NMAP RECON PLAYBOOK

# 1. Check your user — should be root or use sudo
whoami
# Expected: root

# 2. Verify network interface is up
ip a
# Look for your interface (eth0, wlan0, etc.) → should show UP and have an IP

# 3. Test connectivity to target or gateway
ping -c 3 192.168.1.1
# Expected: 3 packets transmitted, 3 received, 0% packet loss

# 4. Verify Nmap is installed and check version
nmap --version
# Expected: Nmap version 7.xx (https://nmap.org)

$ whoami
root

$ ip a
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 ...
    inet 192.168.1.100/24 brd 192.168.1.255 scope global eth0

$ nmap --version
Nmap version 7.94 ( https://nmap.org )

# Create a target list file
cat << 'EOF' > targets.txt
# In-scope targets — Project: [name] — Date: [date]
192.168.1.0/24
10.0.0.1-50
scanme.nmap.org
EOF

# Create an exclusion list (hosts to NEVER scan)
cat << 'EOF' > excludes.txt
# Out-of-scope — DO NOT TOUCH
192.168.1.1      # production gateway
192.168.1.254    # ISP modem
EOF

# Use in scans:
nmap -iL targets.txt --excludefile excludes.txt

# Create organized project directory
mkdir -p ~/engagements/project-name/{scans,reports,evidence,notes}
cd ~/engagements/project-name/scans

# Naming convention: [type]-[target]-[date]
# Example: discovery-192.168.1.0-20260222

# Save in ALL formats at once with -oA (normal + XML + grepable)
nmap -sn 192.168.1.0/24 -oA discovery-192.168.1.0-$(date +%Y%m%d)

# This creates three files:
#   discovery-192.168.1.0-20260222.nmap   (human readable)
#   discovery-192.168.1.0-20260222.xml    (import into tools)
#   discovery-192.168.1.0-20260222.gnmap  (grepable format)

# Basic host discovery (ping sweep) — no port scan
sudo nmap -sn 192.168.1.0/24 -oA discovery

# Breakdown:
#   -sn             Ping scan — disable port scan, only check if host is up
#   192.168.1.0/24  Target: entire /24 subnet (256 IPs)
#   -oA discovery   Save output in all 3 formats

# TCP SYN discovery on common ports (bypasses ICMP block)
sudo nmap -sn -PS22,80,443,445,3389 192.168.1.0/24

# TCP ACK discovery (may bypass stateless firewalls)
sudo nmap -sn -PA80,443 192.168.1.0/24

# UDP discovery (DHCP, DNS, SNMP ports)
sudo nmap -sn -PU53,67,161 192.168.1.0/24

# ARP discovery (local network only — fastest & most reliable)
sudo nmap -sn -PR 192.168.1.0/24

# Combine multiple methods for maximum coverage
sudo nmap -sn -PE -PS22,80,443 -PA80 -PU53 192.168.1.0/24 -oA discovery-aggressive

Starting Nmap 7.94 ( https://nmap.org )
Nmap scan report for 192.168.1.1
Host is up (0.0023s latency).
MAC Address: AA:BB:CC:DD:EE:01 (Cisco Systems)

Nmap scan report for 192.168.1.50
Host is up (0.0041s latency).
MAC Address: AA:BB:CC:DD:EE:02 (Dell)

Nmap scan report for 192.168.1.100
Host is up (0.00012s latency).

Nmap done: 256 IP addresses (3 hosts up) scanned in 2.84 seconds

# SYN scan (default, stealthy, fast) — requires root
sudo nmap -sS 192.168.1.50 -oA syn-scan

# Breakdown:
#   -sS   SYN (half-open) scan — sends SYN, waits for SYN/ACK
#         If received → port open, send RST (never complete handshake)
#         Result: stealthier because no full TCP connection is logged

# Connect scan (no root needed, noisier)
nmap -sT 192.168.1.50 -oA connect-scan

# Breakdown:
#   -sT   TCP connect scan — completes full 3-way handshake
#         Visible in logs, but works without root/sudo

# UDP scan (slow but essential — many services use UDP)
sudo nmap -sU --top-ports 20 192.168.1.50 -oA udp-scan

# Breakdown:
#   -sU            UDP scan (no handshake — relies on ICMP responses)
#   --top-ports 20 Only scan the 20 most common UDP ports (DNS, SNMP, DHCP...)
#   UDP is SLOW — always limit port range unless you have time

# Scan specific ports
sudo nmap -sS -p 22,80,443,445,3389,8080 192.168.1.50

# Scan ALL ports (1-65535)
sudo nmap -sS -p- 192.168.1.50 -oA full-port-scan

# Scan top 1000 ports (Nmap default)
sudo nmap -sS --top-ports 1000 192.168.1.50

# Combined TCP + UDP scan
sudo nmap -sS -sU --top-ports 100 192.168.1.50 -oA combined-scan

PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
443/tcp  open  https
3306/tcp open  mysql
8080/tcp open  http-proxy

Nmap done: 1 IP address (1 host up) scanned in 1.43 seconds

# Service & version detection on all open ports
sudo nmap -sV 192.168.1.50 -oA version-scan

# Breakdown:
#   -sV   Probe open ports to determine service/version info
#         Sends service-specific probes and matches responses
#         against nmap-service-probes database

# Increase intensity for stubborn services (0-9, default: 7)
sudo nmap -sV --version-intensity 9 192.168.1.50

# Light version scan (faster, less accurate)
sudo nmap -sV --version-light 192.168.1.50

# Combined: SYN scan + version detection + all ports
sudo nmap -sS -sV -p- 192.168.1.50 -oA full-version-scan

PORT     STATE SERVICE  VERSION
22/tcp   open  ssh      OpenSSH 8.9p1 Ubuntu 3ubuntu0.1 (Ubuntu Linux; protocol 2.0)
80/tcp   open  http     Apache httpd 2.4.52 ((Ubuntu))
443/tcp  open  ssl/http nginx 1.18.0 (Ubuntu)
3306/tcp open  mysql    MySQL 8.0.32-0ubuntu0.22.04.2
8080/tcp open  http     Apache Tomcat 9.0.68

Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

# OS detection — requires root and at least 1 open + 1 closed port
sudo nmap -O 192.168.1.50 -oA os-detect

# Breakdown:
#   -O   Enable OS detection (TCP/IP fingerprinting)
#        Sends specially crafted packets and compares responses
#        to nmap-os-db database (thousands of fingerprints)

# More aggressive guessing when detection is uncertain
sudo nmap -O --osscan-guess 192.168.1.50

# Limit OS detection attempts (faster, give up on hard targets)
sudo nmap -O --max-os-tries 1 192.168.1.50

# The ultimate recon combo: SYN + Version + OS + Default Scripts
sudo nmap -sS -sV -O -sC 192.168.1.50 -oA full-recon
# Shorthand for the above:
sudo nmap -A 192.168.1.50 -oA aggressive-scan

OS detection performed. Please report any incorrect results at https://nmap.org/submit/
Device type: general purpose
Running: Linux 5.X
OS CPE: cpe:/o:linux:linux_kernel:5
OS details: Linux 5.4 - 5.15
Network Distance: 1 hop

Aggressive OS guesses: Linux 5.4 (97%), Linux 5.15 (94%), Linux 5.10 (92%)

# Run default safe scripts (-sC is shorthand for --script=default)
sudo nmap -sV -sC 192.168.1.50 -oA default-scripts

# Run all vuln-category scripts
sudo nmap -sV --script vuln 192.168.1.50 -oA vuln-scan

# Run a specific script
sudo nmap -sV --script http-vuln-cve2021-41773 -p 80 192.168.1.50

# Run multiple script categories
sudo nmap -sV --script "vuln,safe,discovery" 192.168.1.50

# SMB enumeration (Windows targets)
sudo nmap --script smb-enum-shares,smb-enum-users,smb-os-discovery -p 445 192.168.1.50

# HTTP enumeration
sudo nmap --script http-enum,http-headers,http-methods,http-title -p 80,443,8080 192.168.1.50

# Pass arguments to scripts
sudo nmap --script http-brute --script-args userdb=users.txt,passdb=pass.txt -p 80 192.168.1.50

Q: Do you have root/sudo access?
│
├── NO
│   └── Use -sT (TCP Connect) — only option without root
│
└── YES
    │
    Q: Do you need to be stealthy?
    │
    ├── YES
    │   │
    │   Q: Is the target behind a firewall?
    │   │
    │   ├── YES → Try -sS first. If blocked, try -sF/-sX/-sN
    │   │         Add -f (fragment packets) + -D (decoys)
    │   │
    │   └── NO → Use -sS (SYN scan) — fast & stealthy
    │
    └── NO (speed matters more)
        │
        Q: Need UDP services too?
        │
        ├── YES → -sS -sU (combined TCP + UDP)
        │
        └── NO → -sS with -T4 for speed
              

# Fragment packets — split probes into tiny fragments
sudo nmap -sS -f 192.168.1.50
# -f   Fragment packets into 8-byte chunks (harder for firewalls to reassemble)
# -ff  Fragment into 16-byte chunks (even smaller)

# Decoy scan — hide your IP among fake source IPs
sudo nmap -sS -D RND:5 192.168.1.50
# -D RND:5   Generate 5 random decoy IPs alongside your real scan
#            Target sees 6 scanners — can't tell which is real

# Spoof source port (some firewalls allow traffic from port 53/80)
sudo nmap -sS --source-port 53 192.168.1.50

# Add random data to packets (avoid signature detection)
sudo nmap -sS --data-length 24 192.168.1.50

# Use a specific MTU (must be multiple of 8)
sudo nmap -sS --mtu 24 192.168.1.50

# Idle/zombie scan — scan using a third-party zombie host
sudo nmap -sI zombie-host:port 192.168.1.50
# -sI   Completely hides your IP — uses predictable IP-ID of zombie
#       The ultimate stealth scan (complex to set up)

# MAC address spoofing
sudo nmap -sS --spoof-mac Dell 192.168.1.50
# --spoof-mac Dell   Random Dell MAC
# --spoof-mac 0      Completely random MAC

Ports showing as "filtered"?
│
├── Try -Pn (skip host discovery, assume alive)
│
├── Still filtered? → Try -sA (ACK scan to map firewall rules)
│   └── Shows unfiltered? → Firewall is stateless → Try -sF/-sX/-sN
│
├── Still blocked? → Try -f (fragment) + --source-port 53
│
├── Still blocked? → Try --data-length 24 + -T2 (slow & padded)
│
└── Last resort → -sI zombie:port (idle scan through third-party)
              

# Set maximum packets per second
sudo nmap -sS --max-rate 100 192.168.1.0/24

# Set minimum packets per second (force speed)
sudo nmap -sS --min-rate 1000 192.168.1.0/24

# Control parallelism (how many hosts at once)
sudo nmap -sS --min-parallelism 10 --max-parallelism 50 192.168.1.0/24

# Set host timeout (skip hosts taking too long)
sudo nmap -sS --host-timeout 30s 192.168.1.0/24

# Set per-probe retransmission limits
sudo nmap -sS --max-retries 2 192.168.1.0/24

# 1. Use searchsploit (local ExploitDB mirror, comes with Kali)
searchsploit Apache 2.4.52
searchsploit OpenSSH 8.9
searchsploit MySQL 8.0

# 2. Get more details on a specific exploit
searchsploit -x 50383   # View exploit details
searchsploit -m 50383   # Copy exploit to current directory

# 3. Online resources (when searchsploit isn't enough)
#    https://www.exploit-db.com     ← ExploitDB (full database)
#    https://nvd.nist.gov           ← NVD (CVE details + CVSS scores)
#    https://cve.mitre.org          ← CVE catalog
#    https://vulners.com            ← Aggregated vuln search

# 4. Use Nmap NSE for automated checking
sudo nmap -sV --script vulners 192.168.1.50
# The 'vulners' script queries the vulners.com API
# and shows CVEs for detected service versions

REPORT STRUCTURE:

1. EXECUTIVE SUMMARY (1 page max)
   ├── Engagement overview (who, what, when, why)
   ├── Key findings summary (plain English, no jargon)
   ├── Overall risk rating (Critical / High / Medium / Low)
   └── Top 3 recommendations (actionable, prioritized)

2. SCOPE & METHODOLOGY
   ├── Authorized targets and boundaries
   ├── Tools used and versions
   ├── Scan types performed and justification
   └── Testing timeline

3. FINDINGS (per finding)
   ├── Title (descriptive, e.g., "Exposed MySQL Database on 192.168.1.50:3306")
   ├── Risk Rating (Critical/High/Medium/Low)
   ├── Description (what was found)
   ├── Evidence (screenshots, Nmap output, exact command used)
   ├── Impact (what could an attacker do with this?)
   ├── Remediation (specific steps to fix)
   └── References (CVE links, vendor advisories)

4. APPENDICES
   ├── Full Nmap output files
   ├── Target list and exclusion list
   ├── Raw scan data (XML files)
   └── Tool version information
              

ACTION LOG FORMAT:

Timestamp:     2026-02-22 14:30 UTC
Action:        SYN scan on 192.168.1.0/24
Command:       sudo nmap -sS -p- -oA full-syn-192.168.1.0 192.168.1.0/24
Justification: Full port scan required to identify all open services after
               initial host discovery revealed 12 live hosts. SYN scan chosen
               for speed and stealth per engagement rules.
Result:        Found 47 open ports across 12 hosts. Key findings:
               - 192.168.1.50: Port 3306 (MySQL) open — investigate further
               - 192.168.1.100: Port 445 (SMB) open — check for EternalBlue
Output File:   scans/full-syn-192.168.1.0-20260222.nmap
              

# 1. Archive everything into a compressed, encrypted file
tar czf project-name-$(date +%Y%m%d).tar.gz ~/engagements/project-name/

# 2. Encrypt the archive (GPG)
gpg -c --cipher-algo AES256 project-name-20260222.tar.gz

# 3. Verify the encrypted archive
gpg -d project-name-20260222.tar.gz.gpg | tar tzf -

# 4. Securely delete originals (shred, not rm)
shred -vfz -n 3 ~/engagements/project-name/scans/*
rm -rf ~/engagements/project-name/

# 5. Clear bash history of sensitive commands
history -c
cat /dev/null > ~/.bash_history

# Step 1: Discover live hosts
sudo nmap -sn 192.168.1.0/24 -oA 01-discovery

# Step 2: Quick port scan on live hosts
sudo nmap -sS --top-ports 1000 -iL live-hosts.txt -oA 02-port-scan

# Step 3: Full port scan on interesting hosts
sudo nmap -sS -p- 192.168.1.50 -oA 03-full-ports

# Step 4: Service + version + OS + default scripts
sudo nmap -sS -sV -O -sC -p 22,80,443,3306 192.168.1.50 -oA 04-enum

# Step 5: Vulnerability scan
sudo nmap -sV --script vuln -p 22,80,443,3306 192.168.1.50 -oA 05-vuln

# One-liner: all ports, all info, aggressive timing
sudo nmap -A -T4 -p- 10.10.10.5 -oA htb-target

# Quick recon with vuln check
sudo nmap -sV -sC --script vuln -T4 10.10.10.5 -oA htb-vuln

# Slow, fragmented, decoy scan — maximum stealth
sudo nmap -sS -T2 -f -D RND:5 --data-length 24 --source-port 53 -p 22,80,443,445,3389 192.168.1.50 -oA stealth-scan

# Windows-focused scan: SMB, RDP, WinRM, LDAP, Kerberos
sudo nmap -sS -sV -sC -p 21,22,53,80,88,135,139,389,443,445,636,3268,3269,3389,5985,5986 192.168.1.50 -oA windows-enum

# SMB-specific enumeration
sudo nmap --script "smb-*" -p 445 192.168.1.50 -oA smb-enum

# Web-focused enumeration: HTTP scripts
sudo nmap -sV --script "http-enum,http-headers,http-methods,http-title,http-robots.txt,http-shellshock,http-vuln*" -p 80,443,8080,8443 192.168.1.50 -oA web-enum

# Top 20 UDP ports — catches DNS, SNMP, DHCP, TFTP, NTP
sudo nmap -sU -sV --top-ports 20 192.168.1.50 -oA udp-quick

# SNMP enumeration (if port 161 found open)
sudo nmap -sU -sV --script snmp-info,snmp-sysdescr,snmp-netstat -p 161 192.168.1.50