before deeper testing.

Key pitfalls: banner grabbing is noisy and will appear in target logs as full TCP connections, unlike SYN scans which are often invisible. Some WAFs will rate-limit or block you after a few hundred probes, so reduce --rate significantly (e.g., 500-2000 pps). The --banners output is not always a valid TLS handshake for ports that are not actually HTTPS; masscan may show garbage for non-HTTP services. Also, masscan's banner parser is minimal; do not treat it as a replacement for nmap -sV or testssl.sh. Finally, JSON output can grow large; rotate logs and ship to cold storage.

> System.Execute()

sudo masscan 203.0.113.0/24 -p80,443,8080,8443,8000,8888 --banners --rate 1500 --open-only -oJ /var/log/masscan/banners.json && jq -r '.ip + " " + (.ports[0].port|tostring) + " " + (.ports[0].service.name // "unknown") + " " + (.ports[0].service.banner // "")' /var/log/masscan/banners.json | head -50

> Architecture & Security Context

Verified for Valters IT Hub. When deploying this configuration in a production homelab or enterprise environment, ensure that you monitor system resources and implement strict access controls. Administrator privileges are required.

ID: VALTERSIT-14B1B5309B78