Full Nmap Strategy

reference 15 commands 1 tool

toolsnmap

Scan Order

Phase 1: Quick common ports · immediate results

nmap -sC -sV -p 21,22,23,25,53,80,110,111,135,139,143,389,443,445,512,513,514,\

587,631,873,993,995,1433,1521,2049,3306,3389,5432,5900,5985,5986,6379,8080,\

8443,8888,9090,27017 <TARGET-IP> -oA scans/quick

Phase 2: Full TCP · all 65535 ports

nmap -p- --min-rate 5000 -T4 <TARGET-IP> -oA scans/full_tcp

Phase 3: Targeted · run scripts on all discovered ports

nmap -sC -sV -p <DISCOVERED-PORTS> <TARGET-IP> -oA scans/targeted

Phase 4: UDP top-200 (don't skip this)

nmap -sU --top-ports 200 --min-rate 2000 <TARGET-IP> -oA scans/udp

OS detection

nmap -O <TARGET-IP> --osscan-guess

Output Reading

Quick summary of open ports from xml output

grep "portid" scans/full_tcp.xml | grep "open"

Convert nmap xml to HTML for easier reading

xsltproc scans/full_tcp.xml -o scans/full_tcp.html

Nmap NSE Scripts by Category

Vulnerability scanning

nmap --script vuln <TARGET-IP>

Default scripts (safe, informational)

nmap -sC <TARGET-IP>

Auth brute (careful with lockout)

nmap --script brute <TARGET-IP>

Full discovery

nmap --script discovery <TARGET-IP>

Specific vulnerability checks

nmap --script smb-vuln-ms17-010 -p 445 <TARGET-IP>

nmap --script http-shellshock -p 80 <TARGET-IP>