Scanning
Active scanning reveals open ports, running services, and potential vulnerabilities. This phase provides the technical foundation for exploitation.
Frameworks: WSTG-INFO-02, WSTG-CONF-01, -02 · ASVS 5.0 V13.4 · CWE-200 · T1595.002
At a glance
- Covers
- Port, service, and version scanning plus automated vulnerability scanning
- Use it when
- The recon map is ready and you need known open ports and services
- Key tool
- nmap, nuclei, nikto, testssl.sh
Why Scanning Matters
Service Discovery: Find all entry points - web servers, APIs, databases, and admin panels
Version Identification: Detect software versions to identify known CVEs and exploits
Misconfigurations: Automated scanners catch default credentials, exposed panels, and weak SSL
Attack Prioritization: Focus on high-value targets based on scan results
⚠️ Warning: Active scanning generates significant network traffic and will be logged. Ensure you have authorization and coordinate with the client's security team.
Essential Scanning Tools
Feroxbuster
Fast, recursive content discovery in Rust
feroxbuster -u https://acme.internal -w wordlist.txt
GitHub →
Semgrep
SAST scanner — find code-level vulnerabilities when source is available
semgrep --config=auto .
Website →
Scanning Process Flow
Target IPs/Domains
→
Host Discovery
→
Port Scanning
→
Service Detection
→
Version Detection
→
Vulnerability Scanning
→
Web App Scanning
→
Findings Report
Port Scanning with Nmap
Nmap is the industry-standard port scanner. Understanding its options is essential for effective scanning.
Basic Scan Types
basic-scan.sh
# TCP SYN scan (stealth scan) - requires root
$ sudo nmap -sS 10.10.14.7
# TCP Connect scan (no root required)
$ nmap -sT 10.10.14.7
# UDP scan (slow, but important)
$ sudo nmap -sU 10.10.14.7
# Combined TCP and UDP
$ sudo nmap -sS -sU 10.10.14.7
# ACK scan (firewall detection)
$ sudo nmap -sA 10.10.14.7
# FIN scan (stealthier)
$ sudo nmap -sF 10.10.14.7Comprehensive Scanning
full-scan.sh
# Quick initial scan - find open ports fast
$ nmap -p- --min-rate=1000 -T4 10.10.14.7 -oN initial_scan.txt
# Detailed scan on discovered ports
$ nmap -sC -sV -p 22,80,443,8080 10.10.14.7 -oN detailed_scan.txt
# Full comprehensive scan
$ sudo nmap -sS -sV -sC -O -A -p- 10.10.14.7 -oA full_scan
# Web-focused scan
$ nmap -sV -p 80,443,8080,8443 --script=http-* 10.10.14.7
# Scan common web ports
$ nmap -sV -p 80,443,8000,8080,8443,8888,9000,9090 10.10.14.7| Flag | Description | Use Case |
|---|---|---|
-sS |
SYN stealth scan | Default, fast, stealthy |
-sV |
Version detection | Identify service versions |
-sC |
Default scripts | Run common NSE scripts |
-O |
OS detection | Identify operating system |
-A |
Aggressive | OS, version, script, traceroute |
-p- |
All ports | Scan all 65535 ports |
-T4 |
Timing template | Faster scanning (0-5) |
-oA |
Output all formats | Normal, XML, grepable |
NSE Scripts for Web
nse-web.sh
# HTTP enumeration
$ nmap -sV -p 80,443 --script=http-enum 10.10.14.7
# HTTP headers
$ nmap -sV -p 80,443 --script=http-headers 10.10.14.7
# HTTP methods (PUT, DELETE, etc.)
$ nmap -sV -p 80,443 --script=http-methods 10.10.14.7
# SSL/TLS analysis
$ nmap -sV -p 443 --script=ssl-enum-ciphers 10.10.14.7
$ nmap -sV -p 443 --script=ssl-cert 10.10.14.7
# Vulnerability scanning
$ nmap -sV -p 80,443 --script=vuln 10.10.14.7
# WAF detection
$ nmap -sV -p 80,443 --script=http-waf-detect,http-waf-fingerprint 10.10.14.7
# Specific vulnerability checks
$ nmap -sV -p 443 --script=http-shellshock 10.10.14.7
$ nmap -sV -p 80 --script=http-sql-injection 10.10.14.7Vulnerability Scanning
Nikto - Web Server Scanner
nikto.sh
# Basic scan
$ nikto -h https://acme.internal
# Scan specific port
$ nikto -h https://acme.internal -p 8443
# Output to file
$ nikto -h https://acme.internal -o nikto_report.html -Format htm
# Tuning options (specific tests)
$ nikto -h https://acme.internal -Tuning 123bde
# With authentication
$ nikto -h https://acme.internal -id admin:password
# SSL mode
$ nikto -h https://acme.internal -ssl
# Follow redirects
$ nikto -h https://acme.internal -followredirectsNuclei - Template-Based Scanner
nuclei.sh
# Update templates
$ nuclei -update-templates
# Basic scan with all templates
$ nuclei -u https://acme.internal
# Scan from URL list
$ nuclei -list urls.txt
# Filter by severity
$ nuclei -u https://acme.internal -severity critical,high
# Specific template tags
$ nuclei -u https://acme.internal -tags cve,rce,sqli
# Technology-specific
$ nuclei -u https://acme.internal -tags wordpress
$ nuclei -u https://acme.internal -tags apache
# Rate limiting
$ nuclei -u https://acme.internal -rate-limit 100
# Output formats
$ nuclei -u https://acme.internal -o results.txt
$ nuclei -u https://acme.internal -json -o results.json
# Custom templates
$ nuclei -u https://acme.internal -t /path/to/custom-templates/Nuclei Templates
Nuclei has thousands of community templates covering CVEs, misconfigurations, exposed panels,
default credentials, and more. Update templates regularly with
nuclei -update-templates.
SSL/TLS Analysis
tls-audit.sh
# Using testssl.sh
$ ./testssl.sh https://acme.internal
# Quick check
$ ./testssl.sh --fast https://acme.internal
# Check specific vulnerabilities
$ ./testssl.sh --heartbleed https://acme.internal
$ ./testssl.sh --poodle https://acme.internal
$ ./testssl.sh --beast https://acme.internal
# Using sslscan
$ sslscan acme.internal:443
# Using sslyze
$ sslyze acme.internal
# OpenSSL manual check
$ openssl s_client -connect acme.internal:443
$ echo | openssl s_client -connect acme.internal:443 2>/dev/null | openssl x509 -textWeb Application Proxies
Intercepting proxies are essential for manual web application testing and understanding application behavior.
Burp Suite Setup
Initial Configuration
- Set proxy listener (default: 127.0.0.1:8080)
- Configure browser to use proxy
- Install Burp CA certificate
- Add target to scope
- Configure spider settings
Useful Extensions
- • Autorize - Authorization testing
- • Logger++ - Enhanced logging
- • Turbo Intruder - Fast fuzzing
- • ActiveScan++ - Enhanced scanning
- • JSON Web Tokens - JWT manipulation
Scanning Output & Organization
scan-output.sh
# Create organized directory structure
mkdir -p scans/{nmap,nikto,nuclei,ssl}
# Run organized scans
nmap -sC -sV -oA scans/nmap/full_scan acme.internal
nikto -h https://acme.internal -o scans/nikto/report.html -Format htm
nuclei -u https://acme.internal -json -o scans/nuclei/results.json
testssl.sh --jsonfile scans/ssl/results.json https://acme.internal
# Parse Nmap XML to extract info
xsltproc scans/nmap/full_scan.xml -o scans/nmap/report.html
# Extract open ports from Nmap
grep "open" scans/nmap/full_scan.nmap | cut -d'/' -f1Scanning Testing Checklist
Port Scanning
- ☐ Quick scan for open ports
- ☐ Full 65535 port scan completed
- ☐ UDP scan on common ports
- ☐ Service version detection (-sV)
- ☐ OS detection if needed
Vulnerability Scanning
- ☐ Nuclei scan with updated templates
- ☐ Nikto web server scan
- ☐ NSE vuln scripts run
- ☐ Technology-specific scans (WPScan, etc.)
- ☐ CVE checks against versions
SSL/TLS Analysis
- ☐ testssl.sh or sslscan run
- ☐ Certificate validity checked
- ☐ Weak ciphers identified
- ☐ Protocol version analysis
- ☐ Known SSL vulns tested
Documentation
- ☐ Scan results saved in multiple formats
- ☐ Open ports documented
- ☐ Services and versions listed
- ☐ Potential vulnerabilities noted
- ☐ False positives filtered
Practice Labs
Scanning Practice
Practice scanning techniques on these intentionally vulnerable platforms.
Next Steps
With open ports and services identified, proceed to Enumeration to discover
directories, files, and application-specific details.