Network Scan
Choose manual Nmap or AutoRecon for the initial pass. Avoid repeating collection already completed under the same scope.
Manual first pass
Discover TCP ports, then identify the services on the ports found:
nmap -Pn -p- --open -oA tcp-all TARGET
nmap -Pn -sV -sC -p PORTS -oA services TARGET
Replace PORTS with discovered open ports. Keep UDP separate:
sudo nmap -Pn -sU --top-ports 100 -oA udp-top100 TARGET
Only 100 UDP ports are covered; open|filtered is inconclusive. Use application evidence, including on nonstandard ports, to choose the service page. For a Windows-looking host, use the folded service clues and next checks.
AutoRecon: automatic service follow-up
AutoRecon runs discovery and service follow-up while saving commands and reports. Complete the shared profile setup once, then run from your private host working directory:
sudo autorecon TARGET --config "$HOME/oscp/tools/config/autorecon.toml" -o results/TARGET
The quick common-port pass can provide leads while full TCP discovery continues. The selected service plugins capture HTTP/robots/TLS, SMB/LDAP inventory, anonymous shares, SNMP and NFS exports. Directory fuzzing and authenticated checks remain on their owning service pages.
Read the host's scans/ directory, command/error logs and Markdown report. An open port needs service/configuration validation; failed or unfinished work remains unknown. Choose a fresh output directory for a new pass. Do not rerun the same anonymous inventory merely because another tool offers it.
Set up the AutoRecon profile once
The profile is included in complete AutoRecon preparation, also displayed on the setup page. Create it there once; no per-host copy is needed.
Include another assigned host
sudo autorecon TARGET OTHER_TARGET --config "$HOME/oscp/tools/config/autorecon.toml" -o results/pass2
Supply only assigned hosts. Start with the host you are investigating; multiple hosts share the configured concurrency. Discovered names do not extend scope.
Bound a run or slow down unreliable probes
sudo autorecon TARGET --config "$HOME/oscp/tools/config/autorecon.toml" --target-timeout 30 --timeout 40 -o results/bounded
sudo autorecon TARGET --config "$HOME/oscp/tools/config/autorecon.toml" --nmap='-vv --reason -Pn -T3' -o results/slower
Timeouts are in minutes: per target and whole run respectively. A cutoff preserves partial work; inspect unfinished scans before retrying the missing check. Use slower timing when packet loss, rate limiting or unstable results justify it, rather than as another mandatory pass.
Collect top-100 UDP with AutoRecon
sudo autorecon TARGET --config "$HOME/oscp/tools/config/autorecon.toml" --port-scans top-100-udp-ports -o results/udp
This overrides TCP discovery for this run and adds relevant selected service follow-up. Choose this or the manual UDP command above. It does not cover all UDP ports; silence is inconclusive.
nmapAutomator retained for a static-Nmap / remote fallback
When AutoRecon dependencies cannot be used but a compatible Nmap binary is available:
bash "$HOME/oscp/tools/repos/nmapAutomator/nmapAutomator.sh" -H TARGET -t Port -s /PATH/TO/nmap --remote
nmapAutomator retains binary-selection/remote convenience. Inspect generated commands and perform focused service detection as needed; Vulnerability/All modes are not equivalent to the selected profile above.
Look up one service-specific NSE check
ls /usr/share/nmap/scripts/ftp*
nmap --script-help ftp-anon
nmap -Pn -p 21 --script ftp-anon TARGET
Use FTP anonymous access as this example; inspect the selected script's purpose and prerequisites before choosing a different service check. Run only a missing check if the initial scan already supplied the answer. A script category or broad vuln wildcard is not a substitute for reviewing behaviour. ftp-anon.
Single TCP port question: Netcat
nc -nv -w 3 TARGET PORT
Use for a specific connection/banner, not port discovery. A silent UDP probe is inconclusive.
Fast selected-port sweep: Masscan
sudo masscan TARGET -p80,443 --rate 1000
Use for a distinct rapid selected-port question; validate returned ports with Nmap. It is not another mandatory scan of an already covered host.
Prepare tools used on this page
Run setup on Kali after preparing the shared workspace. Skip a clone when its checkout already exists; review/update it deliberately rather than cloning over it. Operational commands remain in the sections above.
Prepare AutoRecon
Runs on Kali. Use the existing selected-plugin profile; installation does not select a safe scan profile automatically. Upstream.
sudo apt install autorecon enum4linux-ng sslscan smbclient snmp nfs-common
Create the shared AutoRecon profile once. Keep an existing reviewed file, or choose a new filename and use that same path in your runs.
mkdir -p "$HOME/oscp/tools/config"
( set -o noclobber
cat > "$HOME/oscp/tools/config/autorecon.toml" <<'EOF'
exclude-tags = "default"
port-scans = "top-tcp-ports,all-tcp-ports"
service-scans = "curl,curl-robots,ssl-scan,enum4linux,smbclient,snmpwalk,showmount"
reports = "markdown"
max-scans = 8
max-port-scans = 2
[enum4linux]
tool = "enum4linux-ng"
EOF
)
Excluding the default tag disables its automatic plugin selection; the explicitly listed port/service/report plugins override that exclusion. Without this guard, additional default-tagged plugins can still run. This uses installed plugins, with no custom plugin directory or Python launcher. Eight total scans/two port scans are an initial concurrency limit, not a speed guarantee. Nmap timing stays at AutoRecon's default. Review local global settings and generated commands if customized. A missing plugin/dependency is a setup failure, not a negative result. Configuration and plugin controls.
Check on Kali:
autorecon --version
autorecon --config "$HOME/oscp/tools/config/autorecon.toml" --list
Prepare nmapAutomator
Retained alternative, not an additional mandatory pass after AutoRecon. Upstream modes have different dependencies; inspect the selected mode before use. Upstream.
git clone --depth 1 https://github.com/21y4d/nmapAutomator.git "$HOME/oscp/tools/repos/nmapAutomator"
Check on Kali:
bash -n "$HOME/oscp/tools/repos/nmapAutomator/nmapAutomator.sh"