Introduction
# Nmap Recon
Network reconnaissance and port scanning using Nmap. Use when asked to scan a target, find open ports, detect services, check for vulnerabilities, or perform network reconnaissance.
## Triggers
- "scan [target]", "port scan", "nmap", "what ports are open", "recon [target]", "service detection", "vulnerability scan"
## Requirements
- `nmap` must be installed (standard on Kali, available via package managers) - Root/sudo for SYN scans and OS detection
## Usage
### Quick Scan (Top 1000 ports) ```bash nmap -sC -sV -oA scan_$(date +%Y%m%d_%H%M%S) TARGET ```
### Full Port Scan ```bash nmap -p- -sC -sV -oA fullscan_$(date +%Y%m%d_%H%M%S) TARGET ```
### Fast Scan (Quick check) ```bash nmap -F -T4 TARGET ```
### Stealth SYN Scan (requires root) ```bash sudo nmap -sS -sV -O -oA stealth_$(date +%Y%m%d_%H%M%S) TARGET ```
### UDP Scan (Top 100 ports) ```bash sudo nmap -sU --top-ports 100 -oA udp_$(date +%Y%m%d_%H%M%S) TARGET ```
### Vulnerability Scan ```bash nmap --script vuln -oA vulnscan_$(date +%Y%m%d_%H%M%S) TARGET ```
### Aggressive Scan (OS, version, scripts, traceroute) ```bash nmap -A -T4 -oA aggressive_$(date +%Y%m%d_%H%M%S) TARGET ```
## Output Parsing
Nmap outputs in multiple formats with `-oA`: - `.nmap` - Human readable - `.xml` - Machine parseable - `.gnmap` - Greppable format
### Parse open ports from greppable output: ```bash grep "open" scan.gnmap | awk -F'[/]' '{print $1}' | tr ',' '\n' | sort -u ```
### Extract service versions: ```bash grep -E "^[0-9]+/" scan.nmap | awk '{print $1, $3, $4}' ```
### Quick summary from XML: ```bash xmllint --xpath "//port[@state='open']" scan.xml 2>/dev/null ```
## Common Scan Profiles
| Profile | Command | Use Case | |---------|---------|----------| | Quick | `nmap -F -T4` | Fast initial recon | | Standard | `nmap -sC -sV` | Service detection + default scripts | | Full | `nmap -p- -sC -sV` | All 65535 ports | | Stealth | `sudo nmap -sS -T2` | Evasive scanning | | Vuln | `nmap --script vuln` | Vulnerability detection | | Aggressive | `nmap -A -T4` | Full enumeration |
## Script Categories
```bash # List available scripts ls /usr/share/nmap/scripts/
# Run specific category nmap --script=default,safe TARGET nmap --script=vuln TARGET nmap --script=exploit TARGET nmap --script=auth TARGET
# Run specific script nmap --script=http-title TARGET nmap --script=smb-vuln* TARGET ```
## Target Specification
```bash # Single host nmap 192.168.1.1
# CIDR range nmap 192.168.1.0/24
# Range nmap 192.168.1.1-254
# From file nmap -iL targets.txt
# Exclude hosts nmap 192.168.1.0/24 --exclude 192.168.1.1 ```
## Timing Templates
- `-T0` Paranoid (IDS evasion) - `-T1` Sneaky (IDS evasion) - `-T2` Polite (slow) - `-T3` Normal (default) - `-T4` Aggressive (fast) - `-T5` Insane (very fast, may miss ports)
## Authorization Required
⚠️ **Only scan targets you own or have explicit written authorization to test.**
Never scan: - Public infrastructure without permission - Networks you don't control - Production systems without approval
## Example Workflow
```bash # 1. Quick scan to find live hosts nmap -sn 192.168.1.0/24 -oA live_hosts
# 2. Fast port scan on discovered hosts nmap -F -T4 -iL live_hosts.gnmap -oA quick_ports
# 3. Deep scan interesting hosts nmap -p- -sC -sV -oA deep_scan TARGET
# 4. Vulnerability scan nmap --script vuln -oA vuln_scan TARGET ```