Port Scan

Nmap

# https://github.com/nmap/nmap
./configure
make
make install
nmap -sC -sV example.com
nmap example.com

https://3os.org/penetration-testing/cheatsheets/nmap-cheatsheet/

Naabu

# https://github.com/projectdiscovery/naabu
naabu -p 80,443,21-23 -host example.com
cat list | naabu -top-ports 100 -ep 80,443,8080,8443

The two-stage pattern

Fast sweep to find the open ports, then a slow scan of only those. Scanning all 65535 ports with -sV across a large scope wastes days.

# 1: sweep
naabu -l hosts.txt -p - -rate 2000 -silent -o open.txt

# 2: enumerate only what answered
cut -d: -f1 open.txt | sort -u > ips.txt
nmap -sV -sC -Pn -iL ips.txt -p $(cut -d: -f2 open.txt | sort -un | paste -sd,) -oA nmap

# masscan for very large ranges
masscan -p1-65535 --rate 5000 -iL cidrs.txt -oL masscan.txt

Ports that actually produce findings

2375 2376   docker api            6379   redis
2379        etcd                  9200   elasticsearch
5601        kibana                27017  mongodb
8500        consul                11211  memcached
10250       kubelet               5000   docker registry
9000        portainer / sonarqube 8081   nexus / artifactory
1099        java rmi              4444   metasploit / leftover shell
3389 5985   rdp / winrm           161    snmp

Unauthenticated Redis, Docker API, Kubelet and etcd are the ones that go straight to critical.

redis-cli -h TARGET info
curl -s http://TARGET:2375/version
curl -sk https://TARGET:10250/pods
curl -s http://TARGET:2379/v2/keys?recursive=true

Getting past the CDN

Port-scanning a Cloudflare IP scans Cloudflare. Resolve the real origin first, or you are scanning someone else’s infrastructure, which is also out of scope.

# only scan IPs inside the target's own ASN
# see /recon/asncidr/

ASN/CIDR

Passive first

Free, silent, and often enough.

# https://github.com/projectdiscovery/uncover
uncover -q 'ssl:"target.com"' -e shodan,censys,fofa -silent

shodan search 'ssl.cert.subject.CN:"target.com"' --fields ip_str,port,org

Certificate transparency and Shodan usually reveal the odd ports before you send a packet.

Rate and scope

Check the program’s policy for scanning limits before you start
-rate too high gets you blocked and gives false negatives
-Pn if ICMP is filtered, otherwise nmap skips live hosts
Scan from a VPS, not from home

Tools

URL	Description
https://github.com/projectdiscovery/naabu	Fast sweep
https://github.com/nmap/nmap	Service detection
https://github.com/robertdavidgraham/masscan	Huge ranges
https://github.com/RustScan/RustScan	Sweep + hands off to nmap
https://github.com/projectdiscovery/uncover	Passive, via search engines