port-scan

# port-scan ## When to Use - Target domain or IP discovered and need to find open ports - Subdomain enumeration complete and ready to scan hosts - Need to identify running services for vulnerability assessment - Looking for non-standard ports that may expose admin panels - Preparing targets for service-specific vulnerability scanning - Building comprehensive attack surface map of infrastructure ## Quick Start Fast port scan with naabu on top 100 ports: ```bash naabu -host example.com -top-ports 100 -silent ``` ## Tools Overview ### Naabu (Primary - Fast Discovery) ProjectDiscovery's Go-based port scanner. Optimized for speed and reliability with CDN/WAF awareness. **Best For:** Initial fast enumeration, CDN detection, pipeline integration ### Masscan (Speed - Large Scale) Asynchronous TCP port scanner capable of Internet-scale scanning. Uses custom TCP/IP stack. **Best For:** Large IP ranges, high-speed sweeps, initial broad discovery ### Nmap (Detail - Service Detection) Industry-standard network scanner with service detection, OS fingerprinting, and scripting engine. **Best For:** Service version detection, detailed analysis, script-based enumeration ## Step-by-Step Process ### Step 1: Initial Fast Scan with Naabu Start with naabu for quick enumeration of common ports: ```bash naabu -host example.com -top-ports 100 -o naabu-ports.txt ``` For multiple hosts from file: ```bash naabu -list hosts.txt -top-ports 100 -o discovered-ports.txt ``` With JSON output for structured data: ```bash naabu -host example.com -top-ports 100 -json -o ports.json ``` ### Step 2: Extended Port Range Discovery Scan all ports on promising targets: ```bash naabu -host example.com -p - -rate 1000 -o all-ports.txt ``` Scan specific port ranges: ```bash naabu -host example.com -p 1-1000,8000-9000,3389 -o custom-ports.txt ``` ### Step 3: CDN/WAF Aware Scanning Exclude CDN IPs to avoid scanning protected infrastructure: ```bash naabu -host example.com -top-ports 1000 -exclude-cdn -display-cdn -o filtered-ports.txt ``` ### Step 4: High-Speed Scanning with Masscan For large IP ranges, use masscan for speed: ```bash masscan 10.0.0.0/8 -p80,443,8080,8443 --rate 10000 -oL masscan-results.txt ``` Full port scan on smaller ranges: ```bash masscan 192.168.1.0/24 -p1-65535 --rate 5000 -oG masscan-grep.txt ``` ### Step 5: Service Version Detection with Nmap After discovering open ports, identify services: ```bash nmap -sV -p 80,443,8080 example.com -oX nmap-services.xml ``` For stealth scanning with version detection: ```bash nmap -sS -sV -p 80,443 --open example.com -oX nmap-results.xml ``` ### Step 6: Comprehensive Service Analysis Full service and script scan on discovered ports: ```bash nmap -sV -sC -p 22,80,443,8080 example.com -oA nmap-full ``` With OS detection: ```bash nmap -sS -sV -O -p 80,443 example.com -oX nmap-os.xml ``` ### Step 7: Combine Tools in Pipeline Use naabu to discover, nmap to enumerate: ```bash naabu -host example.com -top-ports 100 -silent | nmap -sV -iL - -oX services.xml ``` Naabu has built-in nmap integration: ```bash naabu -host example.com -top-ports 100 -nmap-cli "nmap -sV -oX nmap-output.xml" ``` ## Examples ### Example 1: Basic Host Port Scan **Scenario:** Scan a single domain for common web ports **Command:** ```bash naabu -host hackerone.com -p 80,443,8080,8443 -silent ``` **Output:** ``` hackerone.com:80 hackerone.com:443 hackerone.com:8443 ``` ### Example 2: Subdomain List Scanning **Scenario:** Scan all discovered subdomains for open ports **Command:** ```bash naabu -list subdomains.txt -top-ports 100 -json -o ports.json ``` **Output (ports.json):** ```json {"ip":"104.16.99.52","port":80,"host":"www.example.com"} {"ip":"104.16.99.52","port":443,"host":"www.example.com"} {"ip":"192.168.1.10","port":22,"host":"admin.example.com"} {"ip":"192.168.1.10","port":8080,"host":"admin.example.com"} ``` ### Example 3: Full Port Range Scan **Scenario:** Discover all open ports on high-value target **Command:** ```bash naabu -host admin.example.com -p - -rate 2000 -o all-ports.txt ``` **Output (all-ports.txt):** ``` admin.example.com:22 admin.example.com:80 admin.example.com:443 admin.example.com:3306 admin.example.com:8080 admin.example.com:9090 ``` ### Example 4: CDN Detection and Filtering **Scenario:** Identify CDN-protected hosts and scan direct IPs only **Command:** ```bash naabu -host example.com -top-ports 100 -exclude-cdn -display-cdn -silent ``` **Output:** ``` [cdn] example.com [cloudflare] admin.example.com:22 admin.example.com:8080 api.example.com:443 api.example.com:8443 ``` ### Example 5: High-Speed Network Sweep **Scenario:** Quickly scan large network for web services **Command:** ```bash masscan 10.0.0.0/16 -p80,443,8000-8100 --rate 50000 -oL sweep.txt ``` **Output (sweep.txt):** ``` open tcp 80 10.0.1.15 1609459200 open tcp 443 10.0.1.15 1609459200 open tcp 8080 10.0.2.30 1609459201 open tcp 80 10.0.5.100 1609459202 ``` ### Example 6: Masscan with JSON Output **Scenario:** Large-scale scan with structured output **Command:** ```bash masscan 192.168.0.0/16 -p22,80,443,3389 --rate 10000 -oJ masscan.json ``` **Output (masscan.json):** ```json {"ip": "192.168.1.50", "timestamp": "1609459200", "ports": [{"port": 22, "proto": "tcp", "status": "open"}]} {"ip": "192.168.1.50", "timestamp": "1609459200", "ports": [{"port": 80, "proto": "tcp", "status": "open"}]} {"ip": "192.168.2.100", "timestamp": "1609459201", "ports": [{"port": 443, "proto": "tcp", "status": "open"}]} ``` ### Example 7: Service Version Detection **Scenario:** Identify exact service versions on open ports **Command:** ```bash nmap -sV -p 22,80,443,8080 example.com -oX services.xml ``` **Output:** ``` PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 80/tcp open http nginx 1.18.0 443/tcp open ssl/http nginx 1.18.0 8080/tcp open http-proxy Apache Tomcat 9.0.50 ``` ### Example 8: Nmap Script Scanning **Scenario:** Run default scripts for additional enumeration **Command:** ```bash nmap -sV -sC -p 80,443 example.com --open -oX nmap-scripts.xml ``` **Output:** ``` PORT STATE SERVICE VERSION 80/tcp open http nginx 1.18.0 | http-title: Example Domain |_Requested resource was https://example.com/ 443/tcp open ssl/http nginx 1.18.0 | ssl-cert: Subject: commonName=example.com | Not valid after: 2025-01-15T00:00:00 ``` ### Example 9: UDP Port Scanning **Scenario:** Discover UDP services (DNS, SNMP, etc.) **Naabu UDP scan:** ```bash naabu -host example.com -p u:53,161,500,1194 -o udp-ports.txt ``` **Nmap UDP scan:** ```bash nmap -sU -p 53,161,500 example.com -oX udp-services.xml ``` **Output:** ``` PORT STATE SERVICE 53/udp open domain 161/udp open|filtered snmp 500/udp open|filtered isakmp ``` ### Example 10: Stealth SYN Scan **Scenario:** Low-profile reconnaissance scan **Command:** ```bash nmap -sS -Pn -T2 --top-ports 100 example.com -oX stealth.xml ``` **Output:** ``` PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 443/tcp open https ``` ### Example 11: IPv6 Port Scanning **Scenario:** Scan IPv6 addresses for open ports **Command:** ```bash naabu -host example.com -p 80,443 -ip-version 6 -silent ``` **Output:** ``` 2606:4700::6810:6434:80 2606:4700::6810:6434:443 ``` ### Example 12: Passive Port Enumeration **Scenario:** Discover ports without active scanning using Shodan **Command:** ```bash naabu -host example.com -passive -silent ``` **Output:** ``` example.com:22 example.com:80 example.com:443 example.com:8443 ``` ### Example 13: Pipeline Integration **Scenario:** Combine port scanning with service detection **Command:** ```bash cat hosts.txt | naabu -silent -top-ports 100 | httpx -silent -status-code ``` **Output:** ``` http://example.com:80 [200] https://example.com:443 [301] http://admin.example.com:8080 [401] ``` ### Example 14: Naabu with Nmap Integration **Scenario:** Automatic service detection on discovered ports **Command:** ```bash naabu -host example.com -top-ports 100 -nmap-cli "nmap -sV -oX nmap.xml" ``` **Output:** ``` [INF] Found 4 ports on host example.com (104.16.99.52) example.com:80 example.com:443 example.com:8080 example.com:8443 [INF] Running nmap command: nmap -sV -p 80,443,8080,8443 104.16.99.52 ``` ## Scan Types Reference ### TCP Scan Types | Type | Flag | Description | Use Case | | --------- | ----- | ---------------------- | ----------------------- | | SYN Scan | `-sS` | Half-open stealth scan | Default, requires root | | Connect | `-sT` | Full TCP connection | Unprivileged users | | ACK Scan | `-sA` | Firewall rule mapping | Identify filtered ports | | FIN Scan | `-sF` | Stealth bypass | IDS evasion | | Xmas Scan | `-sX` | Stealth bypass | IDS evasion | ### UDP Scanning | Tool | Flag | Notes | | ------- | ------------- | --------------------- | | Naabu | `-p u:53,161` | Prefix port with `u:` | | Nmap | `-sU` | Slower, needs root | | Masscan | `-pU:53,161` | Uses `U:` prefix | ## Timing and Rate Control | Tool | Slow | Medium | Fast | Max |