recon-nmap

name	recon-nmap
description	Network reconnaissance and security auditing using Nmap for port scanning, service enumeration, and vulnerability detection. Use when: (1) Conducting authorized network reconnaissance and asset discovery, (2) Enumerating network services and identifying running versions, (3) Detecting security vulnerabilities through NSE scripts, (4) Mapping network topology and firewall rules, (5) Performing compliance scanning for security assessments, (6) Validating network segmentation and access controls.
version	0.1.0
maintainer	[e-mail]
category	offsec
tags	["reconnaissance","nmap","port-scanning","service-enumeration","network-security","osint"]
frameworks	["MITRE-ATT&CK","OWASP","PTES"]
dependencies	{"packages":["nmap"],"tools":["python3","masscan"]}
references	["https://nmap.org/book/","https://nmap.org/nsedoc/","https://attack.mitre.org/techniques/T1046/"]

Nmap Network Reconnaissance

Overview

Nmap (Network Mapper) is the industry-standard tool for network discovery, security auditing, and vulnerability assessment. This skill provides structured workflows for authorized reconnaissance operations including port scanning, service enumeration, OS fingerprinting, and vulnerability detection using Nmap Scripting Engine (NSE).

IMPORTANT: Network scanning may be disruptive and must only be conducted with proper authorization. Always ensure written permission before scanning networks or systems you do not own.

Quick Start

Basic host discovery and port scanning:

# Quick scan of common ports
nmap -F <target-ip>

# Scan top 1000 ports with service detection
nmap -sV <target-ip>

# Comprehensive scan with OS detection and default scripts
nmap -A <target-ip>

Core Workflow

Network Reconnaissance Workflow

Progress: [ ] 1. Verify authorization and scope [ ] 2. Perform host discovery and asset enumeration [ ] 3. Conduct port scanning on live hosts [ ] 4. Enumerate services and versions [ ] 5. Perform OS fingerprinting and detection [ ] 6. Run NSE scripts for vulnerability detection [ ] 7. Document findings and generate reports [ ] 8. Validate results and identify false positives

Work through each step systematically. Check off completed items.

1. Authorization Verification

CRITICAL: Before any scanning activities:

• Confirm written authorization from network owner
• Review scope document for in-scope IP ranges and domains
• Verify scanning windows and rate-limiting requirements
• Document emergency contact for accidental disruption
• Confirm blacklisted hosts (production databases, critical infrastructure)

2. Host Discovery

Identify live hosts in target network:

# Ping sweep (ICMP echo)
nmap -sn <target-network>/24

# ARP scan (local network only, faster and more reliable)
nmap -sn -PR <target-network>/24

# TCP SYN ping (when ICMP blocked)
nmap -sn -PS22,80,443 <target-network>/24

# UDP ping (for hosts blocking TCP)
nmap -sn -PU53,161 <target-network>/24

# Disable ping, assume all hosts alive
nmap -Pn <target-network>/24

Host discovery techniques:

• ICMP Echo (-PE): Standard ping, often blocked