← Complete task index · Workspace

Scanner Alternatives and Web Baseline Checks

← Stage index | Discovery cheatsheet | Master Notes | Strategy map | Study methods: Discover attack surfaces

Use when: Nmap remains the interpretation baseline, but a faster TCP discovery pass or a bounded web-server check is useful. These tools generate candidates; Nmap/manual protocol checks confirm them.

RustScan: fast TCP discovery, Nmap interpretation

Prerequisite: RustScan and Nmap on Kali; direct TCP reachability. Coverage: only the explicit TCP range. Decisive output: a discovered port that Nmap can reproduce and identify.

rustscan -a TARGET -r 1-65535 --ulimit 5000 -- \
  -Pn -sV -sC -oA rustscan-followup

If the target or network becomes unstable, lower concurrency rather than trusting an empty result. RustScan does not replace UDP work and does not prove that closed/filtered ports were tested with the same semantics as Nmap.

Bounded first 1,000 TCP ports 
rustscan -a TARGET -r 1-1000 --ulimit 5000 -- \
  -Pn -sV -sC -oA rustscan-1000

Use only for a quick selection. It is not full TCP coverage and is not equivalent to Nmap's default top-1,000 selection.

Masscan: raw-packet discovery, then validation

Prerequisite: root/raw-packet access and a directly routed target. Choose it: for a large authorized address/port space where discovery speed matters. Failure cue: high loss or inconsistent results at the chosen rate.

sudo masscan TARGET -p1-65535 --rate 500 -oL masscan-open.txt

Treat each hit as a candidate and recheck with Nmap:

PORTS=$(awk '$1 == "open" && $2 == "tcp" {print $3}' masscan-open.txt \
  | sort -nu | paste -sd,)
test -n "$PORTS" && sudo nmap -Pn -sV -sC -p "$PORTS" TARGET -oA masscan-verified

Masscan's raw-packet model is not suitable through a TCP SOCKS proxy. A rate that overwhelms the path can create false negatives and disrupt the lab; record the rate with the result.

Unknown-port discrimination

Start passively or with protocol-appropriate probes. Do not spray arbitrary strings at a stateful or destructive service.

nmap -Pn -sV --version-all -p PORT TARGET -oN port-PORT-version.txt
nmap --script-help banner
nmap -Pn --script=banner -p PORT TARGET -oN port-PORT-banner.txt
nc -nv TARGET PORT
openssl s_client -connect TARGET:PORT -servername HOSTNAME
curl -vk --max-time 10 https://TARGET:PORT/

Next action: route application evidence to the matching Stage 02 page. If TLS succeeds but HTTP does not, preserve the certificate names and protocol evidence instead of labelling it HTTPS.

NSE candidate checks

Inspect a script before selecting it:

nmap --script-help SCRIPT_NAME
grep -i 'SCRIPT_NAME' /usr/share/nmap/scripts/script.db

Run a named script against a confirmed service/port:

nmap -Pn -sV --script SCRIPT_NAME -p PORT TARGET -oN nse-SCRIPT_NAME.txt

The broad vuln category is candidate generation and can be intrusive or misleading. If its use is justified in the authorized lab, restrict it to identified ports and manually validate every result:

nmap -Pn -sV --script vuln -p PORTS TARGET -oN nse-vuln-candidates.txt

Avoid *brute* categories as a default; first establish exact service, known test identities, lockout/rate limits and explicit authorization.

Nikto: bounded web-server candidate generation

Prerequisite: an identified HTTP(S) endpoint. Choose it: after manual baselining to identify common files, headers and server misconfiguration candidates. Decisive output: a finding manually reproduced with the same host, path and authentication context.

nikto -h http://TARGET:PORT -output nikto-TARGET-PORT.txt
HTTPS, host name and tuning variants 
nikto -h https://HOSTNAME:PORT -output nikto-HOSTNAME-PORT.txt
nikto -h http://TARGET:PORT -vhost HOSTNAME -output nikto-vhost.txt
nikto -h http://TARGET:PORT -Tuning 123b -output nikto-focused.txt

Tuning codes are version-sensitive. Inspect nikto -H / local documentation before relying on a copied code set.

Nikto is explicitly listed as allowed by the current OffSec exam guide, but its findings remain scanner candidates. Recheck the guide before an exam and manually validate anything that affects an attack decision.

Sources