Professional network reconnaissance and port scanning using nmap. Supports various scan types (quick, full, UDP, stealth), service detection, vulnerability scanning, and NSE scripts. Use when you need to enumerate network services, detect versions, or perform network reconnaissance.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
Professional network reconnaissance and port scanning using nmap. Supports various scan types (quick, full, UDP, stealth), service detection, vulnerability scanning, and NSE scripts. Use when you need to enumerate network services, detect versions, or perform network reconnaissance.
Nmap Scan - Professional Network Reconnaissance
You are helping the user perform professional network reconnaissance and port scanning using nmap. This skill provides guidance for various scan types, output formats, and result analysis.
Output Directory
Directory Structure
nmap-output/
├── nmap-portscan.nmap # Initial fast port discovery
├── nmap-portscan.xml
├── nmap-portscan.gnmap
├── nmap-services.nmap # Detailed service detection on open ports
├── nmap-services.xml
└── nmap-services.gnmap
IMPORTANT: Always save nmap output to an organized directory structure. By default, use ./nmap-output/ or specify a custom directory.
Default Scanning Strategy
IMPORTANT: Unless the user explicitly requests a different scan type, ALWAYS use this two-phase approach:
if [ -n "$OPEN_PORTS" ]; then
nmap -p "$OPEN_PORTS" -sV -sC <target> -oA "$OUTPUT_DIR/nmap-services"elseecho"No open ports found, skipping service detection."fi
Report results location
echo"Scan complete. Results saved to: $OUTPUT_DIR"
Scan Types
Quick Scan (Top 1000 Ports)
Use for initial reconnaissance or when time is limited:
nmap -sV -sC <target> -oA <output-prefix>
-sV: Service version detection
-sC: Run default NSE scripts
-oA: Output in all formats (normal, XML, grepable)
Scans top 1000 most common ports
Typical duration: 1-3 minutes
Comprehensive Scan (All Ports)
Use for thorough assessment when all ports must be checked:
nmap -sV -sC -p- <target> -oA <output-prefix>
-p-: Scan all 65535 ports
Significantly longer duration (5-30+ minutes depending on target)
Use only when comprehensive coverage is required
Stealth SYN Scan
Use when trying to avoid detection (requires root/sudo):
--script vuln: Run NSE vulnerability detection scripts
Checks for common CVEs and misconfigurations
Can be noisy and trigger alerts
OS Detection
Use to identify operating system:
sudo nmap -O <target> -oA <output-prefix>
-O: Enable OS detection
Requires root privileges
Uses TCP/IP stack fingerprinting
Alternative Scan Types
The following scan types are available if the user explicitly requests them instead of the default two-phase strategy:
Quick Scan (Top 1000 Ports Only)
Use ONLY if user explicitly requests a quick/fast scan:
nmap -sV -sC <target> -oA <output-dir>/nmap-quick
-sV: Service version detection
-sC: Run default NSE scripts
-oA: Output in all formats (normal, XML, grepable)
Scans top 1000 most common ports ONLY
Typical duration: 1-3 minutes
Limitation: May miss services on non-standard ports
Scan Workflow
Default Workflow (Two-Phase Strategy)
Phase 1: Port Discovery
Run fast SYN scan: sudo nmap -p- <target> -oA <output-dir>/nmap-portscan
Check for "Host seems down" and retry with -Pn if needed
Wait for scan to complete (typically 1-3 minutes)
Phase 2: Service Detection
4. Parse open ports from Phase 1 results
5. Run targeted service detection: nmap -p <OPEN_PORTS> -sV -sC <target> -oA <output-dir>/nmap-services
6. Wait for scan to complete (typically 1-3 minutes)
Phase 3: Analysis
7. Review the service detection results to determine:
What services are running?
What versions are detected?
Are there any interesting services (web, SSH, database, IoT protocols)?
Do NSE scripts reveal any issues?
Additional Targeted Scans (Optional)
Based on service detection results, run specialized scans:
