Port Scanning

Basic port scanning commands.

Network Port Scanning Recommendation

1. Create active host list

   1. Scan most used 1000 TCP port

   2. Scan most used 100 UDP Port

2. Deep Scan Active Hosts

   1. Scan all TCP ports from active host list with service detection

Create Active Host List

The below assumes that you have a targets.txt file with all your in-scope targets in the directory double above (In nNmap -iL targets format)

TCP Discovery Scan

sudo nmap -sS --top-ports 1000 -iL ../../targets.txt -oA Nmap_TCP_1000_$(date +"%b-%d-%Y") -Pn -T4 --host-timeout=24h --max-retries=1 --defeat-rst-ratelimit --open --disable-arp-ping

UDP Discovery Scan

sudo nmap -sU --top-ports 100 -iL ../../targets.txt -oA Nmap_UDP_100_$(date +"%b-%d-%Y") -Pn -T4 --host-timeout=24h --max-retries=1 --defeat-rst-ratelimit --open --disable-arp-ping

Get Active Hosts from Results

cat *.gnmap | grep -E "open/tcp|open/udp" | cut -d " " -f2 | sort -u >> ../../active.txt

Deep Scan Active Hosts

sudo nmap -sSV -p 0-65535 -iL ../active.txt -oA Nmap_TCP_All_$(date +"%b-%d-%Y") -Pn -T4 --host-timeout=24h --max-retries=1 --defeat-rst-ratelimit --open --disable-arp-ping

Extra Options

Scheduled Scans

# TCP
at midnight 01/01/26 #(change date)

# Add TCP Scan command using full file paths
# Add UDP Scan command using full file paths

# <CTRL+D> to exit

MassScan

All TCP Scan

sudo masscan --rate=10000 -p- -vv --open-only -iL ../../targets.txt --output-format grepable --output-filename MassScan_TCP_All_$(date +"%b-%d-%Y").gnmap | tee -a MassScan_TCP_All_$(date +"%b-%d-%Y").log

Top 100 UDP Scan

sudo masscan --rate=10000 -pU:7,U:9,U:17,U:19,U:49,U:53,U:67-69,U:80,U:88,U:111,U:120,U:123,U:135-139,U:158,U:161-162,U:177,U:427,U:443,U:445,U:497,U:500,U:514-515,U:518,U:520,U:593,U:623,U:626,U:631,U:996-999,U:1022-1023,U:1025-1030,U:1433-1434,U:1645-1646,U:1701,U:1718-1719,U:1812-1813,U:1900,U:2000,U:2048-2049,U:2222-2223,U:3283,U:3456,U:3703,U:4444,U:4500,U:5000,U:5060,U:5353,U:5632,U:9200,U:10000,U:17185,U:20031,U:30718,U:31337,U:32768-32769,U:32771,U:32815,U:33281,U:49152-49154,U:49156,U:49181-49182,U:49185-49186,U:49188,U:49190-49194,U:49200-49201,U:65024 -iL ../targets.txt --output-format grepable --output-filename MassScan_UDP_100_$(date +"%b-%d-%Y").gnmap | tee -a MassScan_UDP_100_$(date +"%b-%d-%Y").log