Home

Welcome to the xmap wiki! XMap: A Fast IPv6 & IPv4 Network Scanner XMap is a fast network scanner designed for performing Internet-wide IPv6 & IPv4 network research scanning.

XMap is reimplemented and improved thoroughly from ZMap and is fully compatible with ZMap, armed with the "5 minutes" probing speed and novel scanning techniques. XMap is capable of scanning the 32-bits address space in under 45 minutes. With a 10 gigE connection and PF_RING, XMap can scan the 32-bits address space in under 5 minutes. Moreover, leveraging the novel IPv6 scanning approach, XMap can discover the IPv6 Network Periphery fast. Furthermore, XMap can scan the network space randomly with any length and at any position, such as 2001:db8::/32-64 and 192.168.0.1/16-20. Besides, XMap can probe multiple ports simultaneously.

XMap operates on GNU/Linux, macOS, and BSD. XMap currently has implemented probe modules for ICMP Echo scans, TCP SYN scans, UDP probes, and DNS scans (stateless, stateful, or address-spoofing).

With banner grab and TLS handshake tool, ZGrab2, more involved scans could be performed.

By default, XMap will perform an ICMP Echo scan on the specified IPv6 or IPv4 address space at the maximum rate possible. A more conservative configuration that will scan 10,000 random addresses on port 80 at a maximum 10 Mbps can be run as follows:

xmap --bandwidth=10M --target-port=80 --max-targets=10000 --output-file=results.csv Or more concisely:

xmap -B 10M -p 80 -n 10000 -o results.csv Due to the default value of the parameter -x(--max-len=len) being 32, the default scanning range of XMap is ::/0-32.However, XMap can also scan specific subnets or CIDR blocks. For example, to perform an ICMP Echo scan only on the 2001:db8::/32, you would run:

xmap -x 128 2001:db8::/32 If you want to scan only 10.0.0.0/8, you need to explicitly declare it with -4:

xmap -4 10.0.0.0/8 In order to scan the network space randomly with any length and at any position, such as 2001:db8::/32-64 and 192.168.0.1/16-20, you would run:

xmap -x 64 2001:db8::/32 xmap -4 -x 20 192.168.0.1/16 You can also perform a TCP SYN scan on the specified IPv6 or IPv4 address space on TCP/80 using -M:

xmap -M tcp_syn -p 80 In addition, XMap can be used to scan multiple ports or ranges of ports. For example,

xmap -M tcp_syn -p 80,443,445-447,500-502 If the scan started successfully, XMap will output real-time status updates:

0:05 0% (2d09h left); send: 104117 20.9 Kp/s 14.97 Mb/s (20.7 Kp/s 14.87 Mb/s avg); recv: 156 35 p/s (31 p/s avg); drops: 0 p/s (0 p/s avg); hitrate: 0.15% 0:06 0% (2d09h left); send: 125126 21.0 Kp/s 15.06 Mb/s (20.8 Kp/s 14.90 Mb/s avg); recv: 197 41 p/s (32 p/s avg); drops: 0 p/s (0 p/s avg); hitrate: 0.16% 0:07 0% (2d09h left); send: 146065 20.9 Kp/s 15.01 Mb/s (20.8 Kp/s 14.92 Mb/s avg); recv: 243 46 p/s (34 p/s avg); drops: 0 p/s (0 p/s avg); hitrate: 0.17% 0:08 0% (2d09h left); send: 166973 20.9 Kp/s 14.99 Mb/s (20.8 Kp/s 14.93 Mb/s avg); recv: 288 45 p/s (35 p/s avg); drops: 0 p/s (0 p/s avg); hitrate: 0.17% 0:09 0% (2d09h left); send: 187892 20.9 Kp/s 15.00 Mb/s (20.8 Kp/s 14.93 Mb/s avg); recv: 337 49 p/s (37 p/s avg); drops: 0 p/s (0 p/s avg); hitrate: 0.18% 0:10 0% (2d09h left); send: 208809 20.9 Kp/s 15.00 Mb/s (20.8 Kp/s 14.94 Mb/s avg); recv: 388 51 p/s (38 p/s avg); drops: 0 p/s (0 p/s avg); hitrate: 0.19% These updates provide information about the current state of the scan and are of the following form:

<%-complete> (); send: ( ); recv: (); drops: (); hitrate: ⚠️ Warning! If you do not know the scan rate that your network can support, you should experiment with different scan rates or bandwidth limits to find the fastest rate that your network can support before you see decreased results.

By default, XMap will output the list of distinct IP addresses that responded successfully (e.g., with an ICMP Echo Reply or TCP SYN ACK packet) similar to the following (take IPv6 as an example). There are several additional formats (e.g., CSV and JSON) for outputting results. Additional output fields can be specified, and the results can be filtered using an output filter. [more information]

2001:db8::1 240e:30e:3d23::55d 2001:db8::2 240e:30e:3d23::55e 2001:db8::3 We strongly encourage you to use a blacklist file to exclude both reserved/unallocated IP space (e.g., multicast, RFC 1918), as well as networks that request to be excluded from your scans. By default, XMap will utilize a simple blacklist file containing reserved and unallocated addresses located at /etc/xmap/blacklist4.conf. [more information]

If you find yourself specifying certain settings, such as your maximum bandwidth or blacklist file every time you run XMap, you can specify these in /etc/xmap/xmap.conf or use a custom configuration file.

If you are attempting to troubleshoot scan-related issues, there are several options to help debug. First, it is possible to perform a dry run scan to see the packets that would be sent over the network by adding the --dryrun flag. Additionally, you can change the logging verbosity by setting the --verbosity=num flag.

After reading the above content, I believe you now have a preliminary understanding of XMap. If a more detailed beginner's guide is needed, please check out the Getting Started Guide.

Using the command xmap --help (or more concisely, xmap -h ), you can see a brief introduction to the basic arguments as follows:

Basic arguments:
  -6, --ipv6                    Scanning the IPv6 networks (default)
  -4, --ipv4                    Scanning the IPv4 networks
  -x, --max-len=len             Max IP bit length to scan  (default=`32')
  -p, --target-port=port|range  Port(s) number to scan (for TCP and UDP scans),
                                  use `,' and `-', with this option, one target
                                  is a <ip/x, port>
  -P, --target-index=num        Payload number to scan, with this option, one
                                  target is a <ip/x, (port), index>
                                  (default=`0')
  -o, --output-file=name        Output file, use `-' for stdout
  -b, --blacklist-file=path     File of subnets to exclude, in CIDR notation,
                                  e.g., 2001::/64, 192.168.0.0/16,
                                  www.qq.com/32 (max len of domain: 256)
  -w, --whitelist-file=path     File of subnets to include, in CIDR notation,
                                  e.g., 2001::/64, 192.168.0.0/16,
                                  www.qq.com/32 (max len of domain: 256)
  -I, --list-of-ips-file=path   List of individual addresses to scan in random
                                  order, e.g., 2001:db8::1, 192.168.0.1

Network Type Selection

• -6, --ipv6: Scan IPv6 networks (enabled by default).
• -4, --ipv4: Scan IPv4 networks.

Note: By default, XMap scans the IPv6 networks. If you need to scan IPv4 networks, you must explicitly specify it using xmap -4. -6 and -4 are mutually exclusive, which means scanning IPv4 and IPv6 networks cannot be performed simultaneously.

Scan Range Configuration

• -x, --max-len=len: Set the maximum IP bit length to scan (default = 32).
• ip|domain|range: Specify the IP addresses, DNS hostnames, or IP ranges to scan (supports CIDR block notation).
  Examples:
  • 2001::1 (IPv6 address)
  • 192.168.0.1 (IPv4 address)
  • 2001::/64 (IPv6 CIDR block)
  • 192.168.0.1/16 (IPv4 CIDR block)
  • www.qq.com (domain name)
  • Default values: ::/0 (IPv6) and 0.0.0.0/0 (IPv4).

Examples

1. Scan the IPv6 address space (::/0-32) :

   xmap

2. Scan the entire IPv4 address space (0.0.0.0/0-32) :

   xmap -4

3. Scan both 2001::/8 and 2002::/16 subnets for their respective address spaces (2001::/8-32 and 2002::/16-32) :

   xmap 2001::/8 2002::/16

4. Scan the 2001::/32-64 address space :

   xmap -x 64 2001::/32

Target Port Configuration

• -p, --target-port=port|range: Specify the TCP or UDP port(s) to scan (for SYN scans and basic UDP scans). Supports port ranges using , and -.
  Examples:
  • 80,443
  • 8080-8081
  • 80,8080-8081
• -P, --target-index=num: Specify the payload number to scan.

Note: -P is particularly useful in DNS modules. In DNS scanning, it is often used to match the number of questions specified in --probe-args. When combined with --target-port, a target is defined as <ip/x, port, index>. For example, if --probe-args contains multiple DNS queries like "A,example.com;AAAA,www.example.com", you would use -P 2 and -p 53 :

xmap -p 53 -P 2 --probe-args="A,example.com;AAAA,www.example.com"

Output Configuration

• -o, --output-file=name: Write scan results to a file. Use - for stdout (standard output).

Supported Formats

XMap supports multiple output formats, including:

1. CSV: Comma-separated values, suitable for spreadsheet applications.
2. JSON: Structured data format, ideal for programmatic processing.

For more detailed information on output options, including customizing fields and formatting, please refer to https://github.com/Limerencece/xmap/wiki/Output-options.

Subnet Filtering

• -b, --blacklist-file=path: File of subnets to exclude, accept DNS hostnames, in CIDR notation, one-per line. It is recommended you use this to exclude RFC 1918 addresses, multicast, IANA reserved space, and other IANA special-purpose addresses. An example blacklist file blacklist4.conf for this purpose.
• -w, --whitelist-file=path: File of subnets to include, accept DNS hostnames, in CIDR notation, one-per line. Specifying a whitelist file is equivalent to specifying to ranges directly on the command line interface, but allows specifying a large number of subnets. An example whitelist file whitelist6.conf for this purpose.
• -I, --list-of-ips-file=path: File of individual IP addresses to scan, one-per line. This feature allows you to scan a large number of unrelated addresses. If you have a small number of IPs, it is faster to specify these on the command line or by using --whitelist-file.

Note:

1. --list-of-ips-file should only be used when scanning more than 1 million addresses.
2. If both --whitelist-file and --list-of-ips-file are used, only hosts in the intersection of both sets will be scanned.
3. Hosts specified in --list-of-ips-file but included in --blacklist-file will be excluded.