network-reconnaissance

name	Network Reconnaissance
description	This skill should be used when the user asks about "nmap", "port scanning", "network reconnaissance", "service discovery", "masscan", "host discovery", "banner grabbing", or needs guidance on network enumeration techniques.
version	1.0.0

Network Reconnaissance Skill

Overview

Comprehensive network reconnaissance techniques for identifying open ports, running services, and potential attack vectors on target systems.

Port Scanning with Nmap

Quick Discovery Scans

# Top 1000 ports with version detection
nmap -sC -sV -T4 <TARGET>

# Fast scan top 100 ports
nmap -F <TARGET>

# Ping sweep for network
nmap -sn 10.10.10.0/24

Comprehensive Scans

# All TCP ports
nmap -p- -T4 --min-rate=1000 <TARGET>

# All TCP with version detection (slower but thorough)
nmap -p- -sC -sV <TARGET>

# UDP top 20 ports (requires root)
sudo nmap -sU --top-ports 20 <TARGET>

Stealth Options

# SYN scan (default, requires root)
sudo nmap -sS <TARGET>

# Connect scan (no root required)
nmap -sT <TARGET>

# Slow scan to evade IDS
nmap -T2 --scan-delay 1s <TARGET>

Nmap Script Engine (NSE)

Categories

# Vulnerability detection
nmap --script vuln <TARGET>

# Safe scripts (won't crash services)
nmap --script safe <TARGET>

# Default scripts (-sC equivalent)
nmap --script default <TARGET>

# Discovery scripts
nmap --script discovery <TARGET>

Service-Specific Scripts

# HTTP enumeration
nmap --script http-enum -p80,443 <TARGET>

# SMB enumeration
nmap --script smb-enum* -p445 <TARGET>

# SMB vulnerabilities
nmap --script smb-vuln* -p445 <TARGET>

# FTP checks
nmap --script ftp-anon,ftp-bounce -p21 <TARGET>

# SSH enumeration
nmap --script ssh-* -p22 <TARGET>

Alternative Tools

Masscan (Faster than Nmap)

# Scan all ports quickly
masscan -p1-65535 <TARGET> --rate=1000

# Top ports
masscan -p80,443,22,21,25,3389 <TARGET> --rate=1000

Rustscan (Fastest)

# Quick scan, pipe to nmap
rustscan -a <TARGET> -- -sC -sV

Service Identification

Banner Grabbing

# Netcat
nc -nv <TARGET> <PORT>

# Telnet
telnet <TARGET> <PORT>

# Curl for HTTP
curl -I http://<TARGET>

Version Detection

# Aggressive version detection
nmap -sV --version-intensity 5 -p<PORT> <TARGET>

Common Ports Reference

Port	Service	Notes
21	FTP	Check anonymous login
22	SSH	Version, auth methods
23	Telnet	Often unencrypted creds
25	SMTP	User enum, relay
53	DNS	Zone transfer
80/443	HTTP/S	Web testing
88	Kerberos	AD environment
110/143	POP3/IMAP	Mail access
135	MSRPC	Windows services
139/445	SMB	Shares, vulns
389/636	LDAP	AD enumeration
1433	MSSQL	xp_cmdshell
3306	MySQL	Default creds
3389	RDP	BlueKeep, brute
5432	PostgreSQL	Default creds
5985/5986	WinRM	PowerShell remote
6379	Redis	Unauth access
8080	HTTP-Alt	Web apps
27017	MongoDB	NoSQL

Output Management

Save Results

# All formats
nmap -oA scan_results <TARGET>

# Grepable output
nmap -oG scan.gnmap <TARGET>

# XML for parsing
nmap -oX scan.xml <TARGET>

Parse Results

# Extract open ports from grepable
grep "open" scan.gnmap | cut -d' ' -f2

# Convert XML to HTML
xsltproc scan.xml -o scan.html

Troubleshooting

Host Appears Down

# Skip host discovery
nmap -Pn <TARGET>

Slow Scans

# Increase speed
nmap -T4 --min-rate=5000 <TARGET>

Firewall Detected

# Fragment packets
nmap -f <TARGET>

# Use decoys
nmap -D RND:10 <TARGET>