Port scanning
option | description |
|---|---|
-p | Port ranges (default: most common 1000 ports), -p- all ports (1-65536) |
-sV | Version scanning, enforces full TCP connection |
-sC | Script scanning |
-O | OS detection |
-A | Aggressive scan options, combines: -O, -sV, -sC, --traceroute |
-T<0-5> | Set timing template (higher is faster), aka paranoid|sneaky|polite|normal|aggressive|insane (default: 3, aka normal) |
-oA | Basename (Output to all formats) |
-sU | UDP scan |
-Pn | Skip host discovery, use this option if the host is blocking ping probes. |
-v -vv | Increase verbosity |
-d -dd | Debug, even more verbose |
--max-retries | set to 1 or 0 to considerably speed up scan (but gets a bit less accurate) |
Note: There are a ton of other options, like more exotic scan types, spoofing IP or MAC addresses, etc.
Note: Nmap can only perform TCP SYN scans (
-sS), when running as privileged user (root or sudoer), otherwise it falls back to full TCP 3-way handshakes (-sT) per default.Light scan
sudo nmap --top-ports 10 --open -oA nmap_light <ip>
Default scan
sudo nmap -sV -oA nmap_default <ip>
Heavy scan
sudo nmap -p- -sV -sC --reason -oA nmap_heavy <ip>
Scan for "safe" vulns
sudo nmap --script "vuln and safe" -oA nmap_vuln <ip>
Scan for SMB vulns
sudo nmap -p 139,445 --script smb-vuln* -oA nmap_vuln_smb <ip>
sudo nmap -sU -oA nmap_udp <ip>
Get open ports comma separated
grep -oP '\d{1,5}/open' nmap.gnmap | cut -d "/" -f 1 | paste -s -d ','
Quicker scanning and smarter identification
NSE script based on Vulners.com API
A script that you can run in the background!
./nmapAutomator <ip> All
TCP/IP swiss army knife
Connect scan (only validates if ports are open)
nc -nvv -w 1 -z <ip> <port-range>
nc -nv -u -z -w 1 <ip> <port-range>
No response means port is open, otherwise a ICMP packet
port unreachable is sent back.
BUT: Response may get dropped (firewalls, routers, ...) -> false positiveIn computer networking, port knocking is a method of externally opening ports on a firewall by generating a connection attempt on a set of prespecified closed ports.
knockd
/etc/knockd.conf
Actually knock to a port
nmap -Pn -sT --host_timeout 201 --max-retries 0 -p <port> <ip>
or
echo "" > /dev/tcp/<ip>/<port>
for i in {1..65535}; do (echo > /dev/tcp/<ip>/$i) >/dev/null 2>&1 && echo $i is open; done
Last modified 10mo ago