/recon-nmap

name: recon-nmap
description: >
  Network reconnaissance and security auditing using Nmap for port scanning, service enumeration,
  and vulnerability detection. Use when: (1) Conducting authorized network reconnaissance and asset
  discovery, (2) Enumerating network services and identifying running versions, (3) Detecting
  security vulnerabilities through NSE scripts, (4) Mapping network topology and firewall rules,
  (5) Performing compliance scanning for security assessments, (6) Validating network segmentation
  and access controls.
version: 0.1.0
maintainer: sirappsec@gmail.com
category: offsec
tags: [reconnaissance, nmap, port-scanning, service-enumeration, network-security, osint]
frameworks: [MITRE-ATT&CK, OWASP, PTES]
dependencies:
  packages: [nmap]
  tools: [python3, masscan]
references:
  - https://nmap.org/book/
  - https://nmap.org/nsedoc/
  - https://attack.mitre.org/techniques/T1046/

Nmap Network Reconnaissance

Overview

Nmap (Network Mapper) is the industry-standard tool for network discovery, security auditing, and vulnerability assessment. This skill provides structured workflows for authorized reconnaissance operations including port scanning, service enumeration, OS fingerprinting, and vulnerability detection using Nmap Scripting Engine (NSE).

**IMPORTANT**: Network scanning may be disruptive and must only be conducted with proper authorization. Always ensure written permission before scanning networks or systems you do not own.

Quick Start

Basic host discovery and port scanning:

# Quick scan of common ports
nmap -F <target-ip>

# Scan top 1000 ports with service detection
nmap -sV <target-ip>

# Comprehensive scan with OS detection and default scripts
nmap -A <target-ip>

Core Workflow

Network Reconnaissance Workflow

Progress: [ ] 1. Verify authorization and scope [ ] 2. Perform host discovery and asset enumeration [ ] 3. Conduct port scanning on live hosts [ ] 4. Enumerate services and versions [ ] 5. Perform OS fingerprinting and detection [ ] 6. Run NSE scripts for vulnerability detection [ ] 7. Document findings and generate reports [ ] 8. Validate results and identify false positives

Work through each step systematically. Check off completed items.

1. Authorization Verification

**CRITICAL**: Before any scanning activities:

• Confirm written authorization from network owner
• Review scope document for in-scope IP ranges and domains
• Verify scanning windows and rate-limiting requirements
• Document emergency contact for accidental disruption
• Confirm blacklisted hosts (production databases, critical infrastructure)

2. Host Discovery

Identify live hosts in target network:

# Ping sweep (ICMP echo)
nmap -sn <target-network>/24

# ARP scan (local network only, faster and more reliable)
nmap -sn -PR <target-network>/24

# TCP SYN ping (when ICMP blocked)
nmap -sn -PS22,80,443 <target-network>/24

# UDP ping (for hosts blocking TCP)
nmap -sn -PU53,161 <target-network>/24

# Disable ping, assume all hosts alive
nmap -Pn <target-network>/24

**Host discovery techniques**:

• **ICMP Echo (-PE)**: Standard ping, often blocked
• **TCP SYN (-PS)**: Half-open connection to specified ports
• **TCP ACK (-PA)**: Sends ACK packets, useful for stateful firewalls
• **UDP (-PU)**: Sends UDP packets to specified ports
• **ARP (-PR)**: Layer 2 discovery, only works on local network

Output live hosts to file for subsequent scanning:

nmap -sn <target-network>/24 -oG - | awk '/Up$/{print $2}' > live_hosts.txt

3. Port Scanning

Scan discovered hosts for open ports:

# Fast scan (top 100 ports)
nmap -F -iL live_hosts.txt

# Top 1000 ports (default)
nmap -iL live_hosts.txt

# Scan all 65535 ports
nmap -p- -iL live_hosts.txt

# Scan specific ports
nmap -p 22,80,443,3389,8080 -iL live_hosts.txt

# Scan port ranges
nmap -p 1-1024,3000-9000 -iL live_hosts.txt

**Scan techniques**:

• **TCP SYN Scan (-sS)**: Default, stealthy half-open scan (requires root)

  sudo nmap -sS <target-ip>

• **TCP Connect Scan (-sT)**: Full TCP connection (no root required)

  nmap -sT <target-ip>

• **UDP Scan (-sU)**: Scan UDP ports (slow but critical)

  sudo nmap -sU -p 53,161,500 <target-ip>

• **Version Detection (-sV)**: Probe services for version information

  nmap -sV <target-ip>

• **Aggressive Scan (-A)**: Enable OS detection, version detection, script scanning, traceroute

  sudo nmap -A <target-ip>

**Timing and performance**:

# Paranoid (0) - Extremely slow, IDS evasion
nmap -T0 <target-ip>

# Sneaky (1) - Very slow, IDS evasion
nmap -T1 <target-ip>

# Polite (2) - Slows down to use less bandwidth
nmap -T2 <target-ip>

# Normal (3) - Default timing
nmap -T3 <target-ip>

# Aggressive (4) - Faster, assumes reliable network
nmap -T4 <target-ip>

# Insane (5) - Very fast, may miss results
nmap -T5 <target-ip>

**Rate limiting for safety**:

# Limit to 100 packets/second
nmap --max-rate 100 <target-ip>

# Minimum 10 packets/second
nmap --min-rate 10 <target-ip>

# Scan with delays to avoid detection
nmap --scan-delay 1s <target-ip>

4. Service Enumeration

Identify services and extract version information:

# Service version detection
nmap -sV <target-ip>

# Aggressive version detection (more probes)
nmap -sV --version-intensity 5 <target-ip>

# Light version detection (fewer probes, faster)
nmap -sV --version-intensity 0 <target-ip>

# Specific service enumeration
nmap -sV -p 80,443 --script=http-headers,http-title <target-ip>

**Service-specific enumeration**:

# SMB enumeration
nmap -p 445 --script=smb-os-discovery,smb-security-mode <target-ip>

# SSH enumeration
nmap -p 22 --script=ssh-hostkey,ssh-auth-methods <target-ip>

# DNS enumeration
nmap -p 53 --script=dns-nsid,dns-recursion <target-ip>

# HTTP/HTTPS enumeration
nmap -p 80,443 --script=http-methods,http-robots.txt,http-titl