Nmap

# RULES OF ENGAGEMENT
#   - In-scope:        only IP ranges in the signed authorisation
#   - Rate / time:     agreed windows; avoid business hours
#   - Detection:       respect the target's IDS/IPS — don't try to evade
#   - Reporting:       findings to security@example.com within 24h
#   - Lab practice:    use your own VM range (e.g. 10.10.10.0/24)

# 1) Install
# apt install nmap          # Debian/Ubuntu
# brew install nmap         # macOS

# 2) Host discovery (no port scan — fast)
nmap -sn 10.10.10.0/24                    # ping sweep
nmap -PS80,443 10.10.10.0/24              # TCP SYN to common ports

# 3) Top 100 / 1000 ports — common services
nmap --top-ports 100 10.10.10.5
nmap --top-ports 1000 10.10.10.5

# 4) Full TCP scan + service detection + default scripts + OS guess
sudo nmap -sS -sV -sC -O -p- 10.10.10.5
#  -sS : SYN scan (stealthier, default with root)
#  -sV : service / version detection
#  -sC : default safe scripts
#  -O  : OS fingerprint
#  -p- : all 65535 TCP ports

# 5) UDP — slow but useful (DNS, SNMP, NTP, IKE)
sudo nmap -sU --top-ports 100 10.10.10.5

# 6) Timing — choose based on stealth vs speed needs
#   -T0 paranoid  ... -T5 insane
sudo nmap -T2 -sS 10.10.10.5             # quiet
sudo nmap -T4 -sS 10.10.10.5             # fast (default for most lab work)

# 7) Output formats — for tooling pipelines
nmap -oN result.txt   target            # human-readable
nmap -oG result.gnmap target            # grep-friendly
nmap -oX result.xml   target            # XML (consumed by tools)
nmap -oA scan         target            # all three at once

# 8) Nmap Scripting Engine (NSE) — categories
nmap --script default     target        # safe defaults
nmap --script vuln        target        # known-vuln checks
nmap --script discovery   target
nmap --script-help http-enum             # docs for any script

# Targeted scripts
nmap -p 80,443 --script http-title,http-headers,ssl-cert example.com
nmap -p 22     --script ssh-auth-methods,ssh-hostkey 10.10.10.5
nmap -p 445    --script smb-os-discovery,smb-protocols 10.10.10.5
nmap -p 53     --script dns-recursion,dns-zone-transfer 10.10.10.5

# 9) Scanning behind firewalls — fragmenting / source port (lab only)
sudo nmap -f -D RND:5 target            # fragment, decoy sources
sudo nmap --source-port 53 target       # spoof source port
# NEVER use these techniques on production targets without explicit permission.

# 10) Output processing — pull open ports for follow-up
nmap -p- -oG - target | awk '/Ports:/ {print $2, $3}' | head

# 11) Defender's mirror — how to spot scans
#   • IDS rules (Suricata / Snort): nmap signatures (-sV probes, SYN bursts)
#   • Cloud: VPC flow logs / NSG flow logs → SIEM alert on too-many-rejects
#   • Honeypot ports — 8080, 22, 3389 on unused hosts → catch scanners
#   • Rate-limit at the perimeter; close ports that don't serve traffic

# 12) The follow-up — what to do with results (in an authorised test)
#   • Open management ports (RDP, SSH, SQL Server) — should be VPN/IP-restricted
#   • Outdated services (FTP, Telnet, SMBv1) — replace + decommission
#   • Default credentials — check + rotate
#   • Certificate issues — expired / wrong CN / weak ciphers
#   • Each finding → ticket + owner + due date in the report

# Nmap — the classic network/service scanner.
# Examples (against AUTHORISED targets only):
nmap -sV -p 80,443,22 target.example          # version detection on 3 ports
nmap -sV --top-ports 1000 target.example      # top 1000 TCP ports
nmap -sC -sV -oA scan-results target.example  # default scripts + outputs
# -T4 fast (riskier); -Pn skip ping; --reason explain decisions.