Nmap Recon
Network reconnaissance and port scanning using Nmap. Use when asked to scan a target, find open ports, detect services, check for vulnerabilities, or perform network reconnaissance.
Triggers
- "scan [target]", "port scan", "nmap", "what ports are open", "recon [target]", "service detection", "vulnerability scan"
Requirements
nmap
must be installed (standard on Kali, available via package managers)- Root/sudo for SYN scans and OS detection
Usage
Quick Scan (Top 1000 ports)
nmap -sC -sV -oA scan_$(date +%Y%m%d_%H%M%S) TARGET
Full Port Scan
nmap -p- -sC -sV -oA fullscan_$(date +%Y%m%d_%H%M%S) TARGET
Fast Scan (Quick check)
nmap -F -T4 TARGET
Stealth SYN Scan (requires root)
sudo nmap -sS -sV -O -oA stealth_$(date +%Y%m%d_%H%M%S) TARGET
UDP Scan (Top 100 ports)
sudo nmap -sU --top-ports 100 -oA udp_$(date +%Y%m%d_%H%M%S) TARGET
Vulnerability Scan
nmap --script vuln -oA vulnscan_$(date +%Y%m%d_%H%M%S) TARGET
Aggressive Scan (OS, version, scripts, traceroute)
nmap -A -T4 -oA aggressive_$(date +%Y%m%d_%H%M%S) TARGET
Output Parsing
Nmap outputs in multiple formats with
-oA
:
.nmap
- Human readable.xml
- Machine parseable.gnmap
- Greppable format
Parse open ports from greppable output:
grep "open" scan.gnmap | awk -F'[/]' '{print $1}' | tr ',' '\n' | sort -u
Extract service versions:
grep -E "^[0-9]+/" scan.nmap | awk '{print $1, $3, $4}'
Quick summary from XML:
xmllint --xpath "//port[@state='open']" scan.xml 2>/dev/null
Common Scan Profiles
| Profile | Command | Use Case |
|---|
| Quick | nmap -F -T4
| Fast initial recon |
| Standard | nmap -sC -sV
| Service detection + default scripts |
| Full | nmap -p- -sC -sV
| All 65535 ports |
| Stealth | sudo nmap -sS -T2
| Evasive scanning |
| Vuln | nmap --script vuln
| Vulnerability detection |
| Aggressive | nmap -A -T4
| Full enumeration |
Script Categories
# List available scripts
ls /usr/share/nmap/scripts/
Run specific category
nmap --script=default,safe TARGET
nmap --script=vuln TARGET
nmap --script=exploit TARGET
nmap --script=auth TARGET
Run specific script
nmap --script=http-title TARGET
nmap --script=smb-vuln* TARGET
Target Specification
# Single host
nmap 192.168.1.1
CIDR range
nmap 192.168.1.0/24
Range
nmap 192.168.1.1-254
From file
nmap -iL targets.txt
Exclude hosts
nmap 192.168.1.0/24 --exclude 192.168.1.1
Timing Templates
-T0
Paranoid (IDS evasion)-T1
Sneaky (IDS evasion)-T2
Polite (slow)-T3
Normal (default)-T4
Aggressive (fast)-T5
Insane (very fast, may miss ports)
Authorization Required
⚠️ Only scan targets you own or have explicit written authorization to test.
Never scan:
- Public infrastructure without permission
- Networks you don't control
- Production systems without approval
Example Workflow
# 1. Quick scan to find live hosts
nmap -sn 192.168.1.0/24 -oA live_hosts
2. Fast port scan on discovered hosts
nmap -F -T4 -iL live_hosts.gnmap -oA quick_ports
3. Deep scan interesting hosts
nmap -p- -sC -sV -oA deep_scan TARGET
4. Vulnerability scan
nmap --script vuln -oA vuln_scan TARGET
