Network Enumeration
https://github.com/leonjza/awesome-nmap-grep
#Masscan Fast scan network
Intrusionz3r0X@htb[/htb]$ masscan -p -Pn 192.168.0.0/16 --rate=10000
#Scan the local network
Intrusionz3r0X@htb[/htb]$ arp-scan -I eth0 --localnet --ignoredups
Intrusionz3r0X@htb[/htb]$ net-discover -i eth0
Intrusionz3r0X@htb[/htb]$ fping -a -g 10.10.110.0/24 2>/dev/null
# Banner Grabbing using nc
Intrusionz3r0X@htb[/htb]$ nc -nv 10.129.2.28 25
#Specific Stript category
Intrusionz3r0X@htb[/htb]$ sudo nmap <target> --script <category>
#Defined Scripts
Intrusionz3r0X@htb[/htb]$ sudo nmap <target> --script <script-name>,<script-name>,...
#Host Discovery
Intrusionz3r0X@htb[/htb]$ sudo nmap 10.129.2.0/24 -sn -oA tnet | grep for | cut -d" " -f5
#SYN-Scan (Default as root | Fast)
Intrusionz3r0X@htb[/htb]$ sudo nmap -sS -p- -Pn -n --disable-arp-ping 10.129.22.77 -oG NmapScanAllTCPPorts --stats-every=5s
#TCP Connect Scan. (Slow | Accurate | Stealthy | less likely to be detected by IDS/UPS | don't disturb or impact the services | SYN-ACK-Open port/RST-Closed port)
Intrusionz3r0X@htb[/htb]$ nmap -sT -p- -Pn -n --disable-arp-ping 10.129.22.77 -oG NmapScanAllTCPPorts --stats-every=5s
#ACK-Scan. (Much harder to filter for firewalls and IDS/IPS system than SYS Scan and TCP Connect Scan)
Intrusionz3r0X@htb[/htb]$ nmap -sA -p- --open -Pn -n --disable-arp-ping 10.129.22.77 -oG NmapScanAllTCPPorts --stats-every=5s
#UDP SCAN
Intrusionz3r0X@htb[/htb]$ sudo nmap 10.129.2.28 -sU -F -Pn -n --disable-arp-ping -oG NmapScanUDPTop100Ports --stats-every=5s
#Nmap web common application discovery
Intrusionz3r0@htb[/htb]$ nmap -p 80,443,8000,8080,8180,8888,1000 --open -oA web_discovery -iL scope_listFirewall Evasion Techniques
Manual AXFR Zone Transfer
Active enumeration resources
Last updated