القائمة
Discover open ports, running services, and their versions on a target
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
| name | port-scanning |
| description | Discover open ports, running services, and their versions on a target |
| origin | RedteamOpencode |
run_tool nmap (primary), run_tool nc (quick checks/banner grab)
run_tool nmap -sV -sC -T4 TARGET -oA $DIR/scans/nmap_initial
run_tool nmap -sV -sC -T4 -p- TARGET -oN $DIR/scans/nmap_full_tcp.txt
# Speed optimization: discover ports first, then deep scan
run_tool nmap -sS -T4 -p- --min-rate 1000 TARGET -oG $DIR/scans/ports_only.txt
PORTS=$(grep -oP '\d+/open' $DIR/scans/ports_only.txt | cut -d/ -f1 | tr '\n' ',' | sed 's/,$//')
run_tool nmap -sV -sC -p "$PORTS" TARGET -oN $DIR/scans/nmap_targeted.txt
run_tool nmap -sV --version-intensity 5 -p PORT1,PORT2 TARGET
run_tool nc -nv TARGET PORT <<< "" 2>&1 | head -5 # Banner grab
printf '\n' | run_tool nc -w 3 TARGET PORT
run_tool nmap --script=vuln -p PORT TARGET
run_tool nmap --script=http-enum -p 80,443 TARGET
run_tool nmap --script=smb-enum-shares,smb-enum-users -p 445 TARGET
run_tool nmap --script=ftp-anon -p 21 TARGET
run_tool nmap --script=ssh-auth-methods -p 22 TARGET
run_tool nmap -sU --top-ports 50 -T4 TARGET -oN $DIR/scans/nmap_udp.txt
run_tool nmap -sU -p 53,67,68,69,123,161,162,500,514,1900 TARGET
run_tool nmap -f -sV -p PORT TARGET # Fragment packets
run_tool nmap -D RND:5 -sV -p PORT TARGET # Decoy scan
run_tool nmap -sV -T2 -p PORT TARGET # Slow scan
run_tool nmap --source-port 53 -sV -p PORT TARGET # Source port trick
grep -oP '\d+/open/tcp//\S+' $DIR/scans/nmap_initial.gnmap
grep "open" $DIR/scans/nmap_targeted.txt | grep -v "filtered"
| Port | Service | Notes |
|---|---|---|
| 21 | FTP | Anonymous login |
| 22 | SSH | Version, auth methods |
| 25 | SMTP | Open relay, user enum |
| 53 | DNS | Zone transfer |
| 80/443 | HTTP/S | Web app testing |
| 139/445 | SMB | Shares, null sessions |
| 1433 | MSSQL | 3306 MySQL |
| 3389 | RDP | 5900 VNC |
| 8080 | HTTP alt | 27017 MongoDB (often unauth) |
Business logic vulnerability detection — workflow bypass, price manipulation, state abuse, and application-specific flaws
Detect PII, credentials, and corporate sensitive data in API responses, source code, files, headers, and database extracts
Detect and exploit SQL injection vulnerabilities in web application parameters
Test for authentication and authorization flaws including credential attacks, session issues, and access control bypasses
Detect and exploit cross-site scripting vulnerabilities in web applications
Discover hidden parameters, test values, and identify input handling anomalies