# How to Perform Mass Scanning of Multiple Hosts Using testssl.sh: Complete Guide

> Learn how to perform mass scanning of multiple hosts with testssl.sh using the --file and --mode parallel options. Scan your infrastructure efficiently and concurrently.

- Repository: [Dirk Wetter/testssl.sh](https://github.com/drwetter/testssl.sh)
- Tags: how-to-guide
- Published: 2026-03-01

---

**Use the `--file` (or `-iL`) option to provide a text file containing one target per line, and add `--mode parallel` to execute concurrent scans across your infrastructure.**

testssl.sh is an open-source command-line tool for auditing TLS/SSL encryption on servers. When assessing large networks, running individual commands becomes impractical; the drwetter/testssl.sh repository provides native mass testing capabilities that process host lists serially or in parallel through the `--file` option and associated batch-mode functions.

## Understanding the `--file` Option for Batch Scanning

The primary mechanism for mass scanning multiple hosts with testssl.sh is the **`--file`** option, also available as the short form **`-iL`**. This accepts a plain-text file where each line represents either a simple host:port specification or a complete testssl.sh command line including additional flags.

When invoked with `--file`, the script automatically enables batch-mode warnings and processes entries **serially** by default. According to the source code in [`testssl.sh`](https://github.com/drwetter/testssl.sh/blob/main/testssl.sh), the implementation reads the file and recursively invokes child processes through the `create_mass_testing_cmdline` and `run_mass_testing` functions located around lines 44-48.

## Serial vs Parallel Execution Modes

By default, testssl.sh executes mass scans in **serial mode**, processing one target completely before starting the next. For infrastructure assessments involving many hosts, enable **parallel mode** using either:

- **`--mode parallel`**
- **`--parallel`** (shortcut)

In parallel mode, the script invokes the `run_mass_testing_parallel` function to fork multiple concurrent background processes, significantly reducing total scan time while maintaining the same output quality.

## Creating Your Host List File

The input file requires Unix line endings and supports two distinct formats per the [`doc/testssl.1.md`](https://github.com/drwetter/testssl.sh/blob/main/doc/testssl.1.md) documentation (lines 84-90):

**Simple target entries:**

```

example.com
mail.example.org:25
192.0.2.10:443

```

**Full command lines with options:**

```

--wide --log example.com
--protocols --log mail.example.org:25
--cipher-per-proto --log 192.0.2.10:8443

```

## Practical Mass Scanning Examples

### Basic Serial Scanning

Create a file named [`hosts.txt`](https://github.com/drwetter/testssl.sh/blob/main/hosts.txt) containing your targets:

```bash
cat > hosts.txt << EOF
example.com
mail.example.org:25
192.0.2.10:443
EOF

```

Execute the mass scan:

```bash
testssl.sh --file hosts.txt

```

### Parallel Mass Testing for Speed

To scan multiple hosts simultaneously and reduce total runtime:

```bash
testssl.sh --file hosts.txt --mode parallel

```

Or using the shortcut syntax:

```bash
testssl.sh --parallel --file hosts.txt

```

### Processing Nmap Greppable Output Files

testssl.sh can directly parse Nmap greppable format files (generated with `nmap -oG`). If you have an existing Nmap scan file `nmap.gnmap`:

```bash
testssl.sh --file nmap.gnmap

```

As documented in [`doc/testssl.1.md`](https://github.com/drwetter/testssl.sh/blob/main/doc/testssl.1.md) (lines 86-88), the script automatically detects the Nmap header, strips extraneous columns, and retains only open ports for SSL/TLS testing.

### Configuring Timeouts for Batch Reliability

When scanning large batches across unreliable networks, prevent individual scans from hanging indefinitely:

```bash
testssl.sh --file hosts.txt --openssl-timeout 30

```

This timeout value is passed to every child scan process, ensuring the entire mass testing operation completes even if specific targets fail to respond.

## Technical Implementation Details

The mass testing functionality in [`drwetter/testssl.sh`](https://github.com/drwetter/testssl.sh/blob/main/drwetter/testssl.sh) operates by reading the input file line-by-line and constructing child command lines. The core logic resides in three key functions within the main [`testssl.sh`](https://github.com/drwetter/testssl.sh/blob/main/testssl.sh) script:

- **`create_mass_testing_cmdline`**: Parses each line of the input file and constructs the appropriate command string for the child process
- **`run_mass_testing`**: Manages the serial execution flow, invoking one scan at a time
- **`run_mass_testing_parallel`**: Handles concurrent execution by forking background processes when `--mode parallel` is specified

These functions appear in the mass-testing code section of [`testssl.sh`](https://github.com/drwetter/testssl.sh/blob/main/testssl.sh) (around lines 44-48), implementing the recursive invocation pattern that enables batch processing.

## Summary

- Use **`--file <filename>`** (or **`-iL`**) to enable mass scanning of multiple hosts with testssl.sh
- Input files support both simple host:port entries and complete command lines per row
- **Serial mode** (default) processes targets sequentially; **parallel mode** (`--mode parallel`) executes concurrent scans
- The script automatically detects and parses Nmap greppable output files (`-oG` format)
- Set **`--openssl-timeout`** to prevent hanging on unresponsive hosts during large batch operations
- Core implementation resides in [`testssl.sh`](https://github.com/drwetter/testssl.sh/blob/main/testssl.sh) functions `create_mass_testing_cmdline`, `run_mass_testing`, and `run_mass_testing_parallel`

## Frequently Asked Questions

### What file format does testssl.sh require for mass scanning?

testssl.sh expects a plain-text file with Unix line endings where each line contains either a target host (with optional port) or a complete testssl.sh command line. The `create_mass_testing_cmdline` function in [`testssl.sh`](https://github.com/drwetter/testssl.sh/blob/main/testssl.sh) parses these entries and constructs the appropriate child process commands, supporting both simple and complex specifications as documented in [`doc/testssl.1.md`](https://github.com/drwetter/testssl.sh/blob/main/doc/testssl.1.md).

### How does parallel mass testing work internally?

When you specify `--mode parallel`, testssl.sh invokes the `run_mass_testing_parallel` function instead of the default `run_mass_testing`. This function forks multiple background processes to execute scans concurrently, allowing multiple SSL/TLS handshakes to occur simultaneously and significantly reducing total runtime when assessing many hosts.

### Can I use existing Nmap scan results as input for mass scanning?

Yes. testssl.sh automatically detects Nmap greppable output format (files generated with `nmap -oG`). As implemented in the source code and documented in [`doc/testssl.1.md`](https://github.com/drwetter/testssl.sh/blob/main/doc/testssl.1.md) (lines 86-88), the script strips the Nmap header and extra columns, extracting only hosts with open ports for SSL/TLS testing without requiring manual file conversion.

### Why should I set a timeout when performing mass scans?

The `--openssl-timeout` parameter prevents individual scans from hanging indefinitely on unresponsive or firewalled hosts, which is critical when processing large batches. This timeout is applied to every child scan process forked during mass testing, ensuring that one slow or unresponsive target cannot block the completion of the entire batch operation.