Port Scanning

Nmap

Reference: https://nmap.org/book/toc.html

Scripts location: /usr/share/nmap/scripts

Scan Types

Flag	Description
-sS	SYN stealth scan — faster, sends SYN packet, waits for SYN-ACK
-sT	TCP full connect — slower, default without sudo privileges
-sU	UDP scan
-sn	Ping sweep / host discovery
-sCV	Service version detection + default scripts
-A	OS detection, script scanning, traceroute

Timing Templates

-T<0-5> sets nmap's timing profile. Lower is slower and stealthier; higher is faster and noisier.

Flag	Name	Use Case
-T0	Paranoid	IDS evasion — serializes probes, ~5 min between packets
-T1	Sneaky	IDS evasion — ~15 sec between packets
-T2	Polite	Reduces bandwidth/host load; slower than default
-T3	Normal	Default; balanced accuracy and speed
-T4	Aggressive	Fast scans on reliable, modern networks (typical CTF/lab default)
-T5	Insane	Sacrifices accuracy for speed; expect missed ports on lossy links

Pad probe packets to defeat signature-based detection that flags empty/short scan packets:

nmap -sS --data-length 25 $TARGET

--data-length appends N random bytes to each sent packet. Common defensive rules flag nmap's default zero-payload SYN probes; adding a few bytes changes the packet signature at the cost of slightly more bandwidth per probe.

Set a custom IP TTL to blend in with a target OS or bypass TTL-based filtering:

nmap -sS --ttl 128 $TARGET

Default initial TTLs by OS (useful both for spoofing with --ttl and for fingerprinting hosts from packet captures):

TTL	Operating System
64	Linux, macOS, *BSD, Android, modern iOS
128	Windows (all modern versions)
255	Cisco IOS, Solaris, most network gear
60	Older macOS (pre-OS X)
32	Legacy Windows 95/98/ME

Observed TTL in a capture is initial_TTL − hop_count, so a reply arriving with TTL 117 is likely a Windows host 11 hops away.

Common Scans

Full TCP port scan with service detection:

nmap -sCV -p- $TARGET --open

Quick SYN scan all ports:

nmap -sS -Pn -T4 -p- --min-rate=1000 $TARGET

• -p- scans all 65535 ports (default is the top 1000)
• -Pn skips host discovery and treats the host as up (use when ICMP is filtered)
• -T4 is aggressive timing; --min-rate=1000 sets a minimum packets/sec floor

Ping sweep for host discovery:

sudo nmap -sn $SUBNET

UDP top ports:

nmap -sU --top-ports 50 $TARGET

Two-Stage Fast Scanning

On slow networks a full -p- nmap scan can take a long time. The common pattern is to find open ports fast with a lightweight scanner, then run nmap's service/script detection only against those ports.

Rustscan pipes discovered ports straight into nmap:

rustscan -a $TARGET --range 1-65535 -- -sCV

Masscan for very fast port discovery (tune --rate to the environment):

sudo masscan $TARGET -p1-65535 --rate 1000 -oL masscan.txt
# then feed the open ports into nmap:
ports=$(grep open masscan.txt | awk '{print $3}' | paste -sd, -)
nmap -sCV -p $ports $TARGET

tip

Masscan uses its own TCP/IP stack and can overwhelm fragile hosts or trip IDS at high rates. Keep --rate modest on production targets. Firewall-evasion flags (-f, -D, --source-port) live on the AV/Evasion page.

NSE Scripts

List scripts for a specific service:

ls -1 /usr/share/nmap/scripts/smb*

Run vulnerability category scripts:

sudo nmap -sV -p 443 --script "vuln" $TARGET

Run specific scripts:

nmap -v -p 139,445 --script smb-os-discovery $TARGET
nmap --script smb-enum-shares.nse -p 445 $TARGET
nmap --script smb-enum-users.nse -p 445 $TARGET

Get help on a specific script:

nmap --script-help=<script-name>

Override the User-Agent sent by HTTP-based NSE scripts (default advertises nmap, which WAFs and access logs flag on sight):

nmap -p 80,443 --script http-enum \
  --script-args http.useragent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" $TARGET

Applies to any script built on the http NSE library (http-enum, http-title, http-vuln-*, etc.).

tip

You can search for CVEs on Google and add NSE scripts from GitHub. After adding new scripts, run sudo nmap --script-updatedb to update the script database.

Output Options

Flag	Description
-oG	Greppable output
-oN	Normal output
-oA	All formats

Netcat Port Scanning

Quick port scan with netcat:

nc -nvv -w 1 -z $TARGET 3388-3390

• -w sets timeout
• -z specifies zero-I/O mode (scanning, sends no data)
• Add -u for UDP scanning

Banner grab on a specific port:

nc -nv $TARGET 80