owasp-amass/amass · error

%s is not a valid IP range

Error message

%s is not a valid IP range

What it means

After splitting a range token on '-' and possibly expanding a shorthand last octet, parseRange validates that both start and end parse as IPs. If either is nil, the token is rejected as an invalid IP range. It means a dash-separated scope entry has a malformed endpoint.

Source

Thrown at config/scope.go:391

	// If s is not a range, try parsing it as a single IP
	if twoIPs[0] == s {
		ip := net.ParseIP(s)
		if ip == nil {
			return fmt.Errorf("%s is not a valid IP", s)
		}
		return p.appendIPs([]net.IP{ip})
	}
	start := net.ParseIP(twoIPs[0])
	end := net.ParseIP(twoIPs[1])
	if end == nil {
		num, err := strconv.Atoi(twoIPs[1])
		if err == nil {
			end = net.ParseIP(twoIPs[0])
			end[len(end)-1] = byte(num)
		}
	}
	if start == nil || end == nil {
		return fmt.Errorf("%s is not a valid IP range", s)
	}

	ips := amassnet.RangeHosts(start, end)
	if len(ips) == 0 {
		return fmt.Errorf("%s is not a valid IP range", s)
	}
	return p.appendIPs(ips)
}

View on GitHub (pinned to 79299dce87)

Solutions

1. Provide both endpoints as full valid IPs: 'startIP-endIP'
2. Check for stray or doubled dash characters in the scope entry
3. Rewrite shorthand ranges explicitly if the automatic last-octet expansion does not apply

Example fix

// before
scope.Set("10.0.0.1-10.0.0")
// after
scope.Set("10.0.0.1-10.0.0.254")

func checkRange(s string) error {
	parts := strings.Split(s, "-")
	if len(parts) != 2 {
		return fmt.Errorf("range %q must be start-end", s)
	}
	if net.ParseIP(parts[0]) == nil || net.ParseIP(parts[1]) == nil {
		return fmt.Errorf("range %q has an invalid endpoint", s)
	}
	return nil
}

func isWellFormedRange(s string) bool {
	parts := strings.Split(s, "-")
	return len(parts) == 2 && net.ParseIP(parts[0]) != nil && net.ParseIP(parts[1]) != nil
}

if err := scope.Set(rng); err != nil && strings.Contains(err.Error(), "is not a valid IP range") {
	log.Printf("dropping malformed range %q", rng)
}

When it happens

Trigger: Calling Set/populate with a range like '10.0.0.1-' (missing end), '-10.0.0.1' (missing start), or 'abc-def' where neither endpoint parses via net.ParseIP.

Common situations: Truncated lines in scope config files, accidental extra dashes splitting a token incorrectly (e.g. '10.0.0.1--10.0.0.5'), or ranges mixing IPs and hostnames.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• %s is not a valid IP address or range
• %s is not a valid IP
• invalid key delimiter: %s
• brute forcing cannot be performed without DNS resolution
• active enumeration cannot be performed without DNS resolutio

AI-assisted analysis of owasp-amass/amass@79299dce87 (2026-09-06). Data as JSON: /api/errors/c9278dd7c2ea6c90. Report an issue: GitHub.