Nmap Recon

Network reconnaissance and port scanning using Nmap. Use when asked to scan a target, find open ports, detect services, check for vulnerabilities, or perform network reconnaissance.

Triggers

•"scan [target]", "port scan", "nmap", "what ports are open", "recon [target]", "service detection", "vulnerability scan"

Requirements

•nmap must be installed (standard on Kali, available via package managers)
•Root/sudo for SYN scans and OS detection

Usage

Quick Scan (Top 1000 ports)

bash

nmap -sC -sV -oA scan_$(date +%Y%m%d_%H%M%S) TARGET

Full Port Scan

bash

nmap -p- -sC -sV -oA fullscan_$(date +%Y%m%d_%H%M%S) TARGET

Fast Scan (Quick check)

bash

nmap -F -T4 TARGET

Stealth SYN Scan (requires root)

bash

sudo nmap -sS -sV -O -oA stealth_$(date +%Y%m%d_%H%M%S) TARGET

UDP Scan (Top 100 ports)

bash

sudo nmap -sU --top-ports 100 -oA udp_$(date +%Y%m%d_%H%M%S) TARGET

Vulnerability Scan

bash

nmap --script vuln -oA vulnscan_$(date +%Y%m%d_%H%M%S) TARGET

Aggressive Scan (OS, version, scripts, traceroute)

bash

nmap -A -T4 -oA aggressive_$(date +%Y%m%d_%H%M%S) TARGET

Output Parsing

Nmap outputs in multiple formats with -oA:

•.nmap - Human readable
•.xml - Machine parseable
•.gnmap - Greppable format

Parse open ports from greppable output:

bash

grep "open" scan.gnmap | awk -F'[/]' '{print $1}' | tr ',' '\n' | sort -u

Extract service versions:

bash

grep -E "^[0-9]+/" scan.nmap | awk '{print $1, $3, $4}'

Quick summary from XML:

bash

xmllint --xpath "//port[@state='open']" scan.xml 2>/dev/null

Common Scan Profiles

Profile	Command	Use Case
Quick	`nmap -F -T4`	Fast initial recon
Standard	`nmap -sC -sV`	Service detection + default scripts
Full	`nmap -p- -sC -sV`	All 65535 ports
Stealth	`sudo nmap -sS -T2`	Evasive scanning
Vuln	`nmap --script vuln`	Vulnerability detection
Aggressive	`nmap -A -T4`	Full enumeration

Script Categories

bash

# List available scripts
ls /usr/share/nmap/scripts/

# Run specific category
nmap --script=default,safe TARGET
nmap --script=vuln TARGET
nmap --script=exploit TARGET
nmap --script=auth TARGET

# Run specific script
nmap --script=http-title TARGET
nmap --script=smb-vuln* TARGET

Target Specification

bash

# Single host
nmap 192.168.1.1

# CIDR range
nmap 192.168.1.0/24

# Range
nmap 192.168.1.1-254

# From file
nmap -iL targets.txt

# Exclude hosts
nmap 192.168.1.0/24 --exclude 192.168.1.1

Timing Templates

•-T0 Paranoid (IDS evasion)
•-T1 Sneaky (IDS evasion)
•-T2 Polite (slow)
•-T3 Normal (default)
•-T4 Aggressive (fast)
•-T5 Insane (very fast, may miss ports)

Authorization Required

⚠️ Only scan targets you own or have explicit written authorization to test.

Never scan:

•Public infrastructure without permission
•Networks you don't control
•Production systems without approval

Example Workflow

bash

# 1. Quick scan to find live hosts
nmap -sn 192.168.1.0/24 -oA live_hosts

# 2. Fast port scan on discovered hosts
nmap -F -T4 -iL live_hosts.gnmap -oA quick_ports

# 3. Deep scan interesting hosts
nmap -p- -sC -sV -oA deep_scan TARGET

# 4. Vulnerability scan
nmap --script vuln -oA vuln_scan TARGET