Discovery

From the target's working folder

Purpose: Confirm the source path and discover explicitly assigned hosts before spending time on port coverage.

Copy# From the target's working folder
mkdir -p scans
ip -br addr
ip route get TARGET

# One host
nmap -sn -n -oA scans/host TARGET

# Host discovery
nmap -sn -n -iL targets.txt -oA scans/hosts

# Explicitly assigned subnet
nmap -sn -n -oA scans/subnet SUBNET

Read: selected interface/source address. A route lookup does not prove reachability.

Test one TCP port from the Windows source host

Copy# Test one TCP port from the Windows source host
Test-NetConnection -ComputerName TARGET -Port PORTS

# Scan a low-port range
1..1024 | % {echo ((New-Object Net.Sockets.TcpClient).Connect("DC_IP", $_)) "TCP port $_ is open"} 2>$null

# Check a selected port list
22,80,443,445,3389 | % {echo ((New-Object Net.Sockets.TcpClient).Connect("TARGET", $_)) "TCP port $_ is open"} 2>$null

Read: TcpTestSucceeded, source and destination addresses. Use one number for PORTS. Failure does not distinguish a closed port, filtering or a path problem.

2. Get initial TCP results

Copy# 2. Get initial TCP results
sudo nmap -sS -n -oA scans/tcp-initial TARGET

# Assigned host list, SYN scan
sudo nmap -sS -n -iL targets.txt -oA scans/tcp-initial-list

# One host, connect scan without raw-packet privileges
nmap -sT -n -oA scans/tcp-connect TARGET

# Selected ports or a range
sudo nmap -sS -n -p PORTS -oA scans/tcp-selected TARGET

# Find relevant services across assigned hosts
sudo nmap -sS -n -p PORTS -iL targets.txt -oA scans/tcp-service-sweep

# 3. Complete TCP coverage
sudo nmap -sS -n -p- -oA scans/tcp-all TARGET

# Connect scan
nmap -sT -n -p- -oA scans/tcp-all-connect TARGET

# Recheck relevant ports with response reasons
sudo nmap -sS -n -Pn --reason -p PORTS -oA scans/tcp-recheck TARGET

# Proceed with full TCP coverage despite failed discovery
sudo nmap -sS -n -Pn -p- -oA scans/tcp-all-no-discovery TARGET

# Full TCP with normal timing and periodic progress
sudo nmap -sS -n -p- -T3 --stats-every 30s -oA scans/tcp-normal TARGET

# Faster timing on a stable path
sudo nmap -sS -n -p- -T4 --stats-every 30s -oA scans/tcp-faster TARGET

Inspect additional endpoints before narrowing the investigation. TCP coverage says nothing about UDP.

This is a bounded first view, not complete TCP coverage

Use ordinary connect calls when a previously established proxy is the only route. This is a bounded first view, not complete TCP coverage:

Copy# This is a bounded first view, not complete TCP coverage
proxychains nmap -sT -Pn -n --top-ports 100 -oA scans/tcp-proxy-top100 TARGET

proxychains cannot turn SYN probes or UDP into proxied TCP connections. -Pn avoids discovery probes that may not traverse the proxy. Confirm the proxy route first, preserve the 100-port limit, and expand with another connect scan only when scope and path permit it.

5. Check UDP separately

Purpose: Sample UDP separately, preserve ambiguous states, and expand only when the objective or evidence warrants it.

Copy# 5. Check UDP separately
sudo nmap -sU -n --top-ports 20 -oA scans/udp-top20 TARGET

# Expand to 100 common ports when more coverage is warranted
sudo nmap -sU -n --top-ports 100 -oA scans/udp-top100 TARGET

# Check a relevant UDP port/list
sudo nmap -sU -n -p PORTS -oA scans/udp-selected TARGET

# Add application probes to resolve a useful candidate
sudo nmap -sU -n -sV -p PORTS -oA scans/udp-detail TARGET

# Full UDP coverage when the objective justifies the cost
sudo nmap -sU -n -p- --stats-every 60s -oA scans/udp-all TARGET

# Combined TCP/UDP selection
sudo nmap -sS -sU -n -p T:22,80,445,U:53,123,161 -oA scans/tcp-udp TARGET

This selects UDP ports 1-65535 and may take a long time because silence requires waiting and ICMP errors may be rate-limited. It is the coverage-expansion option, not a universal first command. Continue service work in parallel and preserve the result if the scan cannot finish.

4. Identify discovered applications

Purpose: Identify applications on discovered ports and choose only the probing needed for the next decision.

Copy# 4. Identify discovered applications
nmap -sT -n -sV -p PORTS -oA scans/tcp-services TARGET

# Identify applications on discovered ports
nmap -sT -n -sV -sC -p PORTS -oA scans/tcp-services-default TARGET

# Lighter version probing when time or fragile service behavior matters
nmap -sT -n -sV --version-light -p PORTS -oA scans/tcp-services-light TARGET

# Inspect behavior locally
nmap --script-help http-headers

# After identifying HTTP, inspect its relevant port(s)
nmap -sT -n -p PORTS --script http-headers -oA scans/http-headers TARGET

# Estimate OS from network-stack behavior
sudo nmap -n -O -oA scans/os TARGET

# Request more tentative OS guesses
sudo nmap -n -O --osscan-guess -oA scans/os-guesses TARGET

# Bundle OS/version detection, default scripts and traceroute
sudo nmap -sS -n -A -oA scans/combined-detail TARGET

Next: choose service-specific enumeration from application evidence. A version match alone does not establish exploitability.

Light mode tries fewer uncommon probes and can miss an identity that the default intensity finds. Use the default first unless a concrete constraint justifies the tradeoff.

OS guesses are hypotheses. These use default TCP coverage; -A does not mean all ports. Choose this bundle only when its additional probing is useful.

RustScan: fast TCP discovery, Nmap interpretation

Prerequisite: RustScan and Nmap on Kali; direct TCP reachability. Coverage: only the explicit TCP range. Decisive output: a discovered port that Nmap can reproduce and identify.

Copy# RustScan: fast TCP discovery, Nmap interpretation
rustscan -a TARGET -r 1-65535 --ulimit 5000 -- \
  -Pn -sV -sC -oA rustscan-followup

# Bounded first 1,000 TCP ports
rustscan -a TARGET -r 1-1000 --ulimit 5000 -- \
  -Pn -sV -sC -oA rustscan-1000

Use only for a quick selection. It is not full TCP coverage and is not equivalent to Nmap's default top-1,000 selection.

Masscan: raw-packet discovery, then validation

Prerequisite: root/raw-packet access and a directly routed target. Choose it: for a large authorized address/port space where discovery speed matters. Failure cue: high loss or inconsistent results at the chosen rate.

Copy# Masscan: raw-packet discovery, then validation
sudo masscan TARGET -p1-65535 --rate 500 -oL masscan-open.txt

# Treat each hit as a candidate and recheck with Nmap
PORTS=$(awk '$1 == "open" && $2 == "tcp" {print $3}' masscan-open.txt \
  | sort -nu | paste -sd,)
test -n "$PORTS" && sudo nmap -Pn -sV -sC -p "$PORTS" TARGET -oA masscan-verified

# Unknown-port discrimination
nmap -Pn -sV --version-all -p PORT TARGET -oN port-PORT-version.txt
nmap --script-help banner
nmap -Pn --script=banner -p PORT TARGET -oN port-PORT-banner.txt
nc -nv TARGET PORT
openssl s_client -connect TARGET:PORT -servername HOSTNAME
curl -vk --max-time 10 https://TARGET:PORT/

Inspect a script before selecting it

Copy# Inspect a script before selecting it
nmap --script-help SCRIPT_NAME
grep -i 'SCRIPT_NAME' /usr/share/nmap/scripts/script.db

# Run a named script against a confirmed service/port
nmap -Pn -sV --script SCRIPT_NAME -p PORT TARGET -oN nse-SCRIPT_NAME.txt

# NSE candidate checks
nmap -Pn -sV --script vuln -p PORTS TARGET -oN nse-vuln-candidates.txt

Nikto: bounded web-server candidate generation

Prerequisite: an identified HTTP(S) endpoint. Choose it: after manual baselining to identify common files, headers and server misconfiguration candidates. Decisive output: a finding manually reproduced with the same host, path and authentication context.

Copy# Nikto: bounded web-server candidate generation
nikto -h http://TARGET:PORT -output nikto-TARGET-PORT.txt

# HTTPS, host name and tuning variants
nikto -h https://HOSTNAME:PORT -output nikto-HOSTNAME-PORT.txt
nikto -h http://TARGET:PORT -vhost HOSTNAME -output nikto-vhost.txt
nikto -h http://TARGET:PORT -Tuning 123b -output nikto-focused.txt

Tuning codes are version-sensitive. Inspect nikto -H / local documentation before relying on a copied code set.

Nikto is explicitly listed as allowed by the current OffSec exam guide, but its findings remain scanner candidates. Recheck the guide before an exam and manually validate anything that affects an attack decision.

Netcat connection check

Keep source, destination, transport and port consistent when comparing results. Revisit relevant checks after a new route, foothold or identity changes access.

Copy# Netcat connection check
nc -nv -w 3 -z TARGET PORTS

# Netcat connection check
nc -nvv -w 3 -z TARGET PORTS

Readable text only, with verbose output and port-state reasons

Copy# Readable text only, with verbose output and port-state reasons
sudo nmap -sS -n -v --reason -p PORTS -oN scans/tcp-check.txt TARGET

Open saved .nmap or .txt output in a text editor. -oA writes .nmap, .gnmap and .xml; -oN writes only normal text. Use a different output prefix when retaining another run.

For every useful endpoint, capture one line with this structure

Copy# For every useful endpoint, capture one line with this structure
SOURCE -> TARGET | tcp/udp PORT | OBSERVED STATE | APPLICATION EVIDENCE | COVERAGE LIMIT | NEXT TEST

Next: carry the complete endpoint tuple into Stage 02 service enumeration and choose the cheapest protocol-aware test that can change your understanding or access. Keep an explicit return item for incomplete TCP, UDP or application coverage.

Next: carry the complete endpoint tuple into Stage 02 service enumeration and choose the cheapest protocol-aware test that can change your understanding or access. Keep an explicit return item for incomplete TCP, UDP or application coverage.

• open establishes a reachable endpoint from the scan source; it does not establish a vulnerability or usable authentication.
• closed records an explicit rejection in that context. Move on unless later evidence changes the route, source or target state.
• filtered leaves the listener state unresolved because filtering, loss or the path prevented classification.
• unfiltered means the selected probe reached the port but could not determine whether it was open or closed; use a scan type that can answer the required question.
• UDP open|filtered is inconclusive. A useful protocol probe may reduce uncertainty, but another silence can remain inconclusive.
• closed|filtered is also an explicit ambiguity. Preserve it unless resolving the distinction changes the next action.
• A port-based service label is a clue. Use application evidence before treating product, version, operating system or machine role as confirmed.
• Record the exact target, transport, selected ports and source position. A successful narrow scan does not cover untested ports, the other transport or another network position.

Rank candidates by the cheapest test likely to produce access, credentials, sensitive information or a decisive prerequisite. Prefer observed application behavior over conventional port numbers. Keep at least one return item for incomplete coverage so an attractive early service does not erase the rest of the map.

Re-run network discovery after a new source host, route, tunnel or target restart. Re-enumerate a service after a new credential or identity. Inspect local listeners after a foothold. Recheck a previous result when the source, target state, port selection or network conditions changed—not simply because the first attack failed.