Scanning

Network Scanning

Network scanning identifies live hosts, open ports, and running services across the internal network. This phase builds the target inventory for deeper enumeration and exploitation.

Danger

Scanning is the loudest phase of an internal test, and the two variables you control — rate and probe type — are both authorisation questions rather than tuning preferences. A --min-rate=1000 sweep across a WAN link can saturate the circuit, an aggressive UDP scan can fill a firewall's session table, and --script vuln runs exploits against production. Agree the rate, the windows and the excluded hosts in the rules of engagement before the first packet, and treat any host outside the signed range as out of scope even if it answers.

Scanning Workflow 7 STEPS

🌐

Network Range

Define scope

→

📡

Host Discovery

Find live hosts

→

🔌

Port Scanning

Open ports

→

🔍

Service Detection

Identify services

→

💻

OS Fingerprint

Detect OS

→

⚠️

Vuln Scanning

Find vulns

→

🎯

Prioritization

Rank targets

Host Discovery

ICMP Ping Sweep

Nmap ping sweep for live host detection.

ping-sweep.sh

# Basic ping sweep
nmap -sn 10.0.0.0/24

# Output live hosts to file
nmap -sn 10.0.0.0/24 -oG - | grep Up | cut -d' ' -f2 > live_hosts.txt

# Disable DNS resolution for speed
nmap -sn -n 10.0.0.0/24

# Multiple subnets
nmap -sn 10.0.0.0/24 10.0.1.0/24 10.0.2.0/24

# From file
nmap -sn -iL subnets.txt

ARP Scanning (Layer 2)

ARP scan - most reliable on local subnet, bypasses firewalls.

arp-scan.sh

# arp-scan (requires root)
sudo arp-scan -l -I eth0
sudo arp-scan 10.0.0.0/24 -I eth0

# Netdiscover - passive and active modes
sudo netdiscover -r 10.0.0.0/24 -i eth0
sudo netdiscover -p -i eth0  # Passive mode

# Nmap ARP discovery (local subnet only)
sudo nmap -PR -sn 10.0.0.0/24

TCP/UDP Discovery

Bypass ICMP blocking with TCP/UDP probes.

tcp-udp-discovery.sh

# TCP SYN ping on common ports
nmap -PS22,80,443,445,3389 -sn 10.0.0.0/24

# TCP ACK ping
nmap -PA80,443 -sn 10.0.0.0/24

# UDP ping
nmap -PU53,161,137 -sn 10.0.0.0/24

# Combined discovery (thorough)
nmap -PS22,80,443,445 -PA80,443 -PU53,161 -sn 10.0.0.0/24

# SCTP discovery
nmap -PY -sn 10.0.0.0/24

Tip

In internal networks, ARP scanning is the most reliable for the local subnet since it operates at Layer 2 and cannot be blocked by host firewalls. For remote subnets, combine TCP SYN and UDP probes.

Port Scanning

Quick Scans

Fast initial scans to identify attack surface.

quick-port-scan.sh

# Top 1000 ports (default)
nmap 10.0.0.1

# Top 100 ports
nmap -F 10.0.0.1

# All ports - fast rate
nmap -p- --min-rate=1000 -T4 10.0.0.1

# Common internal ports
nmap -p 21,22,23,25,53,80,88,110,111,135,139,143,389,443,445,\
464,593,636,993,995,1433,1521,3306,3389,5432,5900,5985,8080 10.0.0.1

Comprehensive Service Scans

Detailed scanning with version detection.

service-scan.sh

# Version detection + default scripts
nmap -sC -sV -p 22,80,445,3389 10.0.0.1 -oA detailed_scan

# Full TCP scan with OS detection
sudo nmap -sS -sV -sC -O -p- 10.0.0.1 -oA full_tcp

# UDP scan (slow but important)
sudo nmap -sU --top-ports 100 10.0.0.1

# Aggressive scan (noisy)
sudo nmap -A -T4 10.0.0.1

Port	Service	Internal Pentest Value
88	Kerberos	Domain Controller - Kerberoasting, AS-REP
389/636	LDAP/LDAPS	AD enumeration, credential attacks
445	SMB	File shares, relay attacks, EternalBlue
135	RPC	Enumeration, DCOM exploitation
5985/5986	WinRM	Remote PowerShell access
3389	RDP	Remote desktop, BlueKeep
1433	MSSQL	Database access, xp_cmdshell
22	SSH	Linux/network device access

Domain Controller Discovery

Identify domain controllers - primary targets in AD environments.

dc-discovery.sh

# DNS query for DCs
nslookup -type=SRV _ldap._tcp.dc._msdcs.domain.local
dig SRV _ldap._tcp.dc._msdcs.domain.local

# Find GC servers
nslookup -type=SRV _gc._tcp.domain.local

# Scan for DC ports
nmap -p 53,88,135,139,389,445,464,636,3268,3269 10.0.0.0/24

# Identify DCs by open port combination
nmap -p 88,389,636 --open 10.0.0.0/24 -oG - | grep "88/open" | grep "389/open"

NSE Scripts for Internal Networks

SMB Enumeration

nse-smb.sh

# SMB security mode
nmap -p 445 --script smb-security-mode 10.0.0.1

# SMB shares
nmap -p 445 --script smb-enum-shares 10.0.0.1

# SMB users (requires access)
nmap -p 445 --script smb-enum-users 10.0.0.1

# SMB vulnerabilities
nmap -p 445 --script smb-vuln* 10.0.0.1

# All SMB scripts
nmap -p 139,445 --script smb* 10.0.0.1

LDAP & Kerberos

nse-ldap-kerberos.sh

# LDAP root DSE
nmap -p 389 --script ldap-rootdse 10.0.0.1

# LDAP search (anonymous)
nmap -p 389 --script ldap-search 10.0.0.1

# Kerberos enumeration
nmap -p 88 --script krb5-enum-users --script-args \
  krb5-enum-users.realm='DOMAIN.LOCAL',userdb=users.txt 10.0.0.1

Other Useful Scripts

nse-other.sh

# MS-SQL info
nmap -p 1433 --script ms-sql-info 10.0.0.1

# SNMP enumeration
nmap -sU -p 161 --script snmp-info,snmp-interfaces 10.0.0.1

# NFS shares
nmap -p 111,2049 --script nfs-ls,nfs-showmount 10.0.0.1

# RDP security
nmap -p 3389 --script rdp-enum-encryption 10.0.0.1

# FTP anonymous
nmap -p 21 --script ftp-anon 10.0.0.1

Vulnerability Scanning

Nmap Vulnerability Scripts

nmap-vuln-scripts.sh

# All vuln scripts (noisy)
nmap --script vuln 10.0.0.1

# Specific CVE checks
nmap -p 445 --script smb-vuln-ms17-010 10.0.0.1  # EternalBlue
nmap -p 3389 --script rdp-vuln-ms12-020 10.0.0.1  # BlueKeep
nmap -p 443 --script ssl-heartbleed 10.0.0.1

# Check for ZeroLogon (CVE-2020-1472)
nmap -p 135,139,445 --script smb-vuln* 10.0.0.1

Nessus / OpenVAS

For comprehensive vulnerability assessment, use dedicated scanners like Nessus or OpenVAS. These provide detailed vulnerability reports with CVSS scores and remediation guidance.

Warning

Vulnerability scanning can be disruptive. Coordinate with the client and avoid scanning critical production systems during business hours. Always have emergency contacts ready.

Output Organization

scan-workflow.sh

# Create organized directory structure
mkdir -p scans/{discovery,ports,services,vulns}

# Systematic scanning workflow
# 1. Host discovery
nmap -sn 10.0.0.0/24 -oA scans/discovery/live_hosts

# 2. Quick port scan on live hosts
nmap -iL scans/discovery/live_hosts.gnmap -p- --min-rate=1000 \
  -oA scans/ports/all_ports

# 3. Service detection on open ports
nmap -iL scans/discovery/live_hosts.gnmap -sC -sV \
  -p $(cat scans/ports/all_ports.nmap | grep open | cut -d'/' -f1 | sort -u | tr '\n' ',') \
  -oA scans/services/detailed

# 4. Vulnerability scanning
nmap -iL scans/discovery/live_hosts.gnmap --script vuln \
  -oA scans/vulns/vuln_scan

# Parse results
grep -E "^[0-9]" scans/ports/all_ports.gnmap | cut -d' ' -f2 | sort -u > targets.txt
grep "open" scans/services/detailed.nmap | grep -v "filtered"

Information

With hosts and services identified, proceed to Enumeration for detailed SMB, LDAP, and service-specific information gathering.

Evidence Collection

A scan is only evidence if a reviewer can repeat it, and a scan result is only a finding if it names the port, the service and the proof.

Saved scan output: Every scan written with -oA, so the XML, greppable and text forms exist together. A screenshot of a terminal is not a scan record.

Command lines: The exact invocation per scan, including timing template and rate. "nmap found 445 open" is unverifiable without the flags that produced it.

Host and service inventory: Live hosts, open ports and version strings as a table, with the NSE script output that identified each service.

Vulnerability checks: Which script produced each result and what the script printed verbatim. LIKELY VULNERABLE and VULNERABLE mean different things and must not be merged into one row.

Scan timing: When each range was scanned, so the client can reconcile the traffic against their IDS and firewall logs.

False Positive Identification

Version guessing: -sV infers a version from a banner and is sometimes wrong by a minor revision — which changes whether a CVE applies. Confirm anything you intend to report by connecting to the service, not from the fingerprint alone.
Filtered is not closed: A port reported as filtered is blocked by a device, and the service may be running behind it. Never report filtered as "service not present"; report it as "not reachable from this position".
NSE vulnerability heuristics: Several smb-vuln* scripts return LIKELY VULNERABLE from a version heuristic. Only a definitive script result plus the patch level from the host inventory justifies a Critical finding.
UDP silence: A UDP scan that returns nothing on a slow or rate-limited network proves nothing. Check the scan statistics for send failures and retransmits before concluding the port is closed.
Duplicate hosts: Multi-homed machines and load balancers appear as several addresses with the same services. Deduplicate by MAC or hostname before the host count reaches the report.

Testing Checklist

A scan is only worth running if its output can be re-read and challenged. These are the checks that make the results defensible.

Record the run

☐ Every scan is written with -oA, so the XML, greppable and text forms exist together, and the command line is in the notes.
☐ Scan timing per range is recorded, so the client can reconcile the traffic against IDS and firewall logs.
☐ UDP results are checked against the scan statistics (send failures, retransmits) before a port is called closed.
☐ Host counts are de-duplicated by MAC or hostname; a load balancer is one service, not four hosts.

Challenge the result

☐ A filtered port is reported as filtered, never as closed, and is retested from a second position if the claim matters.
☐ -sV fingerprints are confirmed by connecting to the service before any CVE is attached to a version.
☐ NSE smb-vuln* output is quoted verbatim - LIKELY VULNERABLE never becomes VULNERABLE in a finding.
☐ A domain controller is confirmed by 88/389 plus ldap-rootdse, not by a hostname convention.

Remediation & Defense

The scan inventory is a description of the attack surface, so the fixes are mostly about removing services rather than patching them.

Reduce the exposed surface

• Close SMB, RPC and WinRM between workstation VLANs; only management hosts need them
• Remove Telnet, TFTP, SNMP v1/v2c and unauthenticated FTP from servers and network devices
• Place management interfaces behind a jump host rather than exposing them to the user VLAN

Harden what stays

• Require SMB signing and disable SMBv1 everywhere, including appliances
• Restrict RDP to a broker or VPN, and enforce NLA with account lockout
• Run authenticated vulnerability scanning on a schedule so patch gaps surface before a test does

Detect the scan

• Alert on horizontal port sweeps and on NSE User-Agent strings at the web tier
• Rate-limit or block scanning sources at the IPS, and log the block for the IR team

Enumeration

Turn the scan inventory into service-level detail

Nmap Cheatsheet

Scan flags and NSE scripts for repeat use

Network Security

What the scanned ports and services should look like

Network Scanning

Host Discovery

ICMP Ping Sweep

ARP Scanning (Layer 2)

TCP/UDP Discovery

Port Scanning

Quick Scans

Comprehensive Service Scans

Domain Controller Discovery

NSE Scripts for Internal Networks

SMB Enumeration

LDAP & Kerberos

Other Useful Scripts

Masscan

RustScan

nxc (Network Scan)

Vulnerability Scanning

Nmap Vulnerability Scripts

Nessus / OpenVAS

Output Organization

Evidence Collection

False Positive Identification

Testing Checklist

Record the run

Challenge the result

Remediation & Defense

The scan inventory is a description of the attack surface, so the fixes are mostly about removing services rather than patching them.

Reduce the exposed surface

Harden what stays

Detect the scan

Enumeration

Nmap Cheatsheet

Network Security

Related Tools

Nmap Builder

Reverse Shell Generator

Port Reference

Findings Library

Network Scanning

Host Discovery

ICMP Ping Sweep

ARP Scanning (Layer 2)

TCP/UDP Discovery

Port Scanning

Quick Scans

Comprehensive Service Scans

Domain Controller Discovery

NSE Scripts for Internal Networks

SMB Enumeration

LDAP & Kerberos

Other Useful Scripts

Masscan

RustScan

nxc (Network Scan)

Vulnerability Scanning

Nmap Vulnerability Scripts

Nessus / OpenVAS

Output Organization

Evidence Collection

False Positive Identification

Testing Checklist

Record the run

Challenge the result

Remediation & Defense

The scan inventory is a description of the attack surface, so the fixes are mostly about removing services rather than patching them.

Reduce the exposed surface

Harden what stays

Detect the scan

Related Topics

Enumeration

Nmap Cheatsheet

Network Security

Related Tools

Nmap Builder

Reverse Shell Generator

Port Reference

Findings Library