Menü
Discover open ports, running services, and their versions on a target
Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.
Basierend auf der SOC-Berufsklassifikation
| name | port-scanning |
| description | Discover open ports, running services, and their versions on a target |
| origin | RedteamOpencode |
run_tool nmap (primary), run_tool nc (quick checks/banner grab)
run_tool nmap -sV -sC -T4 TARGET -oA $DIR/scans/nmap_initial
run_tool nmap -sV -sC -T4 -p- TARGET -oN $DIR/scans/nmap_full_tcp.txt
# Speed optimization: discover ports first, then deep scan
run_tool nmap -sS -T4 -p- --min-rate 1000 TARGET -oG $DIR/scans/ports_only.txt
PORTS=$(grep -oP '\d+/open' $DIR/scans/ports_only.txt | cut -d/ -f1 | tr '\n' ',' | sed 's/,$//')
run_tool nmap -sV -sC -p "$PORTS" TARGET -oN $DIR/scans/nmap_targeted.txt
run_tool nmap -sV --version-intensity 5 -p PORT1,PORT2 TARGET
run_tool nc -nv TARGET PORT <<< "" 2>&1 | head -5 # Banner grab
printf '\n' | run_tool nc -w 3 TARGET PORT
run_tool nmap --script=vuln -p PORT TARGET
run_tool nmap --script=http-enum -p 80,443 TARGET
run_tool nmap --script=smb-enum-shares,smb-enum-users -p 445 TARGET
run_tool nmap --script=ftp-anon -p 21 TARGET
run_tool nmap --script=ssh-auth-methods -p 22 TARGET
run_tool nmap -sU --top-ports 50 -T4 TARGET -oN $DIR/scans/nmap_udp.txt
run_tool nmap -sU -p 53,67,68,69,123,161,162,500,514,1900 TARGET
run_tool nmap -f -sV -p PORT TARGET # Fragment packets
run_tool nmap -D RND:5 -sV -p PORT TARGET # Decoy scan
run_tool nmap -sV -T2 -p PORT TARGET # Slow scan
run_tool nmap --source-port 53 -sV -p PORT TARGET # Source port trick
grep -oP '\d+/open/tcp//\S+' $DIR/scans/nmap_initial.gnmap
grep "open" $DIR/scans/nmap_targeted.txt | grep -v "filtered"
| Port | Service | Notes |
|---|---|---|
| 21 | FTP | Anonymous login |
| 22 | SSH | Version, auth methods |
| 25 | SMTP | Open relay, user enum |
| 53 | DNS | Zone transfer |
| 80/443 | HTTP/S | Web app testing |
| 139/445 | SMB | Shares, null sessions |
| 1433 | MSSQL | 3306 MySQL |
| 3389 | RDP | 5900 VNC |
| 8080 | HTTP alt | 27017 MongoDB (often unauth) |
Business logic vulnerability detection — workflow bypass, price manipulation, state abuse, and application-specific flaws
Detect PII, credentials, and corporate sensitive data in API responses, source code, files, headers, and database extracts
Detect and exploit SQL injection vulnerabilities in web application parameters
Test for authentication and authorization flaws including credential attacks, session issues, and access control bypasses
Detect and exploit cross-site scripting vulnerabilities in web applications
Discover hidden parameters, test values, and identify input handling anomalies