メニュー
Network scanning via nmap — host discovery, port scanning, service/OS detection, vulnerability scanning
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
Run sustained security assessment campaigns against targets using the Ralph Wiggum autonomous loop pattern. Use when asked to start, continue, or manage a pentest campaign.
Control a Flipper Zero and scan BLE targets for authorized security research. Use when asked to interact with Flipper hardware, scan BLE devices, or control RF/IR/NFC/RFID.
Start an autonomous pentest loop. Spawns fresh-context subagents for each phase. Use: /ralph-loop
BLE GATT exploitation methodology — scanning, enumeration, characteristic analysis, payload crafting, and write attacks against Bluetooth Low Energy devices
Run a sustained security assessment campaign — a real pentest, not a simulation
Credential testing methodology — default credential checking, password spraying, credential reuse, and OSINT for leaked credentials
| name | nmap-scan |
| description | Network scanning via nmap — host discovery, port scanning, service/OS detection, vulnerability scanning |
Run nmap directly via Bash. Requires nmap installed (brew install nmap on macOS).
Before running any nmap command, validate the target to prevent command injection:
192.168.1.1), hostnames (example.com), CIDRs (192.168.1.0/24), comma-separated lists (192.168.1.1,192.168.1.2)^[\w\.\-\,\/\:]+$ -- only word chars, dots, hyphens, commas, slashes, colons^[\d,\-]+$ -- only digits, commas, hyphensFind open ports and services. Fast (T4 timing), shows only open ports.
nmap -T4 --open 192.168.1.0/24
With specific ports:
nmap -T4 --open -p 22,80,443,8080 192.168.1.1
Deep scan that detects service versions and attempts OS fingerprinting. Slower but more detailed.
nmap -sV -O -T4 192.168.1.1
With specific ports:
nmap -sV -O -T4 -p 1-1000 192.168.1.1
Find live hosts on a network without port scanning.
nmap -sn 192.168.1.0/24
Scan for known vulnerabilities using nmap's built-in NSE vuln scripts.
nmap --script vuln -T4 192.168.1.1
With specific ports:
nmap --script vuln -T4 -p 80,443 192.168.1.1
For structured output, use the -oX - flag and parse XML, or use the python-nmap library:
python3 -c "
import nmap
scanner = nmap.PortScanner()
scanner.scan('TARGET', arguments='-sV -T4')
for host in scanner.all_hosts():
print(f'{host} ({scanner[host].hostname()}) - {scanner[host].state()}')
for proto in scanner[host].all_protocols():
for port in sorted(scanner[host][proto].keys()):
info = scanner[host][proto][port]
print(f' {port}/{proto} {info[\"state\"]} {info.get(\"name\",\"?\")} {info.get(\"product\",\"\")} {info.get(\"version\",\"\")}')
"
-sn) is LOW risk -- no port scanning, just pings.-sS, OS detection -O) require sudo.-p) checks the top 1000 most common ports.-p- to scan all 65535 ports (slow).