idealeer/xmapHigh-performance network scanner for Internet-wide IPv4/IPv6 research, featuring multi-probe modules (ICMP, TCP SYN, UDP, DNS) and sub-5-minute full-address-space scanning on 10G links.
XMap is a fast network scanner designed for performing Internet-wide IPv6 & IPv4 network research scanning.
XMap is reimplemented and improved thoroughly from ZMap and is fully compatible with ZMap, armed with the "5 minutes" probing speed and novel scanning techniques. XMap is capable of scanning the 32-bits address space in under 45 minutes. With a 10 gigE connection and PF_RING, XMap can scan the 32-bits address space in under 5 minutes. Moreover, leveraging the novel IPv6 scanning approach, XMap can discover the IPv6 Network Periphery fast. Furthermore, XMap can scan the network space randomly with any length and at any position, such as 2001:db8::/32-64 and 192.168.0.1/16-20. Besides, XMap can probe multiple ports simultaneously.
XMap operates on GNU/Linux, macOS, and BSD. XMap currently has implemented probe modules for ICMP Echo scans, TCP SYN scans, UDP probes, and DNS scans (stateless, stateful, address-spoofing, and EDNS).
With banner grab and TLS handshake tool, ZGrab2, more involved scans could be performed.
The latest stable release of XMap is version 2.0.5 and supports Linux, macOS, and BSD. We recommend installing XMap from HEAD rather than using a distro package manager (not supported yet).
Instructions on building XMap from source can be found in INSTALL.
Installing from docker: docker pull liii/xmap:latest
Installing from ArchLinux Package
A guide to using XMap can be found in our GitHub Wiki.
Simple commands and options to using XMap can be found in USAGE.
Check how to use DNS probing modules in Issue #11.
Watch the description video at Pentester Academy TV.
Presented in 2021 West Lake Cybersecurity Conference: Cyberspace Security Tools Presentation
Presented in Pentester Academy TV
Referenced by 10+ top-tier security conference papers
Supporting one patent CN202110502369.2
The 2nd Place of 2025 ACSAC Cybersecurity Artifacts Impact Award (First Chinese institution to receive this award)
[DSN '21] Xiang Li, Baojun Liu, Xiaofeng Zheng, Haixin Duan, Qi Li, Youjun Huang. Fast IPv6 Network Periphery Discovery and Security Implications. In Proceedings of the 2021 IEEE/IFIP International Conference on Dependable Systems and Networks (DSN '21). Taipei, Taiwan, June 21-24, 2021 (Virtually). [PDF] [Slides] [Video].
(Acceptance rate: 48/279=17.2%)
[NDSS '23] Xiang Li, Baojun Liu, Xuesong Bai, Mingming Zhang, Qifan Zhang, Zhou Li, Haixin Duan, and Qi Li. Ghost Domain Reloaded: Vulnerable Links in Domain Name Delegation and Revocation. In Proceedings of the 30th Annual Network and Distributed System Security Symposium (NDSS '23). San Diego, California, 27 February – 3 March, 2023. [PDF] [Slides] [Video]
(Acceptance rate: 94/581=16.2%, Acceptance rate in summer: 36/183=19.7%), Acceptance rate in fall: 58/398=14.6%)
[USENIX Security '23] Xiang Li, Chaoyi Lu, Baojun Liu, Qifan Zhang, Zhou Li, Haixin Duan, and Qi Li. The Maginot Line: Attacking the Boundary of DNS Caching Protection. In Proceedings of the 32nd USENIX Security Symposium (USENIX Security '23). Anaheim, California, August 9–11, 2023. [PDF] [Slides] [Video]
(Acceptance rate: 422/1,444=29.2%, Acceptance rate in summer: 91/388=23.5%, Acceptance rate in fall: 155/531=29.2%), Acceptance rate in winter: 176/525=33.5%)
