nmap
#
Maybe the most used tool when it comes to network discovery and port knocking.
Network discovery#
1nmap -sn 10.10.10.0/24
Machine scan#
1nmap 10.10.10.1 # classic soft scan
2nmap 10.10.10.1 -sU # UDP scan
3nmap 10.10.10.1 -p 80,443 # scan only ports 80 and 443
4nmap 10.10.10.1 -p 1000-2000 # scan all ports between 1000 and 2000
5nmap 10.10.10.1 -p- # scan all ports
6nmap 10.10.10.1 -sV # get services and versions running on open ports
7nmap 10.10.10.1 -sC # use default scripts when scanning
8nmap 10.10.10.1 -O # detect OS
9nmap 10.10.10.1 -A # equivalent to `nmap 10.10.10.1 -O -sV -sC --traceroute`
Global switches#
1-o{N,X,S,G} output_file # save results in output_file in different formats
2-T{1..5} # use from 1 to 5 threads
3-6 # enable IPv6
4-S ip # spoof given IP
5-e interface # use given interface