OPSECTLAS you are here: External access only
next-move engine

You have External access only

5 high-yield moves from here, ordered the way the engagement runs. Open any move to see the exact commands.

  1. toolsnmap
    Scan Order
    Phase 1: Quick common ports · immediate results
    nmap -sC -sV -p 21,22,23,25,53,80,110,111,135,139,143,389,443,445,512,513,514,\
    587,631,873,993,995,1433,1521,2049,3306,3389,5432,5900,5985,5986,6379,8080,\
    8443,8888,9090,27017 <TARGET-IP> -oA scans/quick
    Phase 2: Full TCP · all 65535 ports
    nmap -p- --min-rate 5000 -T4 <TARGET-IP> -oA scans/full_tcp
    Phase 3: Targeted · run scripts on all discovered ports
    nmap -sC -sV -p <DISCOVERED-PORTS> <TARGET-IP> -oA scans/targeted
    Phase 4: UDP top-200 (don't skip this)
    nmap -sU --top-ports 200 --min-rate 2000 <TARGET-IP> -oA scans/udp

    OS detection

    nmap -O <TARGET-IP> --osscan-guess
    Output Reading

    Quick summary of open ports from xml output

    grep "portid" scans/full_tcp.xml | grep "open"

    Convert nmap xml to HTML for easier reading

    xsltproc scans/full_tcp.xml -o scans/full_tcp.html
    Nmap NSE Scripts by Category

    Vulnerability scanning

    nmap --script vuln <TARGET-IP>

    Default scripts (safe, informational)

    nmap -sC <TARGET-IP>

    Auth brute (careful with lockout)

    nmap --script brute <TARGET-IP>

    Full discovery

    nmap --script discovery <TARGET-IP>

    Specific vulnerability checks

    nmap --script smb-vuln-ms17-010 -p 445 <TARGET-IP>
    nmap --script http-shellshock -p 80 <TARGET-IP>