SuperScan 4 is a completely-rewritten update of the highly popular Windows port scanning tool, SuperScan. Here are some of the new features in this version.

Superior scanning speed
Support for unlimited IP ranges
Improved host detection using multiple ICMP methods
TCP SYN scanning
UDP scanning (two methods)
IP address import supporting ranges and CIDR formats
Simple HTML report generation
Source port scanning
Fast hostname resolving
Extensive banner grabbing
Massive built-in port list description database
IP and port scan order randomization
A selection of useful tools (ping, traceroute, Whois etc)
Extensive Windows host enumeration capability

Note that SuperScan 4 is intended for Windows 2000 and XP only. Administrator privileges may be required to run the program. It will not run on Windows 95/98/ME/NT.

Quick Usage Guide

SuperScan 4 is easy to use. On the simplest level, you would enter IP addresses into the main screen input area and start the scan by clicking the start button (the blue triangle). Brief results appear in the topmost pane, scan progress details appear in the lower pane and when the scan completes you can see more detailed results by clicking the View HTML Results button. This launches the generated report.html file in your default Web browser.
·   ·   ·   ·   
In addition to entering IP addresses by hand you can also import a list of IPs and IP ranges from a file by clicking the Read IPs from file button. SuperScan supports seprate IPs (10.20.30.40), IP ranges (10.20.30.40-10.20.30.100, 10.20.30.40-100 etc) and CIDR format ranges (10.20.30.0/24). You can copy IPs from the clipboard directly into the IP entry list by right-clicking on the list and selecting from the popup menu. SuperScan will intelligently extract IPs from any text file or from the clipboard, ignoring superfluous text.

SuperScan operates well with its default settings but offers more control over the scanning process if you need it. Select the desired settings from the Host and Service Discovery and the Scan Options tabs.

Note: For the duration of a scan only, SuperScan will enable a built-in minimalist Ident server listening on port 113. This server is for the sole purpose of better handling certain services during the banner grabbing process.

Host Discovery Options

These options let you choose which methods SuperScan uses to find live hosts on the network and determine if they should be considered for further analysis. Select the Host Discovery checkbox to use any combination of four different ICMP packet types to generate a response from the potential hosts. If you clear the Host Discovery box, SuperScan considers all scanned hosts to be alive. It will scan for them regardless of whether they are actually live on the network.

UDP Port Scan

Enter ports and settings here to scan with UDP packets. SuperScan supports two basic UDP-port scanning methods:

Data - sends UDP data packets that solicit replies from services running on well-known ports.
Data + ICMP - uses the same data probe method. If a port does not respond with a "ICMP Destination Port Unreachable" message, SuperScan treats it as an open port. It generates a test beforehand to see if scanning a known-closed port will generate the message. Note that this method can be prone to false-positives since some systems exhibit ICMP reply throttling.

If you want to perform a scan with a fixed local source port (to bypass certain simple firewall rules) select the relevant checkbox and enter the port number in the text box.

TCP Port Scan

Enter ports and settings here to scan with TCP packets. There are 2 basic TCP port scanning methods:

Connect - performs a full TCP 3-way handshake.
SYN - only sends a SYN packet. To scan your localhost system you will need to use the Connect mode.
·   ·   ·   ·   ·   ·   
If you want to perform a scan with a fixed local source port (to bypass certain simple firewall rules), select the relevant checkbox and enter the port number in the text box.

Scan Options

This tab provides options that control the number of passes to perform when doing host and service scanning and hostname resolving. It also lets you set the Timeout value for banner grabbing.

If you are using TCP SYN scanning, you can choose which source IP address the packets should use from the Source IP dropdown. Note that you cannot spoof IP source addresses here!

The scan speed slider bar controls how fast the scanner sends out packets over the network.

The default scan speed setting of 10 ms should be adequately fast for standard Internet or LAN use with a high speed connection. If you are running on a LAN and your routers and target hosts can handle it then you could set the speed to the maximum setting (a 0 ms delay) but at this position you are in danger of having packets dropped and overwhelming network devices with the high bandwidth.

Conversely, if you are running on a low bandwidth network such as with a dialup modem you should consider adjusting the speed to something a little slower such as a 20 or 30 ms delay.

For a less intrusive scan you could set the scan speed slider to a very slow setting if bandwidth usage is a major concern.

Select Hide systems with no open ports to remove systems with no discovered open ports from the display results.

Select Randomize IP and port scan order to randomize the order in which the systems are scanned. This helps avoid network router and host traffic bottlenecks, and can also help avoid certain intrusion detection systems.

Tools

The Tools tab contains several useful general-purpose network tools. Their use should be self-explanatory.

IP addresses, hostnames, or even complete URLs can be entered and decoded on the input line. If you need to specify a port, use the format 10.20.30.40:123 where 123 is the port in this example.

Windows Enumeration

This tab contains powerful Windows host enumeration options. Enter the hostname or IP address you want to scan in the input box. Click Enumerate to begin the analysis. Click Options for additional settings.

Select the check boxes associated with the enumeration types along the left side of the window.

Remote registry enumeration is possible (assuming appropriate access rights have been given) and is controlled by the provided registry.txt file. You can easily edit this file to add further keys to check for. You can only access the HKEY_LOCAL_MACHINE and HKEY_USERS registry hives from a remote computer.