NMAP Scanning

Various nmap scans
Full UDP Scan
nmap -sU -sV -vv -oA quick_udp 10.10.10.20
nmap -A -sV -sU --script=default,vuln --open -oA udp_full_scan 10.10.10.20
Full TCP Scan
nmap -sC -sV -p- -vv -oA full 10.10.10.20
nmap -A -sV --script=default,vuln -p- --open -oA tcp_full_scan 10.10.10.20
nmap -T4 -A -p- 10.10.10.20
Port Knock
for x in 7000 8000 9000; do nmap -Pn --host_timeout 201 --max-retries 0 -p $x 1
Scan all ports
nmap -sS -A -T4 -p 1-65535 -oA nmapscan.txt 10.10.10.20
OS Guess
nmap -O -v -n 10.10.10.0/24 --osscan-guess
NSE scripts
Used for:
Service enumeration 
Brute-force 
Vulnerabilities 
/usr/share/nmap/scripts/                    # Directory
--script=name-of-the-script
OR
--script name-of-the-script.nse
Vulnerability Scan
# On general
nmap --script vuln -oA nmap vulnscan 10.10.10.20
​
# On specific ports
nmap --script +vuln -p80,1999,8180,35316 10.10.10.20 
nmap --script +vuln -p4433 10.10.10.20
nmap --script +vuln -p2049,445,80,60666 10.10.10.20
Enumeration
Hping3 Scanning
Last modified 3yr ago