Port Scanning Mastery

Phase 1 — Host Discovery

Identify what's alive before spending time on dead IPs. On a LAN, ARP (-PR) is fastest. Over a routed network use ICMP + TCP probes. Against hardened hosts, -Pn treats every IP as alive — expensive but necessary when ICMP is blocked.

nmap -sn 10.10.10.0/24          # Ping sweep
nmap -PS22,80,443 -sn TARGET    # TCP SYN probe
nmap -PU53,161 -sn TARGET       # UDP probe
nmap -Pn TARGET                 # Skip discovery

Phase 2 — Port Scanning

Start fast: masscan or nmap -p- to find every open port. Then hand just the open ports to nmap for deep inspection. Never run -sV against all 65535 — it takes forever.

# Step 1: find open ports fast
nmap -p- --min-rate 5000 --open -T4 TARGET -oN ports.txt

# Step 2: deep scan only open ports
ports=$(grep ^[0-9] ports.txt | cut -d/ -f1 | tr '\n' ',')
nmap -sC -sV -p$ports TARGET -oN detailed.txt

Phase 3 — Service Fingerprinting

Version detection (-sV) plus the default scripts (-sC) turns a port number into actionable intelligence. Cross-reference every version against CVE databases before touching an exploit.

nmap -sC -sV -p22,80,443 TARGET
searchsploit "OpenSSH 7.4"
searchsploit "Apache 2.4.49"
searchsploit "vsftpd 2.3.4"

Phase 4 — Targeted NSE Scripts

After version detection, run protocol-specific scripts to extract live data. SMTP user enumeration, LDAP dumps, SMB share lists, MySQL empty-password checks — each takes seconds and often hands you a foothold without touching an exploit.

nmap --script=smtp-enum-users TARGET -p25
nmap --script=ldap-search TARGET -p389
nmap --script=smb-enum-shares TARGET -p445
nmap --script=mysql-empty-password TARGET -p3306
nmap --script=redis-info TARGET -p6379

Standard Engagement Opening

# 1. Host discovery (ICMP + TCP + UDP probes)
nmap -PE -PS22,80,443 -PA80 -PU53,161 -sn \
  TARGET/24 -oG alive.gnmap
grep "Up" alive.gnmap | cut -d' ' -f2 > hosts.txt

# 2. Fast all-port scan
nmap -p- --min-rate 5000 --open -T4 \
  -iL hosts.txt -oN allports.txt

# 3. Service + script scan on open ports
ports=$(grep ^[0-9] allports.txt | cut -d/ -f1 \
  | sort -u | tr '\n' ',')
nmap -sC -sV -p$ports -iL hosts.txt \
  -oA detailed

# 4. UDP top-200
sudo nmap -sU --top-ports 200 \
  -iL hosts.txt -oN udp.txt

nmap Timing Templates

nmap -T0  # Paranoid   — 5 min/probe  (IDS evasion)
nmap -T1  # Sneaky     — 15 sec/probe
nmap -T2  # Polite     — 0.4 sec/probe
nmap -T3  # Normal     — adaptive (default)
nmap -T4  # Aggressive — 10ms min RTT (exam default)
nmap -T5  # Insane     — fastest, unreliable on WAN

# Fine-grained
--min-rate 5000         # min packets/sec
--max-retries 2         # reduce for speed
--host-timeout 30s      # skip slow hosts

Essential Flags Reference

-sS          # SYN scan (root, default for TCP)
-sU          # UDP scan
-sV          # Version detection
-sC          # Default NSE scripts
-O           # OS detection
-A           # All: -O -sV -sC --traceroute
-p-          # All 65535 ports
--open       # Show only open ports
--reason     # Show why state was assigned
-v / -vv     # Verbose / very verbose
-n           # No DNS resolution
-oA output   # Save all three formats
-iL file     # Read targets from file

Post-Scan Analysis Workflow

# Extract all open TCP ports from grepable output
grep "Ports:" scan.gnmap | \
  grep -oP '\d+/open/tcp' | \
  cut -d/ -f1 | sort -n

# Import XML into Metasploit
msf> db_import scan.xml

# Parse with python-libnmap
pip install python-libnmap
python3 -c "
from libnmap.parser import NmapParser
r = NmapParser.parse_fromfile('scan.xml')
for h in r.hosts:
  for s in h.services:
    if s.state == 'open':
      print(f'{h.address}:{s.port}/{s.protocol} {s.service}')
"