Menu
Network reconnaissance workflow using nmap, masscan, and rustscan via NyxStrike tools
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Binary analysis and reverse engineering workflow using checksec, strings, binwalk, radare2, ropgadget, and gdb for CTF and vulnerability research
Cloud and container security auditing workflow using prowler, trivy, kube-hunter, and docker-bench for AWS, GCP, Azure, Kubernetes, and container images
Exploitation workflow using Metasploit, msfvenom payload generation, and Exploit-DB search — from vulnerability identification to shell
Password hash identification, cracking, and credential brute-forcing using hashid, john, hashcat, hydra, medusa, and ophcrack
SMB and Windows network enumeration workflow using nmap, smbmap, enum4linux, netexec, and nbtscan for share discovery, user enumeration, and lateral movement
Subdomain and DNS enumeration workflow using subfinder, amass, dnsenum, fierce, theharvester, gau, and waybackurls
| name | nmap-recon |
| description | Network reconnaissance workflow using nmap, masscan, and rustscan via NyxStrike tools |
Step-by-step network reconnaissance skill for NyxStrike. Use this skill when a user asks to scan a host, discover open ports, enumerate services, or perform OS detection.
Start with a fast sweep to identify open ports before running detailed scans.
rustscan for speed on a single target.masscan for large CIDR ranges.run_tool(tool="rustscan", target="<target>", ports="1-65535")
Run nmap against the open ports discovered in step 1 to enumerate services, versions, and scripts.
run_tool(tool="nmap", target="<target>", ports="<open_ports>", flags="-sV -sC -O")
Useful nmap flag combinations:
| Goal | Flags |
|---|---|
| Service + version detection | -sV |
| Default NSE scripts | -sC |
| OS detection | -O |
| Aggressive (all of the above + traceroute) | -A |
| UDP scan | -sU |
| Full port range | -p- |
If specific services are found, run targeted NSE scripts for deeper enumeration.
| Service | Suggested scripts |
|---|---|
| SMB (445) | --script smb-vuln-*,smb-enum-shares |
| HTTP (80/443) | --script http-title,http-headers,http-methods |
| FTP (21) | --script ftp-anon,ftp-bounce |
| SSH (22) | --script ssh-hostkey,ssh-auth-methods |
| SNMP (161/udp) | --script snmp-info,snmp-interfaces |
run_tool(tool="nmap_advanced", target="<target>", ports="<port>", scripts="<script_list>")
For targets on the same subnet, use arp_scan to identify live hosts before deeper scanning.
run_tool(tool="arp_scan", target="<subnet_cidr>")
-T3 (default timing) and increase to -T4 only on reliable networks.-oN, -oX, or -oG flags for later analysis; pass via the output_file parameter where supported.| Tool | Use case |
|---|---|
nmap | Service/version/script scanning |
nmap_advanced | NSE script targeting |
masscan | High-speed large-range port sweep |
rustscan | Fast single-target port discovery |
arp_scan | Local subnet host discovery |