The Three Scans You Always Run
SCAN 1: Quick · common ports, scripts, version detection (run first, fastest results)
nmap -sC -sV -p 21,22,23,25,53,80,110,111,135,139,143,389,443,445,512,513,514,587,\
631,873,993,995,1433,1521,2049,3306,3389,5432,5900,5985,5986,6379,8080,8443,8888,\
9090,27017 <TARGET-IP> -oA scans/quick
SCAN 2: Full TCP · every port (run in background immediately)
nmap -p- --min-rate 5000 -T4 <TARGET-IP> -oA scans/full_tcp
SCAN 3: UDP · top ports (slow, but critical · SNMP, TFTP, DNS, NFS often here)
nmap -sU --top-ports 200 --min-rate 2000 <TARGET-IP> -oA scans/udp
After full TCP scan completes · run scripts against ALL open ports found
nmap -sC -sV -p <PORTS-FROM-SCAN2> <TARGET-IP> -oA scans/targeted
Decision tree after scans
- Web port open (80/443/8080/8443)? → Web Application PT Methodology
- SMB / Kerberos / LDAP open (445/88/389)? → Active Directory Methodology
- Only SSH + 1-2 services? → service enumeration below, then exploit
- Nothing obvious? → run a UDP scan, check for missed ports