Lets say I want to scan a large amount of ip addresses for webservers running on port 80 (aware that there are other ports for webservers, ignoring for example).
What would be the most efficient way to do this?
Here are some options:
1) run a bash/python script that runs multiple instances of nmap simultaneously with only one port being scanned, command would look like this:
nmap --append-output -oG output.txt -p 80 -Pn -sS xxx.xxx.xxx.xxx (ip address) &
2) create a python script that attempts a
GET request for each ip address (also running multiple instances simultaneously)
Essentially, my question(s) are: are any of these options the fastest way, or is there a faster way that I'm not thinking of, also, is nmap efficient compared to a python script or is there a lot of overhead in terms of requests, memory footprint etc.
An idea that crossed my mind was to run a bash/python script doing
NSLLOKUP on each ip address, though this wouldn't give me webservers that don't have DNS configured, the plus side would be scanning without sending any packets into the network