Perform advanced network scanning and service enumeration using Nmap for penetration testing and security assessments. Use this skill when conducting network reconnaissance, port scanning, service version detection, OS fingerprinting, and vulnerability scanning. Covers stealth scanning, firewall evasion, NSE script usage, and network mapping for infrastructure penetration tests.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
설치 방법 보기설치하기 전에 에이전트에게 전달되는 지시 내용을 확인할 수 있습니다.
# Ping sweep (find live hosts)
nmap -sn 10.10.10.0/24 -oA host_discovery
# ARP scan (same subnet, most reliable)
nmap -PR -sn 10.10.10.0/24
# Without ping (bypass ICMP blocking)
nmap -Pn -sn 10.10.10.0/24
# TCP SYN ping on common ports
nmap -PS22,80,443,445 -sn 10.10.10.0/24
# Multiple ranges
nmap -sn 10.10.10.0/24 192.168.1.0/24 172.16.0.0/16
# Quick top 100 ports
nmap -F 10.10.10.100
# Full TCP scan (all 65535 ports)
nmap -p- 10.10.10.100
# Common pentest scan (SYN scan + version + scripts + OS)
sudo nmap -sS -sV -sC -O -p- 10.10.10.100 -oA full_scan
# UDP scan (slow but important)
sudo nmap -sU --top-ports 200 10.10.10.100
# Speed-optimized full scan
nmap -p- --min-rate 10000 -T4 10.10.10.100
# Stealth SYN scan (default with root)
sudo nmap -sS -p- 10.10.10.100
# Connect scan (without root)
nmap -sT -p- 10.10.10.100
# Masscan for ultra-fast initial scan (then Nmap for details)
masscan 10.10.10.0/24 -p1-65535 --rate=10000 -oJ masscan_results.json
# Parse results and feed to Nmap for service detection
# Version detection
nmap -sV -p 22,80,443,445,3306,8080 10.10.10.100
# Aggressive version detection
nmap -sV --version-intensity 5 -p- 10.10.10.100
# OS detection
sudo nmap -O 10.10.10.100
# Combined scan (version + OS + default scripts)
sudo nmap -A -p- 10.10.10.100 -oA aggressive_scan
# Run default scripts
nmap -sC -p 22,80,445 10.10.10.100
# Vulnerability scanning
nmap --script vuln -p 22,80,445 10.10.10.100
# Specific vulnerability checks
nmap --script smb-vuln-ms17-010 -p 445 10.10.10.100 # EternalBlue
nmap --script ssl-heartbleed -p 443 10.10.10.100 # Heartbleed
nmap --script http-shellshock -p 80 10.10.10.100 # Shellshock
# SMB enumeration
nmap --script smb-enum-shares,smb-enum-users,smb-os-discovery -p 445 10.10.10.100
# HTTP enumeration
nmap --script http-enum,http-headers,http-methods,http-title -p 80,443 10.10.10.100
# DNS enumeration
nmap --script dns-brute -p 53 ns1.target.com
# Banner grab
nmap --script banner -p 21,22,25,80,110,143,443 10.10.10.100
# Fragment packets
nmap -f -p 80,443 10.10.10.100
# Specify MTU
nmap --mtu 24 -p 80,443 10.10.10.100
# Decoy scan
nmap -D RND:10 -p 80 10.10.10.100
# Source port manipulation
nmap --source-port 53 -p 80 10.10.10.100
# Append random data
nmap --data-length 200 -p 80 10.10.10.100
# MAC address spoofing
nmap --spoof-mac 0 -p 80 10.10.10.100
# Idle zombie scan
nmap -sI zombie_host:port target_host
| Concept | Description |
|---|---|
| SYN scan (-sS) | Half-open scan, stealthier, requires root |
| Connect scan (-sT) | Full TCP connection, no root needed |
| UDP scan (-sU) | Scans UDP ports, very slow |
| NSE | Nmap Scripting Engine for extended functionality |
| OS fingerprinting | Identifying the target's operating system |
Network Scan Report
====================
Target: 10.10.10.0/24
Live Hosts: 42/254
Open Ports Summary:
22/tcp (SSH): 15 hosts
80/tcp (HTTP): 23 hosts
443/tcp (HTTPS): 18 hosts
445/tcp (SMB): 8 hosts (2 vulnerable to MS17-010!)
3389/tcp (RDP): 5 hosts
Critical Findings:
1. 10.10.10.50 - MS17-010 (EternalBlue) vulnerable
2. 10.10.10.100 - Anonymous FTP access enabled
3. 10.10.10.75 - Outdated OpenSSH 7.2 (CVE-2016-6515)
For cross-cutting methodology applicable to all vulnerability classes, see:
_shared/references/elite-chaining-strategy.md— Exploit chaining methodology and high-payout chain patterns_shared/references/elite-report-writing.md— HackerOne-optimized report writing, CWE quick reference_shared/references/real-world-bounties.md— Verified disclosed bounties by vulnerability class
아직 리뷰가 없습니다. 사용해 본 소감을 남겨 주세요.
로그인 없이 쓸 수 있습니다. 사용 후기, 질문, 작동하지 않은 환경 등을 편하게 남겨 주세요.
아직 댓글이 없습니다. 첫 댓글을 남겨 보세요.
Exploit pervasive logical flaws in Multi-Factor Authentication (MFA/2FA) implementations to bypass the secondary authentication challenge entirely. Techniques include response manipulation, referal spoofing, token reuse, and predictable backup codes.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
401/403 bypass playbook. Use when encountering access-denied responses on admin panels, API endpoints, or restricted paths. Covers path manipulation, HTTP method tampering, header injection, protocol downgrade, and automated bypass tools.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Complete PortSwigger deep-dive with exact payloads for every lab variant including zero-day techniques
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Active Directory ACL abuse playbook. Use when exploiting misconfigured AD permissions including GenericAll, WriteDACL, DCSync rights, shadow credentials, LAPS reading, GPO abuse, and BloodHound-guided attack paths.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Execute AS-REP Roasting to extract and crack the NTLM hashes of Active Directory user accounts that have the "Do not require Kerberos preauthentication" flag explicitly enabled. This attack generates a recoverable Ticket Granting Ticket (TGT) without requiring the attacker to authenticate first.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
AD Certificate Services attack playbook. Use when targeting misconfigured AD CS for privilege escalation via ESC1-ESC13 template abuse, NTLM relay to enrollment, CA officer abuse, and certificate-based persistence.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.