{
  "slug": "port-scanning",
  "title": "Port Scanning",
  "phase": "Scanning",
  "description": "Identify open TCP/UDP ports and enumerate running services across the target's IP space to reveal the full network attack surface.",
  "difficulty": "low",
  "tags": [
    "scanning",
    "network",
    "tcp",
    "udp",
    "service-detection"
  ],
  "tools": [
    "nmap",
    "masscan",
    "rustscan",
    "naabu"
  ],
  "steps": [
    {
      "id": "portscan-01",
      "title": "Host discovery",
      "description": "Determine which hosts in the target IP range are alive before running port scans.",
      "commands": [
        "nmap -sn -T4 192.168.1.0/24 -oG hosts-alive.txt",
        "naabu -host target.com -p - -silent -o naabu-out.txt"
      ],
      "notes": "Skip ICMP-only host discovery in environments that block ping. Use TCP SYN probes instead."
    },
    {
      "id": "portscan-02",
      "title": "Fast full-port TCP scan",
      "description": "Run a high-speed scan across all 65535 TCP ports to catch non-standard service placements.",
      "commands": [
        "masscan -p1-65535 target.com --rate 1000 -oL masscan-out.txt",
        "rustscan -a target.com --ulimit 5000 -- -sV",
        "naabu -host target.com -p - -c 50 -o open-ports.txt"
      ],
      "notes": "Rate-limit to 1000 pps or less on external targets. Aggressive rates will trigger IDS/IPS and may violate programme rules."
    },
    {
      "id": "portscan-03",
      "title": "Service and version detection",
      "description": "Run nmap service detection against the open ports identified in the fast scan.",
      "commands": [
        "nmap -sV -sC -p $(cat open-ports.txt | tr '\\n' ',') target.com -oA nmap-services"
      ],
      "notes": "-sC runs the default script set. Review output carefully — some scripts are intrusive."
    },
    {
      "id": "portscan-04",
      "title": "UDP scan for key services",
      "description": "Check for commonly misconfigured UDP services that are often overlooked.",
      "commands": [
        "nmap -sU -p 53,67,68,69,123,161,162,500,1194,1900,4500,5353 target.com -oA nmap-udp"
      ],
      "notes": "UDP scanning is slow and unreliable on rate-limited networks. Focus on high-value ports only."
    },
    {
      "id": "portscan-05",
      "title": "Banner grabbing and protocol fingerprinting",
      "description": "Collect service banners to identify exact versions and look for outdated software.",
      "commands": [
        "nmap --script banner -p $(cat open-ports.txt | tr '\\n' ',') target.com",
        "nc -nv target.com 22",
        "curl -sk https://target.com -o /dev/null -w '%{http_version}\\n'"
      ]
    }
  ],
  "references": [
    "https://nmap.org/book/man.html",
    "https://github.com/RustScan/RustScan",
    "https://github.com/projectdiscovery/naabu",
    "https://github.com/robertdavidgraham/masscan"
  ],
  "version": "1.0.0",
  "updatedAt": "2026-04-04"
}