Network reconnaissance and security auditing using Nmap for port scanning, service enumeration, and vulnerability detection. Use when: (1) Conducting authorized network reconnaissance and asset discovery, (2) Enumerating network services and identifying running versions, (3) Detecting security vulnerabilities through NSE scripts, (4) Mapping network topology and firewall rules, (5) Performing compliance scanning for security assessments, (6) Validating network segmentation and access controls.
Network reconnaissance and security auditing using Nmap for port scanning, service enumeration, and vulnerability detection. Use when: (1) Conducting authorized network reconnaissance and asset discovery, (2) Enumerating network services and identifying running versions, (3) Detecting security vulnerabilities through NSE scripts, (4) Mapping network topology and firewall rules, (5) Performing compliance scanning for security assessments, (6) Validating network segmentation and access controls.
Nmap (Network Mapper) is the industry-standard tool for network discovery, security auditing, and vulnerability assessment. This skill provides structured workflows for authorized reconnaissance operations including port scanning, service enumeration, OS fingerprinting, and vulnerability detection using Nmap Scripting Engine (NSE).
IMPORTANT: Network scanning may be disruptive and must only be conducted with proper authorization. Always ensure written permission before scanning networks or systems you do not own.
Quick Start
Basic host discovery and port scanning:
# Quick scan of common ports
nmap -F <target-ip>
# Scan top 1000 ports with service detection
nmap -sV <target-ip>
# Comprehensive scan with OS detection and default scripts
nmap -A <target-ip>
Core Workflow
Network Reconnaissance Workflow
Progress:
[ ] 1. Verify authorization and scope
[ ] 2. Perform host discovery and asset enumeration
[ ] 3. Conduct port scanning on live hosts
[ ] 4. Enumerate services and versions
[ ] 5. Perform OS fingerprinting and detection
[ ] 6. Run NSE scripts for vulnerability detection
[ ] 7. Document findings and generate reports
[ ] 8. Validate results and identify false positives
Work through each step systematically. Check off completed items.
1. Authorization Verification
CRITICAL: Before any scanning activities:
Confirm written authorization from network owner
Review scope document for in-scope IP ranges and domains
Verify scanning windows and rate-limiting requirements
Document emergency contact for accidental disruption
# OS detectionsudo nmap -O <target-ip>
# Aggressive OS detection with version scanningsudo nmap -A <target-ip>
# Limit OS detection to promising targetssudo nmap -O --osscan-limit <target-ip>
# Guess OS aggressivelysudo nmap -O --osscan-guess <target-ip>
OS fingerprinting indicators:
TCP/IP stack characteristics
Open port patterns
Service banners and versions
TTL values and TCP window sizes
6. NSE Script Scanning
Nmap Scripting Engine for advanced reconnaissance and vulnerability detection:
# Run default NSE scripts
nmap -sC <target-ip>
# Run all scripts in category
nmap --script=vuln <target-ip>
nmap --script=exploit <target-ip>
nmap --script=discovery <target-ip>
# Run specific script
nmap --script=http-sql-injection <target-ip>
# Multiple scripts
nmap --script=smb-vuln-ms17-010,smb-vuln-cve-2017-7494 <target-ip>
# Script with arguments
nmap --script=http-brute --script-args http-brute.path=/admin <target-ip>
# Normal output to screen and file
nmap <target-ip> -oN scan_results.txt
# XML output (for parsing/import)
nmap <target-ip> -oX scan_results.xml
# Grepable output (for easy parsing)
nmap <target-ip> -oG scan_results.gnmap
# All formats
nmap <target-ip> -oA scan_results
# Script kiddie output (for fun)
nmap <target-ip> -oS scan_results.skid
Convert and process results:
# Convert XML to HTML report
xsltproc /usr/share/nmap/nmap.xsl scan_results.xml -o report.html
# Parse XML with Python
python3 -c "import xml.etree.ElementTree as ET; tree = ET.parse('scan_results.xml'); root = tree.getroot(); [print(host.find('address').get('addr')) for host in root.findall('host')]"# Extract open ports from grepable output
grep 'Ports:' scan_results.gnmap | awk '{print $2, $5}'
8. Firewall and IDS Evasion
Techniques to evade detection (authorized testing only):
# Fragment packetssudo nmap -f <target-ip>
# Use decoyssudo nmap -D RND:10 <target-ip>
sudo nmap -D decoy1,decoy2,ME,decoy3 <target-ip>
# Spoof source IP (requires raw packet privileges)sudo nmap -S <spoofed-ip> -e <interface> <target-ip>
# Randomize target order
nmap --randomize-hosts -iL targets.txt
# Use proxy
nmap --proxies http://proxy:8080 <target-ip>
# Idle scan (zombie host required)sudo nmap -sI <zombie-host> <target-ip>
Security Considerations
Authorization & Legal Compliance
Written Permission: Obtain explicit authorization before scanning any network
Scope Definition: Only scan explicitly authorized IP ranges and ports
Disruption Risk: Some scans (DOS, exploit scripts) can crash services
Privacy: Service enumeration may expose sensitive information
Log Traces: Scanning activities are typically logged by firewalls and IDS
Operational Security
Rate Limiting: Use --max-rate to avoid overwhelming targets
Timing: Schedule scans during approved maintenance windows
Bandwidth: Consider network impact, especially for large scans
Noise: Aggressive scans are easily detected by security monitoring
False Positives: Validate findings before reporting vulnerabilities
Audit Logging
Document all reconnaissance activities:
Scan start and end timestamps
Source IP address and scanner hostname
Target IP ranges and ports scanned
Nmap command-line arguments used
Number of hosts discovered and ports found
Vulnerabilities identified via NSE scripts
Any service disruptions or anomalies
Compliance
PTES: Reconnaissance phase of Penetration Testing Execution Standard
OWASP: ASVS verification requirements for network security
MITRE ATT&CK: T1046 (Network Service Scanning)
PCI-DSS 11.2: External and internal vulnerability scanning
ISO 27001: A.12.6 Technical vulnerability management
