# recon/port\_enumeration

## Useful Nmap Scan Combinations

### Port Discovery

#### High-Speed Port Scan

<pre class="language-bash"><code class="lang-bash"><strong>nmap -p- --min-rate 5000 -T5 --open -Pn TARGET_IP
</strong></code></pre>

#### Stealth Scan

```bash
nmap -sS -p- --open -Pn TARGET_IP
```

### Service Detection

#### Service-Version + Default Script + OS detection

```bash
nmap -p PORT_LIST sCV -O -Pn TARGET_IP
```

### UDP Scan

```bash
nmap -sU TARGET_IP
```

## Automating Port Reconnaissance

If we are auditing a network, and not a single host, we can proceed as follows once we have the list of targets in a file named, for example, `targets.txt`:

#### Step 1:  Initial Port Discovery

```bash

nmap -sS --min-rate MIN_RATE -p- --open -iL targets.txt -oN tcp_scan.txt

# For Labs/Certs => MIN_RATE = ~5000
# For real networks => MIN_RATE = ~100

```

To be even more considerate, we can add the following options on real networks:

* `--max-retries 2`: Limits retries per probe to 2, reducing additional network traffic from lost packets.
* `--max-scan-delay 20ms`: Adds a 20ms delay between probes, decreasing scan aggressiveness and network load.

```bash
nmap -sS --min-rate 100 -p- --open --max-retries 2 --max-scan-delay 20ms -iL targets.txt -oN tcp_scan.txt
```

#### Step 2:  Extracting Port List

Extract the list of ports from the `tcp_scan.txt` file using commands to filter, format, and prepare them as a comma-separated list (`PORT_LIST`).

<pre class="language-bash"><code class="lang-bash"><strong>grep '^[0-9]' tcp_scan.txt | cut -d '/' -f1 | sort -u | xargs | tr ' ' ',' 
</strong></code></pre>

#### Step 3: Targeted Port Scan

Conduct an Nmap scan (`nmap`) targeting hosts listed in `targets.txt` (`-iL targets.txt`) using the ports listed in `PORT_LIST`. This scan focuses on open ports (`--open`), and includes checks for service scripts (`-sC`), service/version detection (`-sV`), and excludes host discovery (`-Pn`). Results are saved in `tcp_scan_full.txt`

```bash
nmap -p<PORT_LIST> --open -sC -sV -iL targets.txt -Pn -oN tcp_scan_full.txt
```

## Port Enum

{% content-ref url="recon-port\_enumeration/21-tcp-ftp" %}
[21-tcp-ftp](https://xhuntr3ss.gitbook.io/xhuntr3sss-hack-vault/usd-vault/vaultusd-cheatsheets/recon-port_enumeration/21-tcp-ftp)
{% endcontent-ref %}

{% content-ref url="recon-port\_enumeration/22-tcp-ssh" %}
[22-tcp-ssh](https://xhuntr3ss.gitbook.io/xhuntr3sss-hack-vault/usd-vault/vaultusd-cheatsheets/recon-port_enumeration/22-tcp-ssh)
{% endcontent-ref %}
