OSCP+ Notes
  • 📙oscp+ notes
  • Reconnaissance
    • Discovery
      • DNS Hostname
      • Subdomain Discovery
      • Directory Discovery
    • Host Scan
      • Nmap
  • Enumeration
    • Services
      • FTP
      • SSH
  • Misc
    • SSH
    • RDP
    • File Transfer
    • Full Interactive Shell
    • Pivoting and Tunneling
Powered by GitBook
On this page
  • Default Scan
  • Stealth Scan
  • UDP Scan
  • Nmap Scripts
  • Nmap through Socks proxy
  1. Reconnaissance
  2. Host Scan

Nmap

Default Scan

nmap -sC -sV -o nmap/nmap IP
nmap -Pn -sC -sV -p- -o nmap/tcp-all IP
nmap -sV -Pn -o nmap IP
nmap -T4 -sC -sV -o nmap IP
nmap -vv -Pn -A -sC -sS -T 4 -p- 10.10.0.0/24 -o fullscan

Stealth Scan

nmap -sS -sC -sV -o nmap/stealth IP
nmap -sS -p- -o nmap/stealth-all IP

UDP Scan

nmap -sS -sU -Pn -sV IP
nmap -sU -A --top-ports=20 --version-all IP
nmap -sU -A -p 53,67,68,161,162 --version-all IP

Nmap Scripts

Location: /use/share/nmap/scripts

nmap --scripts vuln,safe,discovery -o nmap IP

Nmap through Socks proxy

nmap --proxies socks4://proxy-ip:port IP
PreviousHost ScanNextServices

Last updated 6 months ago