Prerequisites
- Target system, dependencies and environment configured.
Usage
Purpose
You can't defend or attack a service you don't know is running. This skill takes you from an IP or range to a reliable inventory of open ports, the service on each, and its version — the map everything else in network and host security builds on.
When to use it
Any time you're handed a host, a range, or a fresh cloud subnet and need ground truth about its exposure. On the defensive side, it's how you verify that a firewall change actually closed what you think it closed.
For internet-facing scans, make sure the target is yours or explicitly in scope. Scanning ranges you don't own draws abuse complaints and, in some places, charges.
Procedure
- Confirm scope and note the IPs/ranges in writing. If you're scanning across the internet, expect that the source IP will be logged.
- Find live hosts first so you don't waste time port-scanning dead space:
nmap -sn 10.0.0.0/24 -oA hosts-up
- Do a fast wide sweep to learn which ports are open at all, then scan deeply only those. On large ranges, a fast scanner up front saves hours:
masscan 10.0.0.5 -p1-65535 --rate 1000 -oL ports.txt
- Run nmap's version and default-script scan against just the open ports for detail:
nmap -sV -sC -p 22,80,443,3306 10.0.0.5 -oA detailed
- For UDP, scan a focused set — full UDP is slow and noisy, so target the services that matter (DNS, SNMP, NTP, IKE):
nmap -sU --top-ports 20 10.0.0.5 -oA udp
- Save all three output formats (
-oA) so you have grepable and XML versions for later tooling.
Cheatsheet
nmap -sV --top-ports 1000 target -oA quick
nmap -sS -sV -sC -p- -T4 target -oA full
nmap -p- --open -T4 target
nmap -sV -p 80,443,8080,8443 target
naabu -host target -silent | nmap -sV -iL - -oA combined
Common -T timing: -T4 for most engagements, -T2 when you need to stay quiet or avoid tripping rate limits, -T3 (default) when unsure.
Reading the output
- Open vs filtered.
open answered. filtered means a firewall ate the probe — no answer either way. closed answered with a reset. Filtered ports are a defensive signal, not necessarily a dead end.
- Version strings are leads.
Apache httpd 2.4.49 isn't just informational — that version has a path-traversal-to-RCE CVE. Match versions against known vulnerabilities before you get excited, and confirm; banners lie or get spoofed.
- Unexpected ports. A database port (3306, 5432, 27017) reachable from outside its tier is a finding on its own, regardless of version.
- Default-script hits.
-sC output often includes anonymous FTP, exposed SMB shares, or weak TLS — read it, don't skim past it.
Pitfalls
- Scanning too fast on fragile networks.
-T5 or a high masscan rate can knock over old devices, VoIP gear, or SCADA. Slow down on anything you don't recognise.
- Trusting the banner. Version detection is a guess based on responses. Confirm before reporting a CVE as present.
- Forgetting UDP entirely. Plenty of real exposure (SNMP with
public, open DNS resolvers) is UDP-only and invisible to a TCP scan.
- One scan, one moment. Hosts come and go. A clean scan today isn't a clean scan next week — for monitoring, schedule it.
References
- Nmap Reference Guide (nmap.org/book)
- Masscan README (github.com/robertdavidgraham/masscan)
- OWASP WSTG — Fingerprint Web Server, Enumerate Infrastructure
Inputs
- Relevant source code, logs, network traces, or system specifications.
Outputs
- Analysis findings, security audit report, or generated code artifacts.
1---2name: port-and-service-scanning3description: Use when you need to know what's actually listening on a host or range — open ports, the services behind them, and their versions — before assessing or hardening it.4---5678## Prerequisites9- Target system, dependencies and environment configured.1011## Usage12### Purpose1314You can't defend or attack a service you don't know is running. This skill takes you from an IP or range to a reliable inventory of open ports, the service on each, and its version — the map everything else in network and host security builds on.1516### When to use it1718Any time you're handed a host, a range, or a fresh cloud subnet and need ground truth about its exposure. On the defensive side, it's how you verify that a firewall change actually closed what you think it closed.1920For internet-facing scans, make sure the target is yours or explicitly in scope. Scanning ranges you don't own draws abuse complaints and, in some places, charges.2122### Procedure23241. Confirm scope and note the IPs/ranges in writing. If you're scanning across the internet, expect that the source IP will be logged.252. Find live hosts first so you don't waste time port-scanning dead space:26 ```27 nmap -sn 10.0.0.0/24 -oA hosts-up28 ```293. Do a fast wide sweep to learn which ports are open at all, then scan deeply only those. On large ranges, a fast scanner up front saves hours:30 ```31 masscan 10.0.0.5 -p1-65535 --rate 1000 -oL ports.txt32 ```334. Run nmap's version and default-script scan against just the open ports for detail:34 ```35 nmap -sV -sC -p 22,80,443,3306 10.0.0.5 -oA detailed36 ```375. For UDP, scan a focused set — full UDP is slow and noisy, so target the services that matter (DNS, SNMP, NTP, IKE):38 ```39 nmap -sU --top-ports 20 10.0.0.5 -oA udp40 ```416. Save all three output formats (`-oA`) so you have grepable and XML versions for later tooling.4243### Cheatsheet4445```bash46nmap -sV --top-ports 1000 target -oA quick4748nmap -sS -sV -sC -p- -T4 target -oA full4950nmap -p- --open -T4 target5152nmap -sV -p 80,443,8080,8443 target5354naabu -host target -silent | nmap -sV -iL - -oA combined55```5657Common `-T` timing: `-T4` for most engagements, `-T2` when you need to stay quiet or avoid tripping rate limits, `-T3` (default) when unsure.5859### Reading the output6061- **Open vs filtered.** `open` answered. `filtered` means a firewall ate the probe — no answer either way. `closed` answered with a reset. Filtered ports are a defensive signal, not necessarily a dead end.62- **Version strings are leads.** `Apache httpd 2.4.49` isn't just informational — that version has a path-traversal-to-RCE CVE. Match versions against known vulnerabilities before you get excited, and confirm; banners lie or get spoofed.63- **Unexpected ports.** A database port (3306, 5432, 27017) reachable from outside its tier is a finding on its own, regardless of version.64- **Default-script hits.** `-sC` output often includes anonymous FTP, exposed SMB shares, or weak TLS — read it, don't skim past it.6566### Pitfalls6768- **Scanning too fast on fragile networks.** `-T5` or a high masscan rate can knock over old devices, VoIP gear, or SCADA. Slow down on anything you don't recognise.69- **Trusting the banner.** Version detection is a guess based on responses. Confirm before reporting a CVE as present.70- **Forgetting UDP entirely.** Plenty of real exposure (SNMP with `public`, open DNS resolvers) is UDP-only and invisible to a TCP scan.71- **One scan, one moment.** Hosts come and go. A clean scan today isn't a clean scan next week — for monitoring, schedule it.7273### References7475- Nmap Reference Guide (nmap.org/book)76- Masscan README (github.com/robertdavidgraham/masscan)77- OWASP WSTG — Fingerprint Web Server, Enumerate Infrastructure7879## Inputs80- Relevant source code, logs, network traces, or system specifications.8182## Outputs83- Analysis findings, security audit report, or generated code artifacts.
jihedbfr-art