Skip to content
OPS // KITitspentest.sh

RANK37/Operator

2,140 / 3,000 XP

Dossier

[email protected]

uid=0 · root · Operator

Respect
84
Owned
12
Disconnect →

R-NMA

Nmap

Network scanner for discovering hosts, ports, and services in scope.

Official siteBack to catalog

OVERVIEW

Nmap probes IP ranges and ports to work out which hosts are alive, which ports are open, and what service (with version) is listening on each one. It's almost always the first command run against a new network scope.

The NSE scripting engine extends that with hundreds of checks: known-vulnerability detection, SMB share enumeration, service banners, and more, all from the same binary.

USE CASES

Practical use cases

  • 01

    Discovering live hosts across a network range before touching anything else.

  • 02

    Enumerating ports and service versions to prioritize targets.

  • 03

    Detecting known vulnerabilities and misconfigs via NSE scripts.

  • 04

    Building a repeatable network inventory to diff across engagement checkpoints.

QUICK START

First pass on the agreed scope — what is alive and what it exposes — before deeper enumeration.

  1. Confirm the IP range is inside the authorized scope.
  2. Run a fast host-discovery pass across the whole range.
  3. Against the live hosts, run a version scan with default scripts.
  4. Review the output and decide which services deserve deeper enumeration.
root@itspentest:~# nmap -sV -sC -oA scan_results 10.10.10.0/24

BEFORE YOU RUN IT

What to check before running it

It's noisy: any decent IDS/IPS will flag it, so tune timing (-T) to the agreed stealth profile.

Aggressive version detection can hang fragile services on older production infrastructure.

Always save output in multiple formats (-oA) so the report has reproducible evidence.

KEEP EXPLORING

View the whole phase →