# Nmap

> Use for network discovery, service enumeration, exposure verification, and narrow retesting during authorized pentests. Trigger on identifying live hosts, open ports, service banners, remote administration paths, and segmentation assumptions.

- Skill: `timsonner/nmap` (Agent Skill)
- Install (CLI): `npx skillmds@latest add timsonner/nmap`
- Raw SKILL.md: https://api.skillmd.com/api/skills/timsonner/nmap/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Product & Planning
- License: MIT
- Author: timsonner (https://skillmd.com/u/timsonner)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/timsonner/nmap

---


# Nmap

## Purpose

Use this skill when the current hypothesis depends on confirmed host reachability or exposed network services.

## Phase Fit

- Primary: Discovery and Reconnaissance
- Secondary: Vulnerability Analysis
- Controlled use: Validation and Controlled Impact Demonstration, Retest and Closure

## Use When

- Need to confirm live hosts, exposed ports, or remote administration services.
- Need to test segmentation assumptions or management plane exposure.
- Need a narrow retest after a network-facing fix.

## Avoid When

- Scope or maintenance windows are unclear.
- High-rate scanning could disrupt fragile services.
- Broad script execution would exceed the approved impact level.

## Inputs

- Approved host list, CIDR, or validated inventory
- Rate limits and fragile-service warnings
- Critical exclusions and outage contacts

## Procedure

1. Start from the smallest target set that answers the current question.
2. Use low-impact discovery to validate reachability.
3. Escalate to deeper service identification only where it advances the phase objective.
4. Correlate results with known inventory and owners.
5. Feed confirmed web services into `httpx` or `gowitness` and confirmed protocols into focused analysis.

## Command Syntax

Replace sample targets with approved in-scope assets.

```bash
# Host discovery sweep
nmap -sn 10.10.10.0/24 -oA contoso-sweep

# Top 1000 ports with service/version detection
nmap -Pn --top-ports 1000 -sV 10.10.10.100 -oA contoso-top1000

# Full TCP port scan with default scripts and version detection
nmap -Pn -sV -sC -p- 10.10.10.100 -oA contoso-full

# Targeted port check with OS detection
nmap -Pn -sV -O -p 22,80,443,3389,8080,8443 portal.contoso.com

# Remote administration exposure check
nmap -Pn -p 22,3389,5985,5986,2222 10.10.10.0/24 -oG contoso-admin.gnmap

# UDP scan for key management protocols
nmap -Pn -sU -p 53,161,500,1194 10.10.10.100

# Safe script scan against web services
nmap -Pn --script=safe -p 80,443 portal.contoso.com -oN contoso-scripts.txt
```

## Evidence to Capture

- Timestamped host and service inventory
- Unexpected administrative exposure
- Differences between expected and observed segmentation or reachability

## Safety Boundaries

- Use the least invasive scan that answers the question.
- Respect exclusions, windows, and fragile assets.
- Stop immediately if scanning creates instability or abnormal load.