Network Scanning

Phase 1: Passive Recon (OSINT)
  └─ Shodan, Censys, WHOIS, DNS records, Certificate Transparency
       ↓
Phase 2: Host Discovery (Who's alive?)
  └─ Ping sweep, ARP scan, TCP/UDP probes, ARP broadcast
       ↓
Phase 3: Port Scanning (What's open?)
  └─ SYN scan, Connect scan, UDP scan, Port sweep
       ↓
Phase 4: Service & Version Detection (What's running?)
  └─ Banner grabbing, version probing, NSE scripts
       ↓
Phase 5: OS Fingerprinting (What OS?)
  └─ TCP/IP stack analysis, TTL, window size
       ↓
Phase 6: Vulnerability Scanning (What's exploitable?)
  └─ NSE vuln scripts, Nessus, Nuclei, OpenVAS

WRONG approach:
nmap -A -p- 192.168.0.0/16    ← Scanning /16 with aggressive flags = 65535 hosts × 65535 ports
                                  Takes days. Floods network. Gets detected immediately.

CORRECT approach:
Step 1: fping -a -g 192.168.0.0/16 > live_hosts.txt        (fast — ICMP only)
Step 2: rustscan -a live_hosts.txt > open_ports.txt         (fast — all ports)
Step 3: nmap -sV -sC -p<ports> -iL live_hosts.txt -oA scan  (targeted — just open ports)

# --- NMAP ICMP Sweep ---
# Standard ping sweep (ICMP + TCP SYN 443 + TCP ACK 80 + ICMP timestamp)
nmap -sn 192.168.1.0/24

# Pure ICMP Echo only
sudo nmap -sn -PE 192.168.1.0/24

# ICMP Timestamp ping
sudo nmap -sn -PP 192.168.1.0/24

# ICMP Address Mask
sudo nmap -sn -PM 192.168.1.0/24

# Save live hosts to file (grepable output, extract IPs)
nmap -sn 192.168.1.0/24 -oG - | awk '/Up$/{print $2}' > live_hosts.txt

# --- FPING ---
# Install: sudo apt install fping
# Sweep a subnet (parallel ICMP, much faster than ping)
fping -a -g 192.168.1.0/24 2>/dev/null

# With statistics
fping -asgq 192.168.1.0/24

# From a CIDR, only show alive
fping -a -g 10.0.0.0/8 2>/dev/null > live_hosts.txt

# --- BASH ONE-LINER ---
# Quick subnet sweep without any tools
for i in {1..254}; do ping -c1 -W1 192.168.1.$i &; done | grep "64 bytes"

# --- POWERSHELL (Windows) ---
1..254 | ForEach-Object { Test-Connection -ComputerName "192.168.1.$_" -Count 1 -Quiet } | Where-Object {$_}

# TCP SYN ping — try specific ports (common: 22, 80, 443)
nmap -sn -PS22,80,443 192.168.1.0/24

# TCP ACK ping — bypasses stateless firewalls
nmap -sn -PA80,443 192.168.1.0/24

# Combine ICMP + TCP SYN for better coverage
sudo nmap -sn -PE -PS22,80,443,3389 192.168.1.0/24

# UDP ping (when TCP is also blocked)
sudo nmap -sn -PU53,161 192.168.1.0/24

# Use all probe types together
sudo nmap -sn -PE -PP -PS22,80,443 -PA80 -PU53 192.168.1.0/24

# NMAP ARP sweep (fastest on LAN, works even when ICMP is blocked)
sudo nmap -sn -PR 192.168.1.0/24

# arp-scan (dedicated ARP scanning tool)
# Install: sudo apt install arp-scan
sudo arp-scan -I eth0 192.168.1.0/24
sudo arp-scan -l               # Scan local network automatically
sudo arp-scan --interface=eth0 --localnet

# netdiscover (passive + active ARP)
# Install: sudo apt install netdiscover
sudo netdiscover -i eth0 -r 192.168.1.0/24
sudo netdiscover -p            # Passive mode — listen for ARP without sending

# Passive: just sniff ARP traffic
sudo tcpdump -nn arp | awk '/Request/{print $7}' | sort -u

Why ARP beats ICMP on local networks:
- ARP operates at Layer 2 (Data Link)
- Hosts MUST respond to ARP (no way to block and stay online on the subnet)
- Works even when ICMP (ping) is completely firewalled
- Returns MAC address + vendor info for additional fingerprinting
- Limitation: Only works on the same L2 network segment

#!/usr/bin/env python3
# ping_sweep.py — ICMP sweep using scapy

from scapy.all import IP, ICMP, sr1, conf
import ipaddress
import sys

conf.verb = 0  # Suppress scapy output

def icmp_sweep(network: str) -> list:
    """Sweep a subnet with ICMP Echo Requests."""
    live_hosts = []
    net = ipaddress.IPv4Network(network, strict=False)

    print(f"[*] Sweeping {network} ({net.num_addresses} hosts)")

    for ip in net.hosts():
        pkt = IP(dst=str(ip)) / ICMP()
        reply = sr1(pkt, timeout=1, verbose=0)

        if reply is not None:
            if reply.haslayer(ICMP) and reply[ICMP].type == 0:  # ICMP Echo Reply
                live_hosts.append(str(ip))
                print(f"[+] {ip} is UP")

    return live_hosts

if __name__ == "__main__":
    network = sys.argv[1] if len(sys.argv) > 1 else "192.168.1.0/24"
    live = icmp_sweep(network)
    print(f"\n[*] Found {len(live)} live hosts")
    with open("live_hosts.txt", "w") as f:
        f.write("\n".join(live))

Are you on the same subnet as the target?
│
├─ YES → ARP scan (arp-scan or nmap -PR)
│         Most reliable. Hosts cannot block ARP.
│
└─ NO → Try ICMP first (nmap -sn or fping)
         │
         ├─ ICMP blocked? → TCP SYN ping (nmap -PS80,443,22)
         │
         ├─ TCP also blocked? → UDP ping (nmap -PU53,161)
         │
         └─ Everything blocked? → Skip discovery (nmap -Pn)
                                   Treat all hosts as alive

How it works:
Client → [SYN]     → Target
Client ← [SYN+ACK] ← Target  (open port)
Client → [RST]     → Target  (never completes — "half-open")

OR

Client ← [RST+ACK] ← Target  (closed port)
Client ← (nothing) ← Target  (filtered — firewall dropping)

Why it's "stealthy":
- No full TCP connection established
- Many older IDS/IPS didn't log half-open connections
- Faster than full connect (no teardown needed)

# TCP SYN scan (requires root)
sudo nmap -sS 192.168.1.1
sudo nmap -sS -p- 192.168.1.1       # All 65535 ports
sudo nmap -sS --top-ports 1000 192.168.1.1

How it works:
Client → [SYN]     → Target
Client ← [SYN+ACK] ← Target
Client → [ACK]     → Target   ← Full connection established
Client → [RST+ACK] → Target   ← Connection immediately reset

Advantages:
- No root required (uses OS socket API)
- Works from unprivileged user
Disadvantages:
- Leaves full connection in target's logs
- Slower (full handshake + teardown)
- More detectable

# TCP Connect scan (no root needed)
nmap -sT 192.168.1.1
nmap -sT -p 22,80,443,8080 192.168.1.1

How they work:
Exploit RFC 793 ambiguity:
- Closed port → MUST respond with RST
- Open port   → MUST ignore (silently drop)
- Filtered    → No response or ICMP unreachable

FIN Scan:   Sends only FIN flag
NULL Scan:  Sends NO flags (empty TCP header)
Xmas Scan:  Sends FIN + PSH + URG flags (lights it up like a christmas tree)

Key advantage: Can bypass non-stateful firewalls and basic packet filters
Key limitation: Unreliable on Windows (Windows RSTs both open and closed)

# FIN scan
sudo nmap -sF 192.168.1.1

# NULL scan (no flags)
sudo nmap -sN 192.168.1.1

# Xmas scan (FIN + PSH + URG)
sudo nmap -sX 192.168.1.1

How it works:
- Sends ACK packet to a port (no SYN first)
- If UNFILTERED: receives RST back (regardless of open/closed)
- If FILTERED:   receives nothing (firewall drops)

Purpose: NOT to find open ports — to MAP FIREWALL RULES
         Tells you which ports the firewall is filtering.

# ACK scan — map firewall rules
sudo nmap -sA 192.168.1.1
sudo nmap -sA -p 1-1024 192.168.1.1

# Window scan variant (uses RST TCP window field to differentiate open/closed)
sudo nmap -sW 192.168.1.1

How it works (advanced):
Uses a "zombie" host with predictable IP ID sequence to scan a target while
hiding the attacker's true IP address.

Attacker → Probe zombie's IP ID (X)
Attacker → SYN to target, spoofing zombie's IP
Target   → SYN+ACK to zombie (if port open) → zombie RST → zombie IP ID increments
Attacker → Probe zombie IP ID again (X+2 = port open | X+1 = port closed)

Advantage: Extremely stealthy — target only sees zombie's IP
Requirement: Need a zombie with predictable/incremental IP ID

# Find suitable zombie (needs predictable IP ID)
sudo nmap --script ipidseq 192.168.1.0/24

# Idle scan using zombie at 192.168.1.5 (port 80 as probe port)
sudo nmap -sI 192.168.1.5:80 192.168.1.100

# Verbose zombie scan
sudo nmap -sI 192.168.1.5 -p 22,80,443 192.168.1.100 -vv

Port Sweep:
Scan a SINGLE port across MANY hosts.
Example: Is SSH (22) open on every machine in the subnet?

Use cases:
- Find all HTTP servers (80)
- Find all RDP targets (3389)
- Find all SMB hosts (445)
- Find all SSH hosts (22) — potential access points

# Port sweep — find all SSH hosts in subnet
nmap -p 22 --open 192.168.1.0/24

# Port sweep — find all RDP hosts
nmap -p 3389 --open 10.0.0.0/24

# Multiple port sweep
nmap -p 22,80,443,3389,445 --open 192.168.1.0/24

# Fast port sweep with fping pre-filter
fping -a -g 192.168.1.0/24 2>/dev/null | xargs -I{} nmap -p 22 --open {}

# masscan port sweep (much faster)
sudo masscan 192.168.1.0/24 -p 22 --rate 10000 --open-only

open
  └─ Application is actively listening and accepting connections on this port.
     A service is running. This is what you're looking for.

closed
  └─ Port is accessible (not filtered by firewall) but no service is listening.
     Host responds with RST. Useful for OS detection (shows host is alive).

filtered
  └─ Firewall or packet filter is dropping packets. Cannot determine if open.
     No response, or ICMP unreachable received. Scan is being blocked.

unfiltered
  └─ Port is accessible but open/closed status cannot be determined.
     Only returned by ACK scan. No firewall blocking, but unclear state.

open|filtered
  └─ Either open or filtered — can't tell which. Common with UDP and
     FIN/NULL/Xmas scans when no response is received.

closed|filtered
  └─ Either closed or filtered. Only returned by IP ID idle scan.

# Debian / Ubuntu / Kali
sudo apt update && sudo apt install nmap

# RHEL / CentOS / Fedora
sudo dnf install nmap

# macOS (Homebrew)
brew install nmap

# Verify version
nmap --version     # Should show 7.98+

# Update NSE script database
sudo nmap --script-updatedb

# Single IP
nmap 192.168.1.1

# Hostname
nmap target.example.com

# CIDR subnet
nmap 192.168.1.0/24

# IP range (dash notation)
nmap 192.168.1.1-254

# Multiple targets
nmap 192.168.1.1 192.168.1.5 10.0.0.1

# From file (one target per line)
nmap -iL targets.txt

# Random hosts (internet research / authorized)
nmap -iR 100           # 100 random IPs

# Exclude specific hosts
nmap 192.168.1.0/24 --exclude 192.168.1.1

# Exclude from file
nmap 192.168.1.0/24 --excludefile exclude.txt

# ─── TCP SCANS ─────────────────────────────────────────────────
# SYN scan (stealth, half-open, requires root) — DEFAULT for root
sudo nmap -sS 192.168.1.1

# TCP Connect (full handshake, no root needed) — DEFAULT without root
nmap -sT 192.168.1.1

# ACK scan (firewall rule mapping, NOT for finding open ports)
sudo nmap -sA 192.168.1.1

# Window scan (ACK + analyze TCP window field)
sudo nmap -sW 192.168.1.1

# FIN scan (just FIN flag, evades stateless filters)
sudo nmap -sF 192.168.1.1

# NULL scan (no flags)
sudo nmap -sN 192.168.1.1

# Xmas scan (FIN + PSH + URG)
sudo nmap -sX 192.168.1.1

# Maimon scan (FIN + ACK, named after Uriel Maimon)
sudo nmap -sM 192.168.1.1

# Idle / Zombie scan (spoof IP through zombie)
sudo nmap -sI <zombie_ip> 192.168.1.1

# ─── UDP SCAN ──────────────────────────────────────────────────
# UDP scan (slow — no RST on open ports)
sudo nmap -sU 192.168.1.1
sudo nmap -sU --top-ports 20 192.168.1.1   # Top 20 UDP ports only

# Combined TCP SYN + UDP
sudo nmap -sS -sU -p T:80,U:53 192.168.1.1

# ─── OTHER SCANS ───────────────────────────────────────────────
# IP Protocol scan (which IP protocols does host support?)
sudo nmap -sO 192.168.1.1

# SCTP INIT scan
sudo nmap -sY 192.168.1.1

# Custom TCP flags (raw)
sudo nmap --scanflags SYNFIN 192.168.1.1

# Specific port
nmap -p 80 192.168.1.1

# Multiple ports
nmap -p 22,80,443,8080 192.168.1.1

# Port range
nmap -p 1-1024 192.168.1.1

# ALL 65535 ports
nmap -p- 192.168.1.1

# Top 100 ports (fast scan)
nmap -F 192.168.1.1

# Top N ports
nmap --top-ports 100 192.168.1.1
nmap --top-ports 500 192.168.1.1

# By protocol prefix
nmap -p T:80,U:53 192.168.1.1   # TCP 80 and UDP 53

# Only show open ports in output
nmap -p- --open 192.168.1.1

# Basic version detection
nmap -sV 192.168.1.1

# Version intensity (0=light, 9=all probes)
nmap -sV --version-intensity 5 192.168.1.1

# Light version detection (faster)
nmap -sV --version-light 192.168.1.1

# All version probes (most thorough)
nmap -sV --version-all 192.168.1.1

# Aggressive: OS + version + scripts + traceroute
nmap -A 192.168.1.1

# OS detection (requires root and at least one open + one closed port)
sudo nmap -O 192.168.1.1

# Limit OS scan to promising targets
sudo nmap -O --osscan-limit 192.168.1.0/24

# Aggressive OS guessing (when not confident)
sudo nmap -O --osscan-guess 192.168.1.1

# Combined OS + version
sudo nmap -O -sV 192.168.1.1

# Default scripts (-sC is shorthand for --script=default)
nmap -sC 192.168.1.1

# Run specific script
nmap --script http-enum 192.168.1.1

# Run multiple scripts
nmap --script http-enum,http-headers 192.168.1.1

# Run a script category
nmap --script vuln 192.168.1.1          # All vulnerability scripts
nmap --script discovery 192.168.1.1    # All discovery scripts
nmap --script exploit 192.168.1.1      # All exploit scripts
nmap --script brute 192.168.1.1        # All brute-force scripts
nmap --script safe 192.168.1.1         # All safe scripts (low impact)

# Wildcard matching
nmap --script "http-*" 192.168.1.1     # All HTTP scripts
nmap --script "smb-vuln*" 192.168.1.1  # All SMB vulnerability scripts

# Pass arguments to scripts
nmap --script http-brute --script-args userdb=users.txt,passdb=pass.txt -p 80 192.168.1.1

# List all available scripts
ls /usr/share/nmap/scripts/ | grep -i vuln
nmap --script-help "vuln"               # Describe vuln scripts

# ─── WEB ────────────────────────────────────────────────────────
nmap --script http-enum -p 80,443 192.168.1.1           # Enumerate web directories
nmap --script http-headers -p 80,443 192.168.1.1        # HTTP response headers
nmap --script http-methods -p 80,443 192.168.1.1        # Allowed HTTP methods
nmap --script http-title -p 80,443 192.168.1.1          # Grab page title
nmap --script http-auth-finder -p 80,443 192.168.1.1    # Find auth mechanisms
nmap --script http-vuln* -p 80,443 192.168.1.1          # All HTTP vulns

# ─── SMB ────────────────────────────────────────────────────────
nmap --script smb-enum-shares -p 445 192.168.1.1        # List SMB shares
nmap --script smb-enum-users -p 445 192.168.1.1         # Enumerate SMB users
nmap --script smb-os-discovery -p 445 192.168.1.1       # OS via SMB
nmap --script smb-vuln-ms17-010 -p 445 192.168.1.1      # EternalBlue check
nmap --script smb-vuln* -p 445 192.168.1.1              # All SMB vulns
nmap --script smb2-capabilities -p 445 192.168.1.1      # SMB2 capabilities

# ─── SSH ────────────────────────────────────────────────────────
nmap --script ssh-hostkey -p 22 192.168.1.1             # SSH host key
nmap --script ssh-auth-methods -p 22 192.168.1.1        # Auth methods (pubkey, password)
nmap --script ssh2-enum-algos -p 22 192.168.1.1         # SSH algorithms
nmap --script ssh-brute -p 22 192.168.1.1               # SSH brute force (use carefully)

# ─── FTP ────────────────────────────────────────────────────────
nmap --script ftp-anon -p 21 192.168.1.1                # Anonymous FTP login
nmap --script ftp-bounce -p 21 192.168.1.1              # FTP bounce attack check
nmap --script ftp-brute -p 21 192.168.1.1               # FTP brute force
nmap --script ftp-vuln-cve2010-4221 -p 21 192.168.1.1  # FTP proftpd vuln

# ─── DNS ────────────────────────────────────────────────────────
nmap --script dns-zone-transfer -p 53 192.168.1.1       # Zone transfer attempt
nmap --script dns-brute --script-args dns-brute.domain=example.com 192.168.1.1
nmap --script dns-recursion -p 53 192.168.1.1           # Open resolver check

# ─── DATABASE ───────────────────────────────────────────────────
nmap --script mysql-info -p 3306 192.168.1.1            # MySQL info
nmap --script mysql-empty-password -p 3306 192.168.1.1  # Empty root password
nmap --script ms-sql-info -p 1433 192.168.1.1           # MSSQL info
nmap --script ms-sql-empty-password -p 1433 192.168.1.1
nmap --script redis-info -p 6379 192.168.1.1            # Redis info (often unauth)
nmap --script mongodb-info -p 27017 192.168.1.1         # MongoDB info

# ─── SSL/TLS ────────────────────────────────────────────────────
nmap --script ssl-enum-ciphers -p 443 192.168.1.1       # SSL/TLS cipher analysis
nmap --script ssl-heartbleed -p 443 192.168.1.1         # Heartbleed
nmap --script ssl-cert -p 443 192.168.1.1               # Certificate info
nmap --script ssl-dh-params -p 443 192.168.1.1          # Logjam / DH key vuln

# ─── VULN SCAN (CATCH-ALL) ──────────────────────────────────────
nmap --script vuln -sV 192.168.1.1                      # All vulnerability checks

# -T0  Paranoid:   1 probe per 5 minutes — IDS evasion, extremely slow
# -T1  Sneaky:     1 probe per 15 seconds — IDS evasion
# -T2  Polite:     0.4 sec between probes — reduces bandwidth
# -T3  Normal:     Default — balanced speed/accuracy
# -T4  Aggressive: 10ms between probes — fast, assumes reliable network
# -T5  Insane:     5ms — very fast, may miss ports on lossy networks

nmap -T0 192.168.1.1    # Paranoid — near-invisible
nmap -T1 192.168.1.1    # Sneaky — low detection risk
nmap -T4 192.168.1.1    # Aggressive — fast lab/CTF scans
nmap -T5 192.168.1.1    # Insane — maximum speed

# Fine-grained timing control
nmap --min-rate 100 192.168.1.1        # At least 100 packets/sec
nmap --max-rate 500 192.168.1.1        # No more than 500 packets/sec
nmap --max-retries 2 192.168.1.1       # Limit retransmissions
nmap --host-timeout 30m 192.168.1.0/24 # Skip host after 30 minutes
nmap --scan-delay 500ms 192.168.1.1   # 500ms between probes

# Normal text output
nmap -oN scan.txt 192.168.1.1

# XML (parseable, Metasploit importable)
nmap -oX scan.xml 192.168.1.1

# Grepable output
nmap -oG scan.gnmap 192.168.1.1

# ALL formats simultaneously (most recommended)
nmap -oA scan_results 192.168.1.1    # Creates .nmap, .xml, .gnmap

# Additional output options
nmap -v 192.168.1.1         # Verbose (show ports as found)
nmap -vv 192.168.1.1        # More verbose
nmap --open 192.168.1.1     # Show only open ports
nmap --reason 192.168.1.1   # Show why port is in given state
nmap --packet-trace 192.168.1.1  # Show every packet sent/received

# ─── QUICK START (CTF / Lab) ────────────────────────────────────
nmap -sC -sV -T4 -oA initial 192.168.1.1

# ─── ALL PORTS + SERVICE DETECTION ─────────────────────────────
nmap -sV -sC -p- -oA full_scan 192.168.1.1

# ─── COMPREHENSIVE (OS + version + scripts + traceroute) ────────
sudo nmap -A -T4 -p- 192.168.1.1 -oA comprehensive

# ─── STEALTH SCAN ───────────────────────────────────────────────
sudo nmap -sS -T2 -p- 192.168.1.1 -oA stealth

# ─── FULL TCP + UDP (thorough, slow) ────────────────────────────
sudo nmap -sS -sU -sV -O -sC -p- -T4 -oA fullscan 192.168.1.1

# ─── SUBNET DISCOVERY THEN SCAN ─────────────────────────────────
nmap -sn 192.168.1.0/24 -oG - | awk '/Up$/{print $2}' > live.txt
nmap -sV -sC -T4 -iL live.txt -oA subnet_scan

# ─── VULNERABILITY SCAN ─────────────────────────────────────────
nmap --script vuln -sV -p- 192.168.1.1 -oA vuln_scan

# ─── WEB SERVER ENUMERATION ─────────────────────────────────────
nmap -sV --script=http-enum,http-headers,http-methods -p 80,443,8080,8443 192.168.1.1

# ─── SMB DEEP SCAN ──────────────────────────────────────────────
nmap --script smb-enum-shares,smb-enum-users,smb-vuln* -p 445 192.168.1.1

# ─── STEALTH DECOY SCAN ─────────────────────────────────────────
sudo nmap -sS -T2 -f -D RND:5 --source-port 53 --data-length 50 192.168.1.1

Nmap alone (all ports):  ~17 minutes
RustScan (all ports):    ~7-19 seconds
RustScan → Nmap:         19 sec discovery + targeted Nmap scan

# From GitHub releases (Debian/Ubuntu/Kali)
wget https://github.com/bee-san/RustScan/releases/download/2.4.1/rustscan_2.4.1_amd64.deb
sudo dpkg -i rustscan_2.4.1_amd64.deb

# Via Cargo (Rust package manager)
cargo install rustscan

# Docker
docker pull rustscan/rustscan:latest
docker run -it --rm rustscan/rustscan:latest -a 192.168.1.1

# Verify
rustscan --version

# Scan all ports on a single host
rustscan -a 192.168.1.1

# Scan specific ports
rustscan -a 192.168.1.1 -p 22,80,443

# Scan a subnet
rustscan -a 192.168.1.0/24

# Scan from a file
rustscan -a $(cat live_hosts.txt | tr '\n' ',')

# Set batch size (number of open sockets at once)
rustscan -a 192.168.1.1 -b 500        # Lower = more stable, slower
rustscan -a 192.168.1.1 -b 5000       # Higher = faster, may drop packets

# Set timeout per port (milliseconds)
rustscan -a 192.168.1.1 -t 2000       # 2 second timeout

# Auto-pipe to Nmap with default scripts + version detection
rustscan -a 192.168.1.1 -- -sC -sV

# All ports → Nmap aggressive scan
rustscan -a 192.168.1.1 -- -A

# All ports → Nmap vuln scripts
rustscan -a 192.168.1.1 -- --script vuln

# All ports → Nmap with output
rustscan -a 192.168.1.1 -- -sV -oA rustscan_output

# Subnet scan → Nmap
rustscan -a 192.168.1.0/24 -b 1000 -- -sC -sV -oA subnet_output

# Custom Nmap flags after --
rustscan -a 192.168.1.1 -- -sV -sC -T4 -oN output.txt

# ─── TARGET ─────────────────────────────────────────────────────
-a <addr>           # Address / CIDR / file
-p <ports>          # Specific ports (comma-separated)
--range <range>     # Port range (e.g. 1-1024)

# ─── PERFORMANCE ────────────────────────────────────────────────
-b <batch_size>     # Sockets per batch (default: 4500)
-t <timeout>        # Timeout in ms (default: 1500)
--tries <n>         # Number of tries per port (default: 1)
--ulimit <n>        # Override ulimit (file descriptor limit)

# ─── OUTPUT ─────────────────────────────────────────────────────
-g, --greppable     # Greppable output
--accessible        # Accessible mode (screen reader friendly)

# ─── NMAP PASSTHROUGH ───────────────────────────────────────────
-- [nmap flags]     # Everything after -- is passed to Nmap

# Debian / Ubuntu / Kali
sudo apt install masscan

# From source (latest)
git clone https://github.com/robertdavidgraham/masscan
cd masscan
make -j
sudo make install

# Verify
masscan --version

# Scan a single port on a CIDR
sudo masscan 192.168.1.0/24 -p 80

# Multiple ports
sudo masscan 192.168.1.0/24 -p 22,80,443

# Port range
sudo masscan 192.168.1.0/24 -p 1-65535

# All ports
sudo masscan 192.168.1.0/24 -p 0-65535

# Only show open ports
sudo masscan 192.168.1.0/24 -p 80 --open-only

# Internet-scale: scan all IPv4 for HTTP
sudo masscan 0.0.0.0/0 -p 80 --rate 100000

# Multiple CIDR targets
sudo masscan 10.0.0.0/8 192.168.0.0/16 172.16.0.0/12 -p 80 --open-only

# Set packets per second (PPS)
sudo masscan 192.168.1.0/24 -p 80 --rate 1000      # 1,000 pps (conservative)
sudo masscan 192.168.1.0/24 -p 80 --rate 10000     # 10,000 pps (moderate)
sudo masscan 192.168.1.0/24 -p 80 --rate 100000    # 100,000 pps (aggressive)
sudo masscan 192.168.1.0/24 -p 80 --rate 1000000   # 1M pps (wire speed)

# Practical limits:
# Standard NIC + Linux: ~2.5M pps
# Windows:              ~250K pps
# PF_RING driver:       ~25M pps

Rate Selection Guide:
- Internal lab network:      --rate 10000   (10K pps)
- Authorized corporate scan: --rate 1000    (1K pps) — safe, won't saturate
- Full internet (authorized): --rate 100000 (100K pps)
- Never exceed link capacity — you'll flood the network

# Banner grabbing requires a separate source IP (to prevent OS RST from killing connection)
# Assign masscan a different IP on the same subnet

# Method 1: Separate source IP
sudo masscan 192.168.1.0/24 -p 80,443 --banners --source-ip 192.168.1.200

# Method 2: iptables firewall to drop RSTs (alternative)
sudo iptables -A INPUT -p tcp --dport 60000 -j DROP
sudo masscan 192.168.1.0/24 -p 80 --banners --source-port 60000

# Banner grabbing supported protocols:
# HTTP, HTTPS, FTP, SMTP, POP3, IMAP4, SSH, SSL, SMBv1, SMBv2, Telnet, RDP, VNC, memcached

# Grab HTTP banners with custom user-agent
sudo masscan 192.168.1.0/24 -p 80,443 --banners \
  --http-user-agent "Mozilla/5.0 (Windows NT 10.0; Win64; x64)" \
  --source-ip 192.168.1.200

# Check for Heartbleed via masscan
sudo masscan 192.168.1.0/24 -p 443 --heartbleed

# List format (plain text)
sudo masscan 192.168.1.0/24 -p 80 -oL results.txt

# XML (Nmap-compatible)
sudo masscan 192.168.1.0/24 -p 80 -oX results.xml

# JSON
sudo masscan 192.168.1.0/24 -p 80 -oJ results.json

# Grepable (similar to nmap -oG)
sudo masscan 192.168.1.0/24 -p 80 -oG results.gnmap

# Binary (for pausing/resuming)
sudo masscan 192.168.1.0/24 -p 80 -oB results.bin

# Append to existing output
sudo masscan 192.168.1.0/24 -p 443 -oL results.txt --append-output

#!/usr/bin/env python3
# masscan_to_nmap.py — Run masscan for speed, then Nmap for depth
# Based on common red team workflow

import subprocess
import json
import sys
from collections import defaultdict

TARGET = sys.argv[1] if len(sys.argv) > 1 else "192.168.1.0/24"
RATE   = "10000"

print(f"[*] Step 1: Masscan fast port discovery on {TARGET}")
masscan_cmd = [
    "masscan", TARGET,
    "-p", "1-65535",
    "--rate", RATE,
    "--open-only",
    "-oJ", "/tmp/masscan_out.json"
]
subprocess.run(masscan_cmd, check=True)

# Parse masscan JSON
with open("/tmp/masscan_out.json") as f:
    try:
        results = json.load(f)
    except json.JSONDecodeError:
        results = []

# Group ports by IP
host_ports = defaultdict(set)
for entry in results:
    ip = entry["ip"]
    for port_data in entry.get("ports", []):
        host_ports[ip].add(str(port_data["port"]))

print(f"\n[*] Step 2: Nmap targeted scan on {len(host_ports)} hosts")
for ip, ports in host_ports.items():
    port_list = ",".join(sorted(ports, key=int))
    print(f"  [→] Scanning {ip} on ports: {port_list}")
    nmap_cmd = [
        "nmap", ip,
        "-p", port_list,
        "-sV", "-sC", "-T4",
        "-oA", f"nmap_{ip.replace('.','_')}"
    ]
    subprocess.run(nmap_cmd)

print("\n[+] Done. Check nmap_*.nmap files for results.")

# Target
-p <ports>           # Port specification (single, range, comma list)
--range <CIDR>       # IP range target
-iL <file>           # Read targets from file

# Rate / Performance
--rate <pps>         # Packets per second
--retries <n>        # Packet retry count (default: 1)
--wait <seconds>     # Seconds to wait after scan (default: 10)

# Source / Interface
--source-ip <ip>     # Source IP (needed for banner grab)
--source-port <port> # Source port
--interface <iface>  # Network interface
--adapter-ip <ip>    # Adapter IP (alternative to --source-ip)

# Output
-oL <file>           # List output
-oX <file>           # XML output
-oJ <file>           # JSON output
-oG <file>           # Grepable output
-oB <file>           # Binary output
--open-only          # Only show open ports

# Features
--banners            # Grab service banners (needs --source-ip)
--heartbleed         # Check for Heartbleed
--http-user-agent    # Custom HTTP user-agent string

# Misc
--excludefile <file> # Exclude IPs from scan
--echo               # Print config and exit
-c <configfile>      # Read config from file

sudo apt install hping3    # Debian/Ubuntu/Kali
sudo yum install hping3    # RHEL/CentOS
brew install hping         # macOS

# ICMP ping (like traditional ping)
hping3 -1 192.168.1.1

# ICMP sweep on a subnet (--rand-dest + /24)
sudo hping3 -1 192.168.1.x --rand-dest -I eth0

# TCP SYN ping on port 80
hping3 -S -p 80 192.168.1.1

# UDP ping on port 53
hping3 -2 -p 53 192.168.1.1

# Fast sweep — send only 1 packet
hping3 -S -p 80 --count 1 192.168.1.1

# TCP SYN scan on port range
hping3 -S --scan 1-1024 192.168.1.1

# SYN scan on specific ports
hping3 -S --scan 22,80,443,3389 192.168.1.1

# TCP ACK scan
hping3 -A --scan 1-1024 192.168.1.1

# FIN scan
hping3 -F --scan 1-1024 192.168.1.1

# NULL scan
hping3 --scan 1-1024 192.168.1.1     # No flags set

# Xmas scan
hping3 -F -P -U --scan 1-1024 192.168.1.1

# UDP scan
hping3 -2 --scan 1-1024 192.168.1.1

# Spoof source IP (IP decoy)
hping3 -S -p 80 -a 1.2.3.4 192.168.1.1    # Pretend to be 1.2.3.4

# Fragment packets
hping3 -S -p 80 -f 192.168.1.1

# Use specific source port (bypass firewall rules)
hping3 -S -p 80 --baseport 53 192.168.1.1   # Source from port 53 (DNS)
hping3 -S -p 443 --baseport 80 192.168.1.1  # Source from port 80

# Set TTL (useful for firewalking)
hping3 -S -p 80 --ttl 10 192.168.1.1

# Idle scan detection (probe for IP ID prediction)
hping3 -S -p 80 192.168.1.5   # Monitor IP ID field in replies

# Protocol modes
-1   # ICMP mode
-2   # UDP mode
-S   # TCP SYN flag
-A   # TCP ACK flag
-F   # TCP FIN flag
-P   # TCP PSH flag
-U   # TCP URG flag
-R   # TCP RST flag

# Target / port
-p   # Destination port
--scan   # Port range scan mode

# Speed / count
-c   # Packet count (e.g. -c 1)
--faster     # Default timing (less delay)
--flood      # Send packets as fast as possible

# Source manipulation
-a   # Spoof source IP
--baseport   # Base source port
--ttl        # Time to live

# Output
-V   # Verbose
-q   # Quiet mode

# Install
sudo apt install arp-scan

# Scan local network (auto-detect subnet)
sudo arp-scan -l
sudo arp-scan --localnet

# Scan specific interface
sudo arp-scan -I eth0 192.168.1.0/24

# Scan specific range
sudo arp-scan 10.0.0.1-10.0.0.254

# Verbose output (includes manufacturer from MAC)
sudo arp-scan -v -I eth0 192.168.1.0/24

# Show duplicate responses (detect ARP spoofing)
sudo arp-scan --arpspa=192.168.1.1 -I eth0 192.168.1.0/24

# Install
sudo apt install netdiscover

# Active scan (sends ARP requests)
sudo netdiscover -i eth0 -r 192.168.1.0/24

# Passive mode (listens for ARP — completely silent)
sudo netdiscover -p -i eth0

# Fast mode
sudo netdiscover -f -i eth0 -r 192.168.1.0/24

#!/usr/bin/env python3
# arp_sweep.py — ARP host discovery using scapy

from scapy.all import ARP, Ether, srp

def arp_sweep(ip_range: str) -> list:
    """
    Send ARP broadcast to a subnet and collect responses.
    Returns list of (ip, mac) tuples for live hosts.
    """
    # Create ARP broadcast packet
    arp_pkt = ARP(pdst=ip_range)
    ether_pkt = Ether(dst="ff:ff:ff:ff:ff:ff")  # Broadcast MAC
    combined = ether_pkt / arp_pkt

    # Send and receive (srp = send/receive at Layer 2)
    answered, _ = srp(combined, timeout=3, verbose=0)

    live_hosts = []
    for sent, received in answered:
        live_hosts.append({
            "ip":  received.psrc,    # Sender IP (the host that replied)
            "mac": received.hwsrc    # Sender MAC address
        })

    return live_hosts

if __name__ == "__main__":
    target = "192.168.1.0/24"
    print(f"[*] ARP sweep on {target}")
    hosts = arp_sweep(target)

    print(f"\n{'IP':<20} {'MAC':<20}")
    print("-" * 40)
    for h in hosts:
        print(f"{h['ip']:<20} {h['mac']:<20}")

    print(f"\n[+] Found {len(hosts)} live hosts")

# Install netcat
sudo apt install netcat-openbsd   # OpenBSD variant (recommended)

# Grab FTP banner (port 21)
nc -v 192.168.1.1 21

# Grab SSH banner (port 22)
nc -v 192.168.1.1 22

# Grab SMTP banner (port 25)
nc -v 192.168.1.1 25

# Grab HTTP banner (port 80) — send HTTP request
echo -e "HEAD / HTTP/1.0\r\n\r\n" | nc -v 192.168.1.1 80

# Grab HTTPS banner (needs openssl)
openssl s_client -connect 192.168.1.1:443 < /dev/null 2>/dev/null | head -20

# Interactive connection
nc 192.168.1.1 80
HEAD / HTTP/1.0          ← type this, press Enter twice
                          ← server banner returns

# HTTP headers (reveals web server, version, tech)
curl -I http://192.168.1.1
curl -I https://192.168.1.1

# Follow redirects
curl -IL https://192.168.1.1

# Custom headers (stealth grab)
curl -I http://192.168.1.1 -H "User-Agent: Mozilla/5.0"

# Verbose (full request + response)
curl -v http://192.168.1.1

# wget headers
wget -S --spider http://192.168.1.1 2>&1 | grep "HTTP/"

# Version detection across common service ports
nmap -sV -p 21,22,25,80,110,143,443,3306,3389 192.168.1.1

# Version detection with all probes
nmap -sV --version-all 192.168.1.1

# Banner script (explicit banner grab)
nmap --script banner -p 21,22,25,80 192.168.1.1

# FTP banner
telnet 192.168.1.1 21

# SMTP banner
telnet 192.168.1.1 25

# HTTP banner
telnet 192.168.1.1 80
HEAD / HTTP/1.0          ← then Enter twice

# Note: telnet is not encrypted — only use on test environments

#!/usr/bin/env python3
# banner_grab.py — Grab banners from a list of IP:port pairs

import socket
import sys

def grab_banner(ip: str, port: int, timeout: float = 3.0) -> str:
    """Attempt to grab a banner from ip:port."""
    try:
        with socket.create_connection((ip, port), timeout=timeout) as s:
            s.settimeout(timeout)

            # For HTTP, send a HEAD request
            if port in (80, 8080, 8000, 8443):
                s.send(b"HEAD / HTTP/1.0\r\nHost: " + ip.encode() + b"\r\n\r\n")
            elif port == 443:
                return "[HTTPS — use openssl s_client instead]"

            banner = s.recv(1024).decode('utf-8', errors='ignore').strip()
            return banner
    except Exception as e:
        return f"[ERROR: {e}]"

# ─── Configuration ────────────────────────────────────────────
TARGETS = [
    ("192.168.1.1", 21),    # FTP
    ("192.168.1.1", 22),    # SSH
    ("192.168.1.1", 25),    # SMTP
    ("192.168.1.1", 80),    # HTTP
    ("192.168.1.1", 110),   # POP3
    ("192.168.1.1", 143),   # IMAP
    ("192.168.1.1", 3306),  # MySQL
    ("192.168.1.1", 3389),  # RDP
]
# ─────────────────────────────────────────────────────────────

print(f"{'IP:PORT':<25} {'BANNER'}")
print("-" * 80)

for ip, port in TARGETS:
    banner = grab_banner(ip, port)
    first_line = banner.split('\n')[0][:60]
    print(f"{f'{ip}:{port}':<25} {first_line}")

Key passive indicators:
TTL values (initial TTL before decrement):
  Windows:  128
  Linux:    64
  macOS:    64
  Cisco:    255
  Solaris:  255

TCP Window Size:
  Windows 10: 65535
  Linux:      5840–29200
  macOS:      65535

TCP Options (SYN packet):
  MSS, SACK, Window Scaling, NOP arrangement varies by OS

ICMP:
  How errors are returned, what data is included in ICMP errors

# Passively capture and analyze (p0f)
# Install: sudo apt install p0f
sudo p0f -i eth0 -p -o /tmp/p0f.log

# Read a pcap
sudo p0f -r capture.pcap

# p0f shows: OS, browser, NAT detection, uptime estimate

# Nmap OS detection (sends multiple probes, requires root)
sudo nmap -O 192.168.1.1

# OS detection with aggressive guessing
sudo nmap -O --osscan-guess 192.168.1.1

# Only scan when at least one open + one closed port exists
sudo nmap -O --osscan-limit 192.168.1.0/24

# Combined: version detection + OS + scripts
sudo nmap -A 192.168.1.1

# Example output interpretation:
# OS details: Microsoft Windows 10 1903-1909 (93%)
#             Linux 4.15 - 5.8 (94%)

# Quick guess from ping response (unreliable but fast)
ping -c 1 192.168.1.1 | grep ttl

# TTL ~64  → Linux/macOS
# TTL ~128 → Windows
# TTL ~255 → Network device (Cisco/HP)

# With nmap
nmap -sn --packet-trace 192.168.1.1 2>&1 | grep "ttl="

# Basic UDP scan (slow — recommend top-ports only)
sudo nmap -sU 192.168.1.1

# Top 20 UDP ports (practical starting point)
sudo nmap -sU --top-ports 20 192.168.1.1

# Top 100 UDP ports
sudo nmap -sU --top-ports 100 192.168.1.1

# Specific UDP ports
sudo nmap -sU -p 53,67,68,69,123,161,162,500 192.168.1.1

# Combined TCP SYN + UDP
sudo nmap -sS -sU -p T:80,T:443,U:53,U:161 192.168.1.1

# Increase speed (but less reliable)
sudo nmap -sU --top-ports 20 --max-retries 1 -T4 192.168.1.1

# Service version on UDP
sudo nmap -sU -sV --top-ports 20 192.168.1.1

# ─── DNS (53/UDP) ────────────────────────────────────────────────
# Check for open recursive DNS
nmap -sU -p 53 --script=dns-recursion 192.168.1.1

# Zone transfer via DNS (TCP 53)
dig axfr @192.168.1.1 example.com

# ─── SNMP (161/UDP) ──────────────────────────────────────────────
# Check SNMP with default community string "public"
nmap -sU -p 161 --script snmp-info 192.168.1.1
nmap -sU -p 161 --script snmp-brute 192.168.1.1

# ─── TFTP (69/UDP) ───────────────────────────────────────────────
nmap -sU -p 69 192.168.1.1

# ─── NTP (123/UDP) ───────────────────────────────────────────────
nmap -sU -p 123 --script ntp-info 192.168.1.1
nmap -sU -p 123 --script ntp-monlist 192.168.1.1   # Amplification check

# ─── DHCP (67/UDP) ───────────────────────────────────────────────
nmap -sU -p 67 --script broadcast-dhcp-discover

# ─── NetBIOS (137/UDP) ───────────────────────────────────────────
nmap -sU -p 137 --script nbstat 192.168.1.1

# Install SNMP tools
sudo apt install snmp snmp-mibs-downloader

# snmpwalk — enumerate all OIDs from a community string
snmpwalk -v2c -c public 192.168.1.1                  # Full walk
snmpwalk -v2c -c public 192.168.1.1 1.3.6.1.2.1.1   # System info
snmpwalk -v2c -c public 192.168.1.1 1.3.6.1.2.1.25.4.2.1.2  # Running processes
snmpwalk -v2c -c public 192.168.1.1 1.3.6.1.2.1.25.6.3.1.2  # Installed software
snmpwalk -v2c -c public 192.168.1.1 1.3.6.1.2.1.4.20.1.1    # Network interfaces
snmpwalk -v2c -c public 192.168.1.1 1.3.6.1.4.1.77.1.2.25   # Windows user accounts

# snmpget — get specific OID value
snmpget -v2c -c public 192.168.1.1 sysName.0

# SNMP v3 (auth + encryption)
snmpwalk -v3 -l authPriv -u admin -a SHA -A authpass -x AES -X privpass 192.168.1.1

# Install: sudo apt install onesixtyone
# Single host
onesixtyone -c /usr/share/wordlists/rockyou.txt 192.168.1.1

# Multiple hosts
onesixtyone -c community_strings.txt -i hosts.txt

# Common community strings to try:
echo -e "public\nprivate\ncommunity\nadmin\nmanager\nmonitor\nread\nwrite" > communities.txt
onesixtyone -c communities.txt 192.168.1.1

# SNMP info enumeration
nmap -sU -p 161 --script snmp-info 192.168.1.1

# SNMP brute force community strings
nmap -sU -p 161 --script snmp-brute 192.168.1.1

# Enumerate SNMP interfaces
nmap -sU -p 161 --script snmp-interfaces 192.168.1.1

# System info via SNMP
nmap -sU -p 161 --script snmp-sysdescr 192.168.1.1

# Windows users via SNMP
nmap -sU -p 161 --script snmp-win32-users 192.168.1.1

# Running processes
nmap -sU -p 161 --script snmp-processes 192.168.1.1

# All record types
dig example.com ANY

# A records (IP addresses)
dig example.com A

# MX records (mail servers)
dig example.com MX

# NS records (name servers)
dig example.com NS

# TXT records (SPF, DMARC, verification)
dig example.com TXT

# Reverse DNS (PTR)
dig -x 192.168.1.1

# Specify DNS server
dig @8.8.8.8 example.com

# Zone transfer — leaks all DNS records if misconfigured
dig axfr @192.168.1.1 example.com

# dnsrecon zone transfer
dnsrecon -d example.com -t axfr

# nmap zone transfer script
nmap --script dns-zone-transfer -p 53 192.168.1.1

# Nmap DNS brute force
nmap --script dns-brute --script-args dns-brute.domain=example.com 192.168.1.1

# dnsrecon
dnsrecon -d example.com -t brt                     # Brute force
dnsrecon -d example.com -t std                     # Standard enumeration
dnsrecon -d example.com -t rvl -n 192.168.1.0/24  # Reverse lookup

# fierce
fierce --domain example.com

# amass (modern subdomain enumeration — passive + active)
# Install: go install -v github.com/owasp-amass/amass/v4/...@master
amass enum -d example.com
amass enum -d example.com -active   # Active DNS queries

# Install Shodan CLI
pip install shodan
shodan init <YOUR_API_KEY>

# Search for a specific host
shodan host 192.168.1.1

# Search for open ports on a domain
shodan search "hostname:example.com"

# Find SSH on default port 22
shodan search "port:22 openssh"

# Find all HTTP servers in a city
shodan search "city:London port:80"

# Find specific web server
shodan search "Apache 2.4"

# Network range scan via Shodan
shodan search "net:192.168.1.0/24"

# Count results
shodan count "port:3389 os:windows"

# Download results
shodan download results "port:443 ssl.cert.issuer.cn:example.com"

# Internet-facing services
port:22 product:"OpenSSH"              SSH servers
port:3389 os:"Windows"                  RDP on Windows
port:27017 product:"MongoDB"           Unauthenticated MongoDB
port:6379 product:"Redis"              Unauthenticated Redis
port:9200 product:"Elasticsearch"      Exposed Elasticsearch
port:5900 product:"VNC"                VNC remote access
port:23 telnet                          Open Telnet

# By organization / ASN
org:"Target Company Name"
asn:AS12345

# By country
country:US port:3389
country:IN port:22

# Webcams / IoT
product:"webcam"
title:"IP Camera"
title:"DVR"

# Industrial Control Systems
port:102 siemens                       SCADA S7
port:502 modbus                        Modbus TCP
port:20000 dnp                         DNP3

# Install CLI
pip install censys

# Configure
censys config

# Search for hosts
censys search "services.port:80 and services.http.response.body:login"

# Host lookup
censys view hosts 192.168.1.1

# Certificate transparency
censys search "parsed.names: example.com" --index certificates

# WHOIS — domain/IP ownership
whois example.com
whois 192.168.1.1

# crt.sh — Certificate Transparency (find subdomains)
curl "https://crt.sh/?q=%25.example.com&output=json" | python3 -m json.tool

# theHarvester — emails, subdomains, hosts, names
# Install: pip install theHarvester
theHarvester -d example.com -b all

# Amass passive
amass enum -passive -d example.com

# DNSDumpster (web)
# https://dnsdumpster.com

# VirusTotal passive DNS
curl "https://www.virustotal.com/vtapi/v2/domain/report?apikey=KEY&domain=example.com"

# Split packets into 8-byte fragments (bypasses some DPI)
sudo nmap -sS -f 192.168.1.1

# More fragments (16-byte chunks)
sudo nmap -sS -f -f 192.168.1.1

# Custom MTU (must be multiple of 8)
sudo nmap -sS --mtu 24 192.168.1.1

# Use decoy IPs to hide your real IP
sudo nmap -sS -D 1.2.3.4,5.6.7.8,ME 192.168.1.1     # ME = your real IP position
sudo nmap -sS -D RND:5 192.168.1.1                    # 5 random decoys
sudo nmap -sS -D RND:10,ME 192.168.1.1                # 10 random + your IP

# hping3 decoy
hping3 -S -p 80 -a 1.2.3.4 192.168.1.1   # Spoof source as 1.2.3.4

# Scan from trusted source port (DNS=53, HTTP=80)
sudo nmap -sS --source-port 53 192.168.1.1
sudo nmap -sS -g 80 192.168.1.1     # -g is alias for --source-port

# hping3 specific source port
hping3 -S -p 80 --baseport 53 192.168.1.1

# Slow scan — under many IDS thresholds
sudo nmap -sS -T1 192.168.1.1             # One probe ~15 sec apart
sudo nmap -sS -T0 192.168.1.1             # One probe ~5 min apart

# Manual timing control
sudo nmap -sS --scan-delay 5s 192.168.1.1       # 5 second delay between probes
sudo nmap -sS --max-rate 1 192.168.1.1          # 1 packet/sec max

# Masscan slow rate
sudo masscan 192.168.1.0/24 -p 80 --rate 100   # 100 pps — conservative

# Randomize host scan order (avoid sequential IP pattern)
sudo nmap -sS --randomize-hosts 192.168.1.0/24

# Add random data to packets (bypass length-based signatures)
sudo nmap -sS --data-length 50 192.168.1.1
sudo nmap -sS --data-length 100 192.168.1.1

# Combine multiple evasion techniques
sudo nmap -sS -T2 -f -D RND:5 --source-port 53 --data-length 50 --randomize-hosts 192.168.1.0/24

# Spoof MAC address (only relevant on local network)
sudo nmap -sS --spoof-mac 0 192.168.1.1           # Random vendor MAC
sudo nmap -sS --spoof-mac Apple 192.168.1.1       # Spoof Apple MAC
sudo nmap -sS --spoof-mac 00:11:22:33:44:55 192.168.1.1  # Specific MAC

# Use HTTP as cover for other scans
nmap -sV --script http-methods 192.168.1.1

# Scan over SSL (looks like normal HTTPS traffic)
nmap -sV -p 443 --script ssl-enum-ciphers 192.168.1.1

# Use nmap's --proxies option to route through HTTP proxy
nmap --proxies http://proxy.example.com:8080 192.168.1.1

#!/bin/bash
# recon.sh — Full network recon pipeline
# Usage: sudo ./recon.sh 192.168.1.0/24 ./output/

TARGET=$1
OUTDIR=$2
LHOSTS="$OUTDIR/live_hosts.txt"

mkdir -p "$OUTDIR"
echo "[*] Target: $TARGET"
echo "[*] Output: $OUTDIR"

# Step 1: Host discovery
echo "[1] Ping sweep..."
fping -a -g "$TARGET" 2>/dev/null > "$LHOSTS"
echo "[+] Found $(wc -l < "$LHOSTS") live hosts"

# Step 2: Fast port discovery (RustScan or masscan)
echo "[2] Fast port scan (masscan)..."
sudo masscan -iL "$LHOSTS" -p 1-65535 --rate 5000 \
  --open-only -oJ "$OUTDIR/masscan.json"

# Step 3: Parse masscan output, build nmap target list
python3 - <<'EOF'
import json, sys
with open("${OUTDIR}/masscan.json") as f:
    data = json.load(f)
hosts = {}
for entry in data:
    ip = entry["ip"]
    ports = [str(p["port"]) for p in entry.get("ports", [])]
    if ip not in hosts:
        hosts[ip] = set()
    hosts[ip].update(ports)
with open("${OUTDIR}/nmap_targets.txt", "w") as f:
    for ip, ports in hosts.items():
        f.write(f"{ip}:{','.join(sorted(ports, key=int))}\n")
EOF

# Step 4: Targeted Nmap scan
echo "[3] Targeted Nmap service scan..."
while IFS=: read -r ip ports; do
    nmap -sV -sC -p "$ports" "$ip" -oA "$OUTDIR/nmap_$ip" --open
done < "$OUTDIR/nmap_targets.txt"

# Step 5: Quick vuln check
echo "[4] Vulnerability scan..."
nmap --script vuln -sV -iL "$LHOSTS" -oA "$OUTDIR/vuln_scan"

echo "[+] Done. Results in $OUTDIR"

#!/usr/bin/env python3
# port_scanner.py — Threaded TCP connect scanner

import socket
import sys
from concurrent.futures import ThreadPoolExecutor, as_completed
from datetime import datetime

def scan_port(ip: str, port: int, timeout: float = 1.0) -> tuple:
    """Attempt TCP connect to ip:port. Returns (port, state)."""
    try:
        with socket.create_connection((ip, port), timeout=timeout) as s:
            # Try to grab banner
            try:
                s.settimeout(2.0)
                banner = s.recv(1024).decode('utf-8', errors='ignore').strip()
                first_line = banner.split('\n')[0][:50] if banner else ""
            except:
                first_line = ""
            return (port, "open", first_line)
    except (ConnectionRefusedError, OSError):
        return (port, "closed", "")
    except socket.timeout:
        return (port, "filtered", "")

def scan_host(ip: str, ports: list, threads: int = 100) -> list:
    """Scan multiple ports on a host using a thread pool."""
    open_ports = []

    with ThreadPoolExecutor(max_workers=threads) as executor:
        futures = {executor.submit(scan_port, ip, p): p for p in ports}

        for future in as_completed(futures):
            port, state, banner = future.result()
            if state == "open":
                open_ports.append((port, banner))
                print(f"  [+] {ip}:{port}/tcp  OPEN  {banner}")

    return sorted(open_ports, key=lambda x: x[0])

if __name__ == "__main__":
    target = sys.argv[1] if len(sys.argv) > 1 else "127.0.0.1"
    start_port = int(sys.argv[2]) if len(sys.argv) > 2 else 1
    end_port   = int(sys.argv[3]) if len(sys.argv) > 3 else 1024

    print(f"\n[*] Scanning {target}: ports {start_port}-{end_port}")
    print(f"[*] Started: {datetime.now()}\n")

    ports = range(start_port, end_port + 1)
    results = scan_host(target, ports, threads=200)

    print(f"\n[+] Found {len(results)} open ports")
    print(f"[*] Finished: {datetime.now()}")

# Install (Go-based)
go install -v github.com/projectdiscovery/naabu/v2/cmd/naabu@latest

# Basic scan
naabu -host 192.168.1.1

# Subnet scan
naabu -host 192.168.1.0/24

# All ports
naabu -host 192.168.1.1 -p -

# Top 100 ports
naabu -host 192.168.1.1 -top-ports 100

# Specific ports
naabu -host 192.168.1.1 -p 22,80,443,8080

# Pipe from subfinder → naabu → httpx (full chain)
subfinder -d example.com | naabu | httpx

# Naabu → Nmap passthrough
naabu -host 192.168.1.1 -nmap-cli "nmap -sV -sC"

# Save output
naabu -host 192.168.1.1 -p - -o open_ports.txt

#!/usr/bin/env python3
# parse_nmap.py — Parse Nmap XML output

import xml.etree.ElementTree as ET
import sys

def parse_nmap_xml(xml_file: str) -> list:
    """Parse nmap XML and extract hosts + open ports."""
    tree = ET.parse(xml_file)
    root = tree.getroot()
    results = []

    for host in root.findall('host'):
        # Check if host is up
        status = host.find('status')
        if status is None or status.get('state') != 'up':
            continue

        # Get IP
        addr = host.find("address[@addrtype='ipv4']")
        ip = addr.get('addr') if addr is not None else "Unknown"

        # Get OS guess
        os_guess = ""
        osclass = host.find('.//osmatch')
        if osclass is not None:
            os_guess = osclass.get('name', '')

        # Get open ports
        open_ports = []
        for port in host.findall('.//port'):
            state = port.find('state')
            if state is not None and state.get('state') == 'open':
                portid  = port.get('portid')
                proto   = port.get('protocol')
                svc     = port.find('service')
                name    = svc.get('name', '') if svc is not None else ''
                product = svc.get('product', '') if svc is not None else ''
                version = svc.get('version', '') if svc is not None else ''

                open_ports.append({
                    "port":    portid,
                    "proto":   proto,
                    "service": name,
                    "product": product,
                    "version": version
                })

        results.append({
            "ip":    ip,
            "os":    os_guess,
            "ports": open_ports
        })

    return results

if __name__ == "__main__":
    xml_file = sys.argv[1] if len(sys.argv) > 1 else "scan.xml"
    hosts = parse_nmap_xml(xml_file)

    for host in hosts:
        print(f"\n{'='*50}")
        print(f"Host: {host['ip']}")
        if host['os']:
            print(f"OS:   {host['os']}")
        print(f"\nPort    Proto  Service     Product/Version")
        print("-" * 50)
        for p in host['ports']:
            ver = f"{p['product']} {p['version']}".strip()
            print(f"{p['port']:<8}{p['proto']:<7}{p['service']:<12}{ver}")

# Find all open ports across a scan
grep "open" scan.nmap

# Extract just IPs with open port 80
grep "80/open" scan.gnmap | awk '{print $2}'

# Extract all open ports for a specific host
grep "Host: 192.168.1.1" scan.gnmap

# Count total open ports
grep -c "open" scan.nmap

# Find all hosts with SMB open
grep "445/open" scan.gnmap | awk '{print $2}'

# Convert gnmap to IP:port list
grep "open" scan.gnmap | awk '{print $2}' | while read ip; do
    grep "Host: $ip" scan.gnmap | grep -oP '\d+/open' | \
    awk -v ip="$ip" -F/ '{print ip":"$1}'
done

# Parse masscan list output
grep "open" masscan_results.txt | awk '{print $4, $3}' | sed 's|/tcp||'

# Parse masscan JSON with jq
jq -r '.[] | "\(.ip):\(.ports[].port)"' masscan_results.json

# Extract just IPs with port 443 open
jq -r '.[] | select(.ports[].port == 443) | .ip' masscan_results.json

┌──────────┬───────┬──────────────────────────────────────────────┐
│ Port     │ Proto │ Service / Notes                              │
├──────────┼───────┼──────────────────────────────────────────────┤
│ 21       │ TCP   │ FTP — check anon login, banner, version      │
│ 22       │ TCP   │ SSH — check version, weak keys, auth methods │
│ 23       │ TCP   │ Telnet — plaintext, high value on IoT/legacy │
│ 25       │ TCP   │ SMTP — email relay, banner, version          │
│ 53       │ T/U   │ DNS — zone transfer, open resolver           │
│ 67/68    │ UDP   │ DHCP — rogue DHCP, starvation               │
│ 69       │ UDP   │ TFTP — often unauthenticated, file access    │
│ 80       │ TCP   │ HTTP — web server, enumerate dirs/headers    │
│ 110      │ TCP   │ POP3 — email, banner, brute force           │
│ 111      │ TCP   │ RPC — portmapper, enumerate RPC services     │
│ 123      │ UDP   │ NTP — monlist amplification                  │
│ 135      │ TCP   │ MS-RPC — Windows endpoint mapper            │
│ 137-139  │ T/U   │ NetBIOS — name resolution, enumeration      │
│ 143      │ TCP   │ IMAP — email, brute force                   │
│ 161      │ UDP   │ SNMP — community strings, dump config       │
│ 389      │ TCP   │ LDAP — AD enumeration, anon bind            │
│ 443      │ TCP   │ HTTPS — SSL/TLS analysis, web app scan      │
│ 445      │ TCP   │ SMB — shares, users, EternalBlue            │
│ 500      │ UDP   │ IKE/IPSec — VPN, ISAKMP                    │
│ 512-514  │ TCP   │ rsh/rlogin/rexec — legacy Unix (high value) │
│ 587      │ TCP   │ SMTP Submission — relay, auth               │
│ 631      │ TCP   │ IPP — CUPS printing, often exposed           │
│ 873      │ TCP   │ rsync — unauthenticated file sync           │
│ 993      │ TCP   │ IMAPS — SSL IMAP                            │
│ 995      │ TCP   │ POP3S — SSL POP3                            │
│ 1433     │ TCP   │ MSSQL — SA account, xp_cmdshell             │
│ 1521     │ TCP   │ Oracle DB — TNS listener                    │
│ 1723     │ TCP   │ PPTP VPN                                    │
│ 2049     │ TCP   │ NFS — mount filesystem, check showmount     │
│ 2375     │ TCP   │ Docker API (unauthenticated) — HIGH VALUE   │
│ 3306     │ TCP   │ MySQL — default creds, root empty password  │
│ 3389     │ TCP   │ RDP — BlueKeep, brute force, NLA bypass     │
│ 4369     │ TCP   │ Erlang Port Mapper (RabbitMQ)               │
│ 4444     │ TCP   │ Common Metasploit default listener           │
│ 5432     │ TCP   │ PostgreSQL — default creds                  │
│ 5900     │ TCP   │ VNC — often no auth, brute force            │
│ 6379     │ TCP   │ Redis — usually unauthenticated! HIGH VALUE │
│ 8080     │ TCP   │ HTTP-alt — proxy, alternate web server       │
│ 8443     │ TCP   │ HTTPS-alt — web apps on alt port            │
│ 8888     │ TCP   │ Jupyter Notebook — unauthenticated RCE!     │
│ 9200     │ TCP   │ Elasticsearch — unauthenticated, HIGH VALUE │
│ 9300     │ TCP   │ Elasticsearch cluster                        │
│ 11211    │ TCP   │ Memcached — data leak, amplification DDoS   │
│ 27017    │ TCP   │ MongoDB — unauthenticated, dump all DBs     │
│ 50000    │ TCP   │ SAP, IBM DB2                                │
└──────────┴───────┴──────────────────────────────────────────────┘

# Step 1: Host Discovery (pick the fastest method for your environment)
fping -a -g 192.168.1.0/24 2>/dev/null > live_hosts.txt          # ICMP sweep
sudo arp-scan -I eth0 192.168.1.0/24 | grep -v "Starting\|Interface" # ARP (LAN)
nmap -sn 192.168.1.0/24 -oG - | awk '/Up$/{print $2}' >> live_hosts.txt

# Step 2: Fast Port Discovery
rustscan -a $(paste -sd, live_hosts.txt) > open_ports.txt         # All ports, seconds
# OR
sudo masscan -iL live_hosts.txt -p 1-65535 --rate 10000 -oL ports.txt

# Step 3: Targeted Deep Scan (only discovered ports)
nmap -sV -sC -p<discovered_ports> -iL live_hosts.txt -oA full_scan

# Step 4: Service-Specific Enumeration
nmap --script vuln -iL live_hosts.txt -oA vuln_scan
nmap --script smb-vuln* -p 445 -iL live_hosts.txt
nmap --script http-enum -p 80,443,8080 -iL live_hosts.txt

Environment                  Recommended timing
─────────────────────────────────────────────────────
CTF / Lab                    -T4 or -T5 (fast)
Authorized pentest           -T3 (default, balanced)
Noisy environment (warned)   -T2 (polite)
Evading basic IDS            -T1 or -T0 (sneaky)
Critical infrastructure      --scan-delay 1s --max-rate 10

What do you need?                 Scan type
──────────────────────────────────────────────────────────────
Find live hosts (LAN)            ARP scan (arp-scan / nmap -PR)
Find live hosts (WAN/routed)     ICMP sweep (fping / nmap -sn)
Standard port scan               TCP SYN (-sS) with root
No root available                TCP Connect (-sT)
Evade simple firewall            FIN/NULL/Xmas (-sF/-sN/-sX)
Map firewall rules               ACK scan (-sA)
Hide source IP completely        Idle scan (-sI)
Check UDP services               UDP scan (-sU --top-ports 20)
Fast ALL ports discovery         RustScan -a host -- -sV
Internet-scale discovery         Masscan --rate 100000
Vulnerability check              nmap --script vuln

# Discovery
fping -a -g 192.168.1.0/24 2>/dev/null                              # ICMP sweep
sudo arp-scan -l                                                      # LAN ARP
nmap -sn 192.168.1.0/24 -oG - | awk '/Up$/{print $2}'              # Nmap sweep

# Quick CTF start
nmap -sC -sV -T4 -oA scan TARGET

# All ports
nmap -p- -T4 TARGET

# All ports + service
nmap -p- -sV -sC TARGET -oA full

# Fast all ports (rustscan → nmap)
rustscan -a TARGET -- -sC -sV

# Internet-scale (masscan)
sudo masscan TARGET/24 -p 1-65535 --rate 10000 --open-only -oL out.txt

# Vuln scan
nmap --script vuln -sV TARGET

# SMB
nmap --script smb-vuln* -p 445 TARGET

# Passive recon (shodan CLI)
shodan host TARGET

# Banner grab
nc -v TARGET 22
echo -e "HEAD / HTTP/1.0\r\n\r\n" | nc TARGET 80

# DNS zone transfer
dig axfr @TARGET domain.com

open         → Service listening, exploit it
closed       → Host is alive, port accessible, nothing listening
filtered     → Firewall is blocking (try evasion)
unfiltered   → ACK scan result — reachable but state unknown
open|filtered → Open or filtered — try different scan type

# Must-run scripts per service
SSH:     --script ssh-auth-methods,ssh-hostkey -p 22
FTP:     --script ftp-anon,ftp-brute -p 21
HTTP:    --script http-enum,http-headers,http-title -p 80,443
HTTPS:   --script ssl-enum-ciphers,ssl-cert,ssl-heartbleed -p 443
SMB:     --script smb-enum-shares,smb-vuln*,smb-os-discovery -p 445
RDP:     --script rdp-vuln-ms12-020 -p 3389
SNMP:    --script snmp-info,snmp-brute -p 161 (UDP)
MySQL:   --script mysql-info,mysql-empty-password -p 3306
Vuln:    --script vuln (catch-all — run last)