菜单
Port scanning and service identification using nmap, masscan, and rustscan. Use this skill when user needs to discover open ports, identify running services, detect service versions, or fingerprint operating systems on target hosts.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
| name | recon-port-scan |
| description | Port scanning and service identification using nmap, masscan, and rustscan. Use this skill when user needs to discover open ports, identify running services, detect service versions, or fingerprint operating systems on target hosts. |
IMPORTANT: Port scanning without proper authorization is illegal. Always ensure you have:
Required tools that must be installed on your system:
sudo apt install nmap (Debian/Ubuntu) or brew install nmap (macOS)Optional tools:
Most commonly used commands for port scanning:
nmap -T4 -F <target>
Quick scan of top 100 common ports.
nmap -sV -sC -p- <target>
Scan all 65535 ports with version detection and default scripts.
sudo nmap -sS -T2 -p- <target>
Stealthy scan (requires root).
masscan -p1-65535 <target/CIDR> --rate=10000
Fast scanning of large IP ranges.
When you need fast results on common ports:
nmap -T4 -F <target>
Parameters:
-T4 - Aggressive timing template (faster)-F - Fast mode, scan top 100 ports<target> - IP address, hostname, or CIDR rangeExample:
nmap -T4 -F 192.168.1.100
nmap -T4 -F example.com
nmap -T4 -F 192.168.1.0/24
When you need to find all open ports (1-65535):
nmap -p- <target>
Parameters:
-p- - Scan all 65535 portsExample:
nmap -p- 192.168.1.100
With version detection:
nmap -sV -p- <target>
When you need to identify running service versions:
nmap -sV -sC <target>
Parameters:
-sV - Probe open ports for service/version info-sC - Run default NSE scriptsExample:
nmap -sV -sC 192.168.1.100
More aggressive version detection:
nmap -sV --version-intensity 7 <target>
When you need to avoid detection:
sudo nmap -sS -T2 -f --data-length 24 <target>
Parameters:
-sS - SYN scan (stealthier than connect scan)-T2 - Polite timing (slower, less suspicious)-f - Fragment packets--data-length 24 - Append random data to packetsExample:
sudo nmap -sS -T2 -f 192.168.1.100
Decoy scan:
sudo nmap -D RND:10 -sS <target>
When you need to discover UDP services:
nmap -sU --top-ports 100 <target>
Parameters:
-sU - UDP scan--top-ports 100 - Scan top 100 most common UDP portsExample:
nmap -sU --top-ports 100 192.168.1.100
Combined TCP + UDP scan:
nmap -sS -sU <target>
When you need to identify the operating system:
sudo nmap -O <target>
Parameters:
-O - Enable OS detectionExample:
sudo nmap -O 192.168.1.100
Combined with version detection:
sudo nmap -sV -O <target>
When scanning large IP ranges:
masscan -p1-65535 <CIDR> --rate=10000 -oL output.txt
Parameters:
-p1-65535 - Port range--rate=10000 - Packets per second (adjust based on bandwidth)-oL output.txt - Save results to fileExample:
masscan -p1-65535 192.168.1.0/24 --rate=10000 -oL scan_results.txt
Follow-up with nmap for detailed scanning:
# First, masscan to find open ports
masscan -p1-65535 192.168.1.0/24 --rate=10000 -oL - | grep open > open_ports.txt
# Then, nmap for service details on discovered ports
nmap -sV -p 80,443,22,3306 192.168.1.100
rustscan -a <target> -- -sV
Parameters:
-a - Target address-- - Separator for nmap arguments (passed through to nmap)Example:
rustscan -a 192.168.1.100 -- -sV -sC
Save results in different formats:
# All formats (normal, XML, grepable)
nmap -oA output <target>
# XML only (for parsing)
nmap -oX output.xml <target>
# Grepable format
nmap -oG output.gnmap <target>
# Normal output to file
nmap -oN output.txt <target>
Example:
nmap -sV -p- -oA scan_results 192.168.1.100
# Creates: scan_results.nmap, scan_results.xml, scan_results.gnmap
| Scenario | Recommended Tool | Command |
|---|---|---|
| Quick common port scan | nmap | nmap -T4 -F <target> |
| Full port range | nmap | nmap -p- <target> |
| Service version detection | nmap | nmap -sV -sC <target> |
| Large network / speed critical | masscan | masscan -p1-65535 <target> --rate=10000 |
| Stealth required | nmap | sudo nmap -sS -T2 <target> |
| UDP service discovery | nmap | nmap -sU --top-ports 100 <target> |
| OS fingerprinting | nmap | sudo nmap -O <target> |
| Modern fast workflow | rustscan | rustscan -a <target> -- -sV |
Tool Comparison:
| Tool | Speed | Accuracy | Features | Use Case |
|---|---|---|---|---|
| nmap | Medium | High | Most comprehensive | General purpose |
| masscan | Very High | Medium | Basic port scan | Large networks |
| rustscan | High | High | nmap integration | Modern workflows |
Adjust scan speed with timing templates (0-5):
| Level | Name | Description |
|---|---|---|
-T0 | Paranoid | Very slow, IDS evasion |
-T1 | Sneaky | Slow, IDS evasion |
-T2 | Polite | Medium-slow, reduces load |
-T3 | Normal | Default speed |
-T4 | Aggressive | Fast, recommended |
-T5 | Insane | Very fast, may be inaccurate |
Example:
nmap -T4 <target> # Fast scan (recommended)
nmap -T2 <target> # Slower, more stealthy
nmap -T5 <target> # Maximum speed (may miss ports)
NSE (Nmap Scripting Engine) script categories:
# Vulnerability detection
nmap --script=vuln <target>
# Auth bypass detection
nmap --script=auth <target>
# Brute force
nmap --script=brute <target>
# Information gathering
nmap --script=discovery,info <target>
Reference for common service ports:
| Ports | Services |
|---|---|
| 21 | FTP |
| 22 | SSH |
| 23 | Telnet |
| 25 | SMTP |
| 53 | DNS |
| 80, 8080, 8443 | HTTP |
| 110 | POP3 |
| 135, 139, 445 | SMB |
| 143, 993 | IMAP |
| 443, 8443 | HTTPS |
| 3306 | MySQL |
| 3389 | RDP |
| 5432 | PostgreSQL |
| 5900 | VNC |
| 6379 | Redis |
| 27017 | MongoDB |
scripts/parse_nmap_xml.py - Parse nmap XML output to structured JSON formatscripts/masscan_to_nmap.py - Convert masscan results to nmap-compatible formatscripts/merge_scan_results.py - Combine multiple scan result filesreferences/nmap_cheatsheet.md - Comprehensive nmap reference guidereferences/masscan_guide.md - Detailed masscan usage documentationreferences/rustscan_guide.md - RustScan quick referencereferences/scanning_techniques.md - Advanced scanning techniques and evasion methodsassets/top-1000-ports.txt - Top 1000 common ports listassets/top-100-ports.txt - Top 100 common ports listassets/common-services.txt - Common service fingerprint dataWhen you need to persist port scan results to the database for cross-session analysis and reporting:
# Generate XML scan output
nmap -sV -p- 192.168.1.0/24 -oX scan.xml
# Store to database (flat hierarchy - no subsystem)
python .claude/skills/recon-port-scan/scripts/port_scan_storage.py \
--xml-file scan.xml
# Store to database with subsystem
python .claude/skills/recon-port-scan/scripts/port_scan_storage.py \
--xml-file scan.xml \
--subsystem "External Network"
# Or pipe directly (flat hierarchy)
nmap -sV -p- target.com -oX - | \
python .claude/skills/recon-port-scan/scripts/port_scan_storage.py
# Or pipe directly (with subsystem)
nmap -sV -p- target.com -oX - | \
python .claude/skills/recon-port-scan/scripts/port_scan_storage.py \
--subsystem "DMZ"
Parameters:
--subsystem - Subsystem name (optional, omit for flat hierarchy)--scan-tool - Scan tool used (default: nmap)--xml-file - Path to nmap XML file (optional, reads from stdin if not provided)Database location: ./data/results.db
Related skills: results-storage - Query data, generate reports
本地文件包含 (LFI) 漏洞检测和利用工具。使用 curl、ffuf 等工具测试 LFI 漏洞，支持路径遍历、PHP 伪协议利用、日志投毒 RCE、敏感文件读取。当用户需要检测 LFI 漏洞、利用文件包含漏洞读取服务器文件时使用此技能。
SQL injection detection and exploitation using sqlmap, manual techniques, and custom payloads. Use this skill when user needs to test for SQL injection vulnerabilities, extract database information, or exploit SQLi in parameters, headers, or cookies.
按照标准格式生成渗透测试报告，包含项目信息表、漏洞发现清单、漏洞详情（含属性表、描述、复现步骤、证据截图、修复建议）、附录（风险等级定义、CVSS说明、词汇表）。当用户要求生成渗透测试报告、安全测试报告、漏洞报告时使用此技能。严格遵循项目模板目录中的标准格式。
任意文件下载与本地文件包含 (LFI) 漏洞检测和利用工具。使用 curl、ffuf、wget 等工具测试文件下载漏洞，支持路径遍历、伪协议利用、敏感文件读取。当用户需要测试文件下载功能、检测 LFI 漏洞、读取服务器敏感文件时使用此技能。
Arbitrary file download vulnerability detection and exploitation using path traversal techniques, bypass methods, and sensitive file discovery. Use this skill when user needs to test for file download vulnerabilities, path traversal, or read sensitive files on target systems.
Cross-site scripting (XSS) vulnerability detection and exploitation. Supports reflected XSS, stored XSS, DOM-based XSS, and blind XSS testing. Use this skill when user mentions XSS, cross-site scripting, script injection, or needs to test JavaScript injection in parameters, forms, headers, or DOM sources.