46 lines
1.0 KiB
Markdown
46 lines
1.0 KiB
Markdown
```
|
|
nmap -p- -T5 <ip>
|
|
nmap -p 22,25,80 -A <ip>
|
|
```
|
|
|
|
```
|
|
nmap -p- --min-rate 5000 <ip>
|
|
```
|
|
|
|
```
|
|
nmap -sn 192.168.102.0/24 -T4 -oN discovery.nmap
|
|
nmap -iL output.txt -T4 -sV -sC -p- -Pn -n --open -A -oN version.nmap
|
|
```
|
|
|
|
```
|
|
nmap -sU -p- --min-rate 5000 <ip>
|
|
```
|
|
|
|
- Conduct a full UDP port scan (may be all `open|filtered`) because open ports rarely respond to empty probes. No response --> open port or dropped by firewall.
|
|
|
|
|
|
```
|
|
nmap -A -sV -sC -sU 10.11.1.111 --script=*enum --top-ports 20
|
|
```
|
|
|
|
- When version scanning is enabled with -sV (or -A), it will send UDP probes to every `open|filtered` port. If any of the probes elicit a response from an `open|filtered`port, the state is changed to open.
|
|
|
|
|
|
```
|
|
nmap script=vuln 192.168.193.211
|
|
```
|
|
|
|
- Nmap scripts location `/usr/share/nmap/scripts/`
|
|
|
|
```
|
|
proxychains nmap --top-ports=20 -sT -Pn 10.5.5.20
|
|
```
|
|
|
|
- SOCKS proxies require a TCP connection to be made and thus a half-open or SYN scan cannot be used with ProxyChains
|
|
|
|
|
|
Scans thru Socks proxy
|
|
|
|
```
|
|
nmap --proxies socks4://proxy-ip:8080 target-ip
|
|
``` |