菜单
Network scanning via nmap — host discovery, port scanning, service/OS detection, vulnerability scanning
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
| name | nmap-scan |
| description | Network scanning via nmap — host discovery, port scanning, service/OS detection, vulnerability scanning |
Run nmap directly via Bash. Requires nmap installed (brew install nmap on macOS).
Before running any nmap command, validate the target to prevent command injection:
192.168.1.1), hostnames (example.com), CIDRs (192.168.1.0/24), comma-separated lists (192.168.1.1,192.168.1.2)^[\w\.\-\,\/\:]+$ -- only word chars, dots, hyphens, commas, slashes, colons^[\d,\-]+$ -- only digits, commas, hyphensFind open ports and services. Fast (T4 timing), shows only open ports.
nmap -T4 --open 192.168.1.0/24
With specific ports:
nmap -T4 --open -p 22,80,443,8080 192.168.1.1
Deep scan that detects service versions and attempts OS fingerprinting. Slower but more detailed.
nmap -sV -O -T4 192.168.1.1
With specific ports:
nmap -sV -O -T4 -p 1-1000 192.168.1.1
Find live hosts on a network without port scanning.
nmap -sn 192.168.1.0/24
Scan for known vulnerabilities using nmap's built-in NSE vuln scripts.
nmap --script vuln -T4 192.168.1.1
With specific ports:
nmap --script vuln -T4 -p 80,443 192.168.1.1
For structured output, use the -oX - flag and parse XML, or use the python-nmap library:
python3 -c "
import nmap
scanner = nmap.PortScanner()
scanner.scan('TARGET', arguments='-sV -T4')
for host in scanner.all_hosts():
print(f'{host} ({scanner[host].hostname()}) - {scanner[host].state()}')
for proto in scanner[host].all_protocols():
for port in sorted(scanner[host][proto].keys()):
info = scanner[host][proto][port]
print(f' {port}/{proto} {info[\"state\"]} {info.get(\"name\",\"?\")} {info.get(\"product\",\"\")} {info.get(\"version\",\"\")}')
"
-sn) is LOW risk -- no port scanning, just pings.-sS, OS detection -O) require sudo.-p) checks the top 1000 most common ports.-p- to scan all 65535 ports (slow).Run sustained security assessment campaigns against targets using the Ralph Wiggum autonomous loop pattern. Use when asked to start, continue, or manage a pentest campaign.
Control a Flipper Zero and scan BLE targets for authorized security research. Use when asked to interact with Flipper hardware, scan BLE devices, or control RF/IR/NFC/RFID.
Start an autonomous pentest loop. Spawns fresh-context subagents for each phase. Use: /ralph-loop
BLE GATT exploitation methodology — scanning, enumeration, characteristic analysis, payload crafting, and write attacks against Bluetooth Low Energy devices
Run a sustained security assessment campaign — a real pentest, not a simulation
Credential testing methodology — default credential checking, password spraying, credential reuse, and OSINT for leaked credentials