padding-oracle-attacker VS masscan

padding-oracle-attacker - A CLI tool to execute padding oracle attacks.

Nope, this doesn't work any more. Shodan checks all ports (so any attackers using data from Shodan already know which ports you have open), and tools like masscan (https://github.com/robertdavidgraham/masscan) let you portscan the entire IPv4 address space in less than 10 minutes.

https://github.com/LogoiLab/mcsl https://github.com/robertdavidgraham/masscan

The discord user at the time used the tool "Masscan" to scan every 25565 port on the internet, he claims he was able to get the entire internet scanned in just a few minutes with a 512MB buyvm slice.

Masscan is a tool for scanning large segments of the internet for open ports. I've used it previously and it's not an inherently malicious tool.

https://github.com/robertdavidgraham/masscan can scan the entire Internet in under 5 minutes

"Not hard", to say the least, yeah:

https://github.com/robertdavidgraham/masscan

It's likely they were also hitting NAT limits of their firewall, as evidenced by their other devices taking a performance hit. They'd likely see a lot of improvement if they directly connected to the internet, just like all those millions of compromised routers and firewall that make up so many botnets already do. Also, if you scan naïvely and willy-nilly then you are going to get blocklisted and throttled. This has been well established for years. Tools like massscan have flags to use exclude files to use to skip the known troublesome areas.