nmap & masscan port scanning

When it applies

You have in-scope hosts or IP ranges (confirmed in scope.txt — see tradecraft-scope-roe) and need the network attack surface: open ports, service versions, OS guesses. This is the active-scanning step that follows passive enumeration (recon-subdomain-enum, recon-arsenal) and feeds service-specific testing (network-service-attacks, web-arsenal for anything HTTP).

Why it works

nmap crafts raw packets to classify ports (open/closed/filtered) and then speaks each discovered service's protocol just enough to fingerprint its version; its NSE script engine adds per-service checks on top. masscan trades per-host depth for raw speed (its own TCP stack, millions of pps), so the efficient pattern is: masscan for breadth across many hosts/ports, nmap for depth on the hits.

Method

1. Host discovery on a range (skip port scan): nmap -sn 192.168.1.0/24.
2. Pick the scan type:

   nmap -sS target            # SYN half-open scan — default when root; fast, less logging
   nmap -sT target            # full TCP connect — use when unprivileged or raw sockets fail
   nmap -sU --top-ports 100 target   # UDP is slow; always bound it to top ports
   

3. Identify what is listening:

   nmap -sV --version-intensity 5 -sC target   # service versions + default scripts
   nmap -O target                              # OS fingerprint (needs root)
   nmap -A target                              # OS + version + scripts + traceroute (loud)
   

4. Size the port list to the phase: -F (fast, top 100) for a first look; -p 22,80,443 for a targeted check; -p- for full 65535 when the rules of engagement allow the noise.
5. NSE scripts after fingerprinting — never --script vuln as a first move:

   nmap --script vuln target                              # known-vuln checks (loud)
   nmap --script smb-enum-shares,smb-enum-users target    # SMB surface
   nmap --script http-enum,http-vuln* -p 80,443 target    # web surface
   

6. Always save output for the engagement record: -oN normal, -oX XML (importable, feeds other tools — e.g. ncrack -iX scan.xml), -oG greppable.
7. Wide/fast with masscan, then deep with nmap:

   masscan -p1-65535 target --rate=1000              # rate is packets/sec — tune to the link
   masscan -p80,443,8080 10.0.0.0/24 --rate=500 --banners
   masscan -p1-65535 10.0.0.0/8 --rate=10000 -e eth0 --excludefile exclude.txt
   

   --excludefile is how you hard-exclude out-of-scope addresses from a wide sweep; masscan output flags (-oJ/-oX/-oG) mirror nmap's.

Gotchas

• Windows: dnet: Failed to open device eth0 — raw-socket scans fail on some Windows installs; fall back to nmap -sT -sV --top-ports 50 -Pn -T3 target (connect scan, no host-discovery dependency). If it still fails, record it as an environment limitation and continue with HTTP-layer recon — do not let nmap block the engagement.
• Targets behind Cloudflare/CDN — a full raw port scan of a CDN edge tells you almost nothing and burns rate budget; pivot to the application layer (HTTPS/API/JS) instead.
• Scanner output is not a finding — a vuln script hit or an open port is a lead; verify exploitability before it goes in the report (reporting-triage-validation).
• Rate = detection + DoS risk — high --rate / -T5 trips IDS and can flatten weak services; match tempo to the RoE. masscan against ranges you don't own is exactly what scope.txt forbids.
• -Pn when hosts "look down" — many hosts drop ICMP; -Pn skips ping discovery, at the cost of scanning dead hosts.
• SYN scan needs root — -sS as an unprivileged user silently degrades or errors; use -sT.

Verify success

You have a saved scan file (-oX/-oN) whose results you can restate as: live hosts, open ports, service + version per port, and a prioritized list of which services get deep testing next — every entry inside scope.txt.

References

nmap.org reference guide; NSE script library; masscan GitHub (robertdavidgraham). Pipeline context: automation-recon-pipeline; next step per service: network-service-attacks.

---

Portions adapted from reverse-skill by zhaoxuya520, MIT License.