Fast passive subdomain enumeration tool that finds subdomains of a domain using online sources, without sending traffic to the target.
bee-san/RustScan
A fast port scanner written in Rust that finds open ports quickly and can pipe results into Nmap or custom scripts.
Open-source alternative to:Nmap
- Stars
- 20,680
- Forks
- 1,398
- Open issues
- 23
- Last commit
- 3 days ago
What is it?
RustScan is a command-line port scanner written in Rust. It is aimed at quickly finding open TCP ports on one or more hosts, and it can scan the full range of 65k ports in a few seconds according to the project's own claims. It supports IPv6, CIDR notation and file input for targets.
Beyond raw scanning, RustScan automatically passes discovered ports into Nmap for deeper service analysis. It also includes a scripting engine that lets users run Python, Lua or Shell scripts against the results, or write their own, for example to run an SMB enumeration when port 445 is open.
The project also offers Docker images and packages for several Linux distributions, macOS via Homebrew, and installation through Cargo. Its adaptive features tune behaviour to the host OS and to how the tool is used over time.
Key features
- 01Scans all 65k ports in about three seconds, according to the project.
- 02Automatically pipes discovered ports into Nmap for further analysis.
- 03Scripting engine supports Python, Lua and Shell.
- 04Supports IPv6, CIDR ranges and file-based target input.
- 05Available through Docker, Cargo and several package managers.
Use cases
- Quickly enumerating open ports on hosts during a penetration test.
- Chaining port discovery into Nmap or custom scripts in an automated security workflow.
- Checking which services are exposed on your own servers or networks.
Quick start
- 1
Install Rust, then install RustScan with Cargo (the officially supported method)
cargo install rustscan - 2
On macOS, install RustScan with Homebrew
brew install rustscan - 3
On Arch Linux, install RustScan with pacman
pacman -S rustscan
Things to know
- Only Cargo installations are officially supported; other installs come from third-party packagers.
- Licensed under GPL-3.0, a copyleft license that requires derivative works to remain open source.
Topics
FAQ
- What is RustScan?
- A fast port scanner written in Rust that finds open ports quickly and can pipe results into Nmap or custom scripts. RustScan is a command-line port scanner written in Rust. It is aimed at quickly finding open TCP ports on one or more hosts, and it can scan the full range of 65k ports in a few seconds according to the project's own claims. It supports IPv6, CIDR notation and file input for targets.
- Is RustScan free to use? What license does it have?
- RustScan is open source under the GPL-3.0 license. Check the license terms before using it in commercial products.
- Is RustScan still maintained?
- Actively maintained. The last commit to RustScan was on Nov 4, 2026.
- What can I use RustScan for?
- Quickly enumerating open ports on hosts during a penetration test. Chaining port discovery into Nmap or custom scripts in an automated security workflow. Checking which services are exposed on your own servers or networks.
- How do I install RustScan?
- Install Rust, then install RustScan with Cargo (the officially supported method): cargo install rustscan On macOS, install RustScan with Homebrew: brew install rustscan On Arch Linux, install RustScan with pacman: pacman -S rustscan
- Where can I get RustScan?
- The source code and installation instructions are on GitHub: https://github.com/bee-san/RustScan
Summary generated by AI from the project's README. GitHub stats refresh daily.
Related projects
A curated awesome-list of tools, bookmarklets, browser addons and Burp/Caido/ZAP extensions used by web hackers and bug bounty hunters.
Open-source TCP port checker with a REST API and web UI, self-hostable via Docker and built on Litestar.
Command-line network scanner in Go that supports ARP, ICMP, TCP, UDP and SOCKS5 scans with JSON output for automation.
Kubernetes-based platform that runs a separate OWASP Juice Shop instance per participant for security trainings and CTF events.
Free, open-source application firewall for Windows and Linux that monitors and controls each app's network traffic, with built-in secure DNS and tracker blocking.