RustScan — Fast Port Scanner
RustScan blasts through all TCP ports quickly, then passes discovered ports to Nmap for version/scripts — faster than nmap -p- alone on many boxes.
OSCP workflow:
rustscan -a TARGET -- -sV -sC→ searchsploit → UseCases for ports
GitHub: https://github.com/RustScan/RustScan
Install (Kali)
sudo apt install rustscan
# or: cargo install rustscan
rustscan --version📌 Basic Usage
# Default — scans all ports, runs nmap on results
rustscan -a 10.10.10.10
# Explicit target list
rustscan -a 10.10.10.10,10.10.10.11
# Pass extra args to Nmap (after --)
rustscan -a 10.10.10.10 -- -sV -sC -Pn
rustscan -a TARGET -- -sV -sC -oA rustscan_nmap
# Custom port range / list
rustscan -a TARGET -p 1-1000
rustscan -a TARGET -p 22,80,443,445,3389📌 Common Flags
| Flag | Description |
|---|---|
-a, --addresses | Target IP(s) or CIDR |
-p, --ports | Port range or comma list |
-r, --range | Batch size / rate (higher = faster, noisier) |
-t, --timeout | Timeout per port (ms) |
-u, --ulimit | Raise file descriptor limit (fix “too many open files”) |
--scan-order | serial or random |
-g, --greppable | Greppable output |
--accessible | Accessible mode (slower, friendlier) |
-- | Everything after → passed to Nmap |
📌 OSCP Templates
# Fast full TCP + Nmap service scan
rustscan -a TARGET -u 5000 -- -sV -sC -Pn -oA scans/rust
# Quiet greppable then manual nmap
rustscan -a TARGET -g
# If ulimit errors
ulimit -n 5000
rustscan -a TARGET -u 5000📌 RustScan vs Nmap
| Situation | Tool |
|---|---|
| Need scripts / UDP / OS detect | Nmap |
| Fast discover open TCP ports | RustScan then Nmap on hits |
| Exam time pressure | RustScan -a TARGET -- -sV -sC |
| Stealth / low noise | Nmap -T2 only |
Always follow RustScan with Nmap -sV (and -sC / --script) on found ports — RustScan alone does not replace service enumeration.