Basic arguments

Using the command xmap --help (or more concisely, xmap -h ), you can see a brief introduction to the basic arguments as follows:

Basic arguments:
  -6, --ipv6                    Scanning the IPv6 networks (default)
  -4, --ipv4                    Scanning the IPv4 networks
  -x, --max-len=len             Max IP bit length to scan  (default=`32')
  -p, --target-port=port|range  Port(s) number to scan (for TCP and UDP scans),
                                  use `,' and `-', with this option, one target
                                  is a <ip/x, port>
  -P, --target-index=num        Payload number to scan, with this option, one
                                  target is a <ip/x, (port), index>
                                  (default=`0')
  -o, --output-file=name        Output file, use `-' for stdout
  -b, --blacklist-file=path     File of subnets to exclude, in CIDR notation,
                                  e.g., 2001::/64, 192.168.0.0/16,
                                  www.qq.com/32 (max len of domain: 256)
  -w, --whitelist-file=path     File of subnets to include, in CIDR notation,
                                  e.g., 2001::/64, 192.168.0.0/16,
                                  www.qq.com/32 (max len of domain: 256)
  -I, --list-of-ips-file=path   List of individual addresses to scan in random
                                  order, e.g., 2001:db8::1, 192.168.0.1

Network Type Selection

• -6, --ipv6: Scan IPv6 networks (enabled by default).
• -4, --ipv4: Scan IPv4 networks.

Note: By default, XMap scans the IPv6 networks. If you need to scan IPv4 networks, you must explicitly specify it using xmap -4. -6 and -4 are mutually exclusive, which means scanning IPv4 and IPv6 networks cannot be performed simultaneously.

Scan Range Configuration

• -x, --max-len=len: Set the maximum IP bit length to scan (default = 32).
• ip|domain|range: Specify the IP addresses, DNS hostnames, or IP ranges to scan (supports CIDR block notation).
  Examples:
  • 2001::1 (IPv6 address)
  • 192.168.0.1 (IPv4 address)
  • 2001::/64 (IPv6 CIDR block)
  • 192.168.0.1/16 (IPv4 CIDR block)
  • www.qq.com (domain name)
  • Default values: ::/0 (IPv6) and 0.0.0.0/0 (IPv4).

Examples

1. Scan the IPv6 address space (::/0-32) :

   xmap
   

2. Scan the entire IPv4 address space (0.0.0.0/0-32) :

   xmap -4
   

3. Scan both 2001::/8 and 2002::/16 subnets for their respective address spaces (2001::/8-32 and 2002::/16-32) :

   xmap 2001::/8 2002::/16
   

4. Scan the 2001::/32-64 address space :

   xmap -x 64 2001::/32
   

Target Port Configuration

• -p, --target-port=port|range: Specify the TCP or UDP port(s) to scan (for SYN scans and basic UDP scans). Supports port ranges using , and -.
  Examples:
  • 80,443
  • 8080-8081
  • 80,8080-8081
• -P, --target-index=num: Specify the payload number to scan.

Note: -P is particularly useful in DNS modules. In DNS scanning, it is often used to match the number of questions specified in --probe-args. When combined with --target-port, a target is defined as <ip/x, port, index>. For example, if --probe-args contains multiple DNS queries like "A,example.com;AAAA,www.example.com", you would use -P 2 and -p 53 :

xmap -p 53 -P 2 --probe-args="A,example.com;AAAA,www.example.com"

## Output Configuration

- `-o`, `--output-file=name`: Write scan results to a file. Use `-` for stdout (standard output).

### Supported Formats
XMap supports multiple output formats, including:
- **CSV**: Comma-separated values, suitable for spreadsheet applications.
- **JSON**: Structured data format, ideal for programmatic processing.

For more detailed information on output options, including customizing fields and formatting, please refer to <https://github.com/Limerencece/xmap/wiki/Output-options>.