Masscan

Import the JSON output of masscan, a port scanner that reports which TCP and UDP ports answered.

File Types#

JSON, as written by masscan -oJ:

masscan -p80,443,8080 203.0.113.0/24 --rate 1000 -oJ masscan.json

Every open port becomes one finding at severity Info, matching how DefectDojo treats nmap’s open ports. Whether a port should be open is a question about the host, not something masscan can answer. A port masscan reports as closed (it answered with a RST) is the opposite of a finding and is not imported.

The endpoint is built as //host:port, because an open port has no scheme.

Two masscan behaviours the parser accommodates, both covered by tests:

• A scan that finds nothing writes an empty file, not an empty JSON array. That parses to zero findings rather than raising, because finding nothing is an ordinary result.
• Some masscan versions leave a trailing comma before the closing bracket, which is not valid JSON. The rest of the file is fine and the ports in it are real, so the comma is tolerated.

A port answered by more than one probe can appear in more than one record; findings are keyed on host, port and protocol so it is imported once.

Sample Scan Data#

Sample Masscan scans can be found here.

Default Deduplication Hashcode Fields#

By default, DefectDojo identifies duplicate findings using these hashcode fields:

• title
• endpoints

The description is deliberately left out: it records what the scan saw at the time (a response size, a detected version, a timestamp, a payload) and that changes between two scans of an unchanged target, which would import the same finding again on every rescan.