Internal Port Scanning

Thought process (pentest)

• Scanning all 65535 ports on every discovered host loses viability with internal networks with larger numbers of hosts.
• Host discovery should be completed separately and the result IP addresses used as an input for port discovery scans
• The IP addresses being referenced in these commands should be verified against the in scope & out of scope documentation to confirm scope isn’t being violated at every step of the penetration testing process.

Options

type	speed	COVERAGE	command	explanation
TCP	FAST	MODERATE	nmap --top-ports 200 -sT -T3 -Pn -n --open <target> -oA ./scans/nmap/tcp-top-200-ports	Assumes hosts up and performs a TCP CONNECT scan against the top 200 TCP Ports
UDP	FAST	MODERATE	nmap --top-ports 200 -sU -T3 -Pn -n --open <target> -oA ./scans/nmap/tcp-top-200-ports	Assumes hosts up and performs a UDP scan against the top 200 UDP Ports
TCP	MODERATE	HIGH	nmap --top-ports 1000 -sT -T3 -Pn -n --open <target> -oA ./scans/nmap/tcp-top-1000-ports	Assumes hosts up and performs a TCP CONNECT port scan against the top 1000 TCP Ports
UDP	MODERATE	HIGH	nmap --top-ports 1000 -sT -T3 -Pn -n --open <target> -oA ./scans/nmap/tcp-top-1000-ports	Assumes hosts up and performs a UDP port scan against the top 1000 UDP Ports
TCP	SLOW	VERY HIGH	nmap --top-ports 4000 -sT -T3 -Pn -n --open <target> -oA ./scans/nmap/tcp-top-4000-ports	Assumes host up and performs a TCP CONNECT port scan against the top 4000 TCP Ports
UDP	SLOW	VERY HIGH	nmap --top-ports 2000 -sT -T3 -Pn -n --open <target> -oA ./scans/nmap/tcp-top-4000-ports	Assumes host up and performs a UDP port scan against the top 2000 UDP Ports

Related

Related Notes

All Related Notes

TABLE file.ctime as "Created", tags as "Tags"
FROM "New Notes"
WHERE contains(tags, "discovery") OR contains(tags, "nmap") OR contains(tags, "scanning")
SORT file.ctime DESC

discovery

TABLE file.ctime as "Created", tags as "Tags"
FROM "New Notes"
WHERE contains(tags, "discovery")
SORT file.ctime DESC

nmap

TABLE file.ctime as "Created", tags as "Tags"
FROM "New Notes"
WHERE contains(tags, "nmap")
SORT file.ctime DESC

scanning

TABLE file.ctime as "Created", tags as "Tags"
FROM "New Notes"
WHERE contains(tags, "scanning")
SORT file.ctime DESC