Nmap & Port Scanning

Don't trust the default scan. The default only covers common ports 0–1000.

TCP handshake: SYN → SYN+ACK → ACK.

Part of the opening routine — see Enum-checklist.

Scan types / key flags

Flag	Meaning
-sS	SYN / stealth scan (default; SYN then RST)
-sT	Full TCP handshake — use over proxychains (pivoting)
-sU	UDP scan (Code 3 = closed; no response = open)
-sC	Default script scan (shows some vulns)
-sV / -A	Version detection / OS + scripts + traceroute
-O	OS detection
-sN / -sF / -sX	Null / FIN / Xmas stealth scans
-sA	ACK scan (firewall mapping)
-sW	Window scan (window size 0 = open)
-p-	All ports 0–65535
-p 22,80,443	Specific ports
-F	Fast — top 100 ports
--top-ports=20	Top N ports
-Pn	Skip host-alive ping (slower)
-n / -r	No DNS / force DNS
-sn	Host discovery only
--min-rate 10000	Packets per second
-T3/-T4	Timing
-f	Fragment packets
-sI	Idle / zombie scan
--script=NAME	Script from /usr/share/nmap/scripts/
--script vuln	Vulnerability scripts
-oN/-oG/-oX/-oS	Output formats
-v/-vv	Verbosity

Common invocations

nmap -p- --min-rate 10000 -T4 -Pn IP -oN nmap.allports.txt
nmap -sC -sV -T4 IP -oN nmap.tcp.txt                 # TCP
nmap -sU -T4 --top-ports=100 IP                      # UDP
nmap -Pn -p445 --script vuln 192.168.232.40          # vuln scripts
nmap -sV -p 443 --script "vuln" 192.168.250.13
nmap -sn 192.168.50.1-253                            # network sweep
proxychains nmap -O -sT -T4 -Pn --min-rate 10000 10.10.79.148 --top-ports 100 -vv

Netcat port scan

nc -nvv -w 1 -z 192.168.50.152 3388-3390   # TCP range
nc -nv -u -z -w 1 192.168.50.149 120-123   # UDP (unreliable)

Helpers

./nmapAutomator.sh --host 10.1.1.1 --type All
./nmapAutomator.sh -H academy.htb -t Recon -d 1.1.1.1
# Threader3000 for fast initial port discovery