Port Scanning (Nmap, Masscan)

Basic Nmap Scans

Quick Scan

Basic scan (default 1000 ports)

nmap $ip

Scan all ports

nmap -p 1-65535 $ip

Stealth SYN scan

nmap -sS $ip

Full TCP connection scan

nmap -sT $ip

Aggressive Scan

OS, services, and version detection

nmap -A $ip

Aggressive fast scan

nmap -T4 -A -v $ip

Scanning Specific Ports

Scan specific ports

nmap -p 22,80,443 $ip

Scan all 65,535 ports

nmap -p- $ip

Scan first 1000 ports

nmap -p 1-1000 $ip

Service & Version Detection

Detect services and versions

nmap -sV $ip

More aggressive version detection

nmap -sV --version-intensity 5 $ip

OS Detection

Detect OS

nmap -O $ip

OS and service detection

nmap -A $ip

Skip host discovery (useful for firewalled hosts)

nmap -Pn $ip

Evading Firewalls & IDS

Slow stealth scan

nmap -sS -T2 $ip

Fragmented packets scan

nmap -f $ip

Use custom MTU (bypass filters)

nmap --mtu 16 $ip

Use decoys

nmap -D RND:10 $ip

Randomize payload size

nmap --data-length 200 $ip

UDP Scanning

Scan specific UDP ports

nmap -sU -p 53,161 $ip

Full UDP scan

nmap -sU -p- $ip

Scanning Multiple Hosts

Scan a range of IPs

nmap 192.168.1.1-100

Scan from a file

nmap -iL targets.txt

Ping sweep to find live hosts

nmap -sn 192.168.1.0/24

Output & Logging

Save output in normal format

nmap -oN output.txt $ip

Save output in XML

nmap -oX output.xml $ip

Save in greppable format

nmap -oG output.gnmap $ip

Save in all formats

nmap -oA fullscan $ip

Advanced & Specialized Scans

Scan Hosts Inside a Network

Identify live hosts

nmap -sn 192.168.1.0/24

Ping sweep

nmap -sP 192.168.1.0/24

Detecting Vulnerabilities

Run built-in vulnerability scans

nmap --script vuln $ip

Scan for HTTP vulnerabilities

nmap --script http-vuln* $ip

Scanning for Specific Services

Scan for SMB OS info

nmap -p 445 --script smb-os-discovery $ip

Scan MySQL version

nmap -p 3306 --script mysql-info $ip

Additional Tools for Port Scanning

Masscan

masscan -p1-65535 --rate=1000 $ip

Unicornscan

unicornscan -i eth0 -mT $ip

Zmap

zmap -p 443 -o results.txt 192.168.1.0/24