Comment on page
Nmap Scanning
autorecon 10.10.10.3
autorecon -t targets.txt
nmap -sC -sV -O -oA nmap/initial 10.10.10.3
Comprehensive nmap scans in the background to make sure we cover all bases.
nmap -sC -sV -O -p- -oA nmap/full 10.10.10.3
nmap -sU -O -p- -oA nmap/udp 10.10.10.3
SPARTA is a python GUI application which simplifies network infrastructure penetration testing by aiding the penetration tester in the scanning and enumeration phase.
nmap -A $ip
$ nmap -sn $ip/24
$ nmap -vvv -sn $ip/24
If you want a little faster,
$ nmap -sn -n $ip/24 > ip-range.txt
$ nmap -sP 10.0.0.0-100
$ cat ip-range.txt | grep -B 1 "Host is up"
and now filter all the IPs and create a file.
grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}' ip-range.txt > only-ip.txt
nmap www.testhostname.com
$ nmap -A -oA filename $ip/24
The command:
- Scan 1024 most common ports
- Run OS detection
- Run default nmap scripts
- Save the result into
.nmap,.gnmapand.xml - Faster
Scan 100 most common ports
nmap -F $ip
nmap -sC -sV -vv -oA quick $ip
nmap -sU -sV -vv -oA quick_udp $ip
nmap -sC -sV -p- -vv -oA full 10.10.10.10
for x in 7000 8000 9000; do nmap -Pn --host_timeout 201 --max-retries 0 -p $x $ip; done
Scanning more deeply:
$ nmap -v -p- -sT $ip
Example:
$ nmap -v -p- -sT 10.0.1.0/24
This command:
- Scan all 65535 ports with full connect scan
- Take very long time
- Print out straigt away instead of having to wait until end of the scan
Tips:
Scanning this takes a long time, suggest to leave the scan running overnight, when you're sleep or move on to different box in the meantime.
$ nmap -p T:80,443,8080 $ip/24
Use
-T: specifies TCP ports. Use -U: for UDP ports.$ nmap -v -sn $ip/24 | grep down | awk '{print $5}' > filename.txt
nmap -sV -sC -v -oA output $ip
Scanning this might slow and unreliadble
$ nmap $ip -sU
Example:
$ nmap 10.11.1.X -sU
Create a text file contains of our targets machine (like in method Scan for unused IP addresses and store in text file):
192.168.1.144
192.168.1.179
192.168.1.182
Run this nmap command with
-iLnmap -iL list-of-ips.txt
Grab the latest bash script
git clone https://github.com/superkojiman/onetwopunch.git
cd onetwopunch
Create a text file contains of our targets machine (like in method Scan for unused IP addresses and store in text file):
192.168.1.144
192.168.1.179
192.168.1.182
Then, run the script and tell it to read our txt file and perform TCP scan against each target.
./onetwopunch.sh -t ip-range.txt -p tcp
So, the idea behind the script to generate a scan of 65,535 ports on the targets. The script use unicornscan to scan all ports, and make a list of those ports that are open. The script then take the open ports and pass them to nmap for service detection.
Last modified 1yr ago