nmap

What this skill does

# Nmap Scan - Professional Network Reconnaissance

You are helping the user perform professional network reconnaissance and port scanning using nmap. This skill provides guidance for various scan types, output formats, and result analysis.

## Output Directory

### Directory Structure
```bash
nmap-output/
├── nmap-portscan.nmap      # Initial fast port discovery
├── nmap-portscan.xml
├── nmap-portscan.gnmap
├── nmap-services.nmap      # Detailed service detection on open ports
├── nmap-services.xml
└── nmap-services.gnmap
```

**IMPORTANT**: Always save nmap output to an organized directory structure. By default, use `./nmap-output/` or specify a custom directory.

## Default Scanning Strategy

**IMPORTANT**: Unless the user explicitly requests a different scan type, ALWAYS use this two-phase approach:

### Phase 1: Fast Port Discovery (Root SYN Scan)
```bash
sudo nmap -p- <target> -oA <output-dir>/nmap-portscan
```
- **Why sudo**: Running as root enables fast SYN scan (-sS is implicit)
- **Why -p-**: Scans all 65535 ports quickly
- **Duration**: Typically 1-3 minutes for SYN scan
- **Output**: List of all open ports

**Host Down Detection**:
If the scan output contains "Note: Host seems down", automatically retry with:
```bash
sudo nmap -p- -Pn <target> -oA <output-dir>/nmap-portscan
```
- `-Pn`: Skip host discovery, treat host as online
- Use this when firewalls block ping probes

### Phase 2: Targeted Service Detection
After Phase 1 completes, parse the open ports and run:
```bash
nmap -p <OPEN_PORT_LIST> -sV -sC <target> -oA <output-dir>/nmap-services
```
- `-p <OPEN_PORT_LIST>`: Only scan the ports found to be open (e.g., `-p 23,80,443,554,8000`)
- `-sV`: Service version detection
- `-sC`: Run default NSE scripts for additional enumeration
- **Duration**: Usually 1-3 minutes since only scanning known open ports

### Why This Strategy?

1. **Speed**: Fast SYN scan finds all open ports in 1-3 minutes
2. **Thoroughness**: Covers all 65535 ports, not just top 1000
3. **Efficiency**: Service detection only runs on confirmed open ports
4. **Accuracy**: Two-phase approach reduces false negatives

### Parsing Open Ports

After Phase 1, extract open ports using:
```bash
# Extract open ports from .gnmap file
grep "Ports:" <output-dir>/nmap-portscan.gnmap | sed 's/.*Ports: //' | tr ',' '\n' | grep '/open/' | cut -d'/' -f1 | tr -d ' ' | tr '\n' ',' | sed 's/,$//'
```

Or parse from .nmap file (matches the STATE column exactly, so `open|filtered` ports are excluded):
```bash
awk '$2=="open"{split($1,p,"/"); ports=ports sep p[1]; sep=","} END{print ports}' <output-dir>/nmap-portscan.nmap
```

## Implementation Workflow

When the nmap-scan skill is invoked:

1. **Create output directory**
   ```bash
   OUTPUT_DIR="./nmap-output"
   mkdir -p "$OUTPUT_DIR"
   ```

2. **Run Phase 1: Fast port discovery**
   ```bash
   sudo nmap -p- <target> -oA "$OUTPUT_DIR/nmap-portscan"
   ```

3. **Check for "Host seems down" error**
   ```bash
   if grep -q "Host seems down" "$OUTPUT_DIR/nmap-portscan.nmap"; then
       echo "Host appears down, retrying with -Pn flag..."
       sudo nmap -p- -Pn <target> -oA "$OUTPUT_DIR/nmap-portscan"
   fi
   ```

4. **Parse open ports from results**
   ```bash
   OPEN_PORTS=$(awk '$2=="open"{split($1,p,"/"); ports=ports sep p[1]; sep=","} END{print ports}' "$OUTPUT_DIR/nmap-portscan.nmap")
   ```

5. **Run Phase 2: Service detection on open ports**
   ```bash
   if [ -n "$OPEN_PORTS" ]; then
       nmap -p "$OPEN_PORTS" -sV -sC <target> -oA "$OUTPUT_DIR/nmap-services"
   else
       echo "No open ports found, skipping service detection."
   fi
   ```

6. **Report results location**
   ```bash
   echo "Scan complete. Results saved to: $OUTPUT_DIR"
   ```

## Scan Types

### Quick Scan (Top 1000 Ports)
Use for initial reconnaissance, when time is limited, or only when the user explicitly requests a quick/fast scan instead of the default two-phase strategy:
```bash
nmap -sV -sC <target> -oA <output-prefix>
```
- `-sV`: Service version detection
- `-sC`: Run default NSE scripts
- `-oA`: Output in all formats (normal, XML, grepable)
- Scans top 1000 most common ports
- Typical duration: 1-3 minutes
- **Limitation**: May miss services on non-standard ports

### Comprehensive Scan (All Ports)
Use for thorough assessment when all ports must be checked:
```bash
nmap -sV -sC -p- <target> -oA <output-prefix>
```
- `-p-`: Scan all 65535 ports
- Significantly longer duration (5-30+ minutes depending on target)
- Use only when comprehensive coverage is required

### Stealth SYN Scan
Use when trying to avoid detection (requires root/sudo):
```bash
sudo nmap -sS -sV -sC <target> -oA <output-prefix>
```
- `-sS`: SYN stealth scan (doesn't complete TCP handshake)
- Less likely to be logged by target
- Requires root privileges

### UDP Scan
Use when UDP services need to be enumerated:
```bash
sudo nmap -sU --top-ports 100 <target> -oA <output-prefix>
```
- `-sU`: UDP scan
- `--top-ports 100`: Scan top 100 UDP ports (UDP scanning is slow)
- Common UDP services: DNS (53), SNMP (161), DHCP (67/68)
- Very slow - use top-ports to limit scope

### Aggressive Scan
Use for maximum information gathering (noisy):
```bash
nmap -A -T4 <target> -oA <output-prefix>
```
- `-A`: Enable OS detection, version detection, script scanning, traceroute
- `-T4`: Aggressive timing template (faster but more detectable)
- Very noisy - will be detected by IDS/IPS
- Use only with authorization

### Vulnerability Scan
Use to check for known vulnerabilities:
```bash
nmap -sV --script vuln <target> -oA <output-prefix>
```
- `--script vuln`: Run NSE vulnerability detection scripts
- Checks for common CVEs and misconfigurations
- Can be noisy and trigger alerts

### OS Detection
Use to identify operating system:
```bash
sudo nmap -O <target> -oA <output-prefix>
```
- `-O`: Enable OS detection
- Requires root privileges
- Uses TCP/IP stack fingerprinting

## Scan Workflow

### Default Workflow (Two-Phase Strategy)

Run Phase 1 (port discovery) and Phase 2 (service detection) per the Default Scanning Strategy and Implementation Workflow sections above. Then analyze:

**Phase 3: Analysis**
- Review the service detection results to determine:
   - What services are running?
   - What versions are detected?
   - Are there any interesting services (web, SSH, database, IoT protocols)?
   - Do NSE scripts reveal any issues?

### Additional Targeted Scans (Optional)
Based on service detection results, run specialized scans:

**If web services found (80, 443, 8080, etc.)**:
```bash
nmap -p 80,443,8080,8443 --script http-* <target> -oA <output-dir>/nmap-web
```

**If SSH found**:
```bash
nmap -p 22 --script ssh-* <target> -oA <output-dir>/nmap-ssh
```

**If RTSP found (554)**:
```bash
nmap -p 554 --script rtsp-* <target> -oA <output-dir>/nmap-rtsp
```

**If ONVIF/camera suspected**:
```bash
nmap -p 80,554,8000,8080 --script http-methods,http-headers <target> -oA <output-dir>/nmap-onvif
```


## Output Management

### Output Formats
Always use `-oA <prefix>` to generate all three formats:
- `.nmap` - Normal human-readable format
- `.xml` - XML format for parsing/importing into tools
- `.gnmap` - Grepable format for command-line processing


## Timing and Performance

### Timing Templates
Use `-T<0-5>` to control scan speed:
- `-T0` (Paranoid): Extremely slow, for IDS evasion
- `-T1` (Sneaky): Very slow, for IDS evasion
- `-T2` (Polite): Slow, less bandwidth intensive
- `-T3` (Normal): Default, balanced speed
- `-T4` (Aggressive): Fast, recommended for modern networks
- `-T5` (Insane): Very fast, may miss results

**Default**: Use `-T3` or omit (default is T3)
**Fast scans**: Use `-T4` when speed is important and network can handle it
**Stealth**: Use `-T1` or `-T2` for evasion

### Timeout Considerations
- Phase 1 Port Discovery (sudo nmap -p-): 180-300 seconds timeout (3-5 minutes)
- Phase 2 Service Detection (nmap -p <ports> -sV -sC): 120-180 seconds timeout (2-3 minutes)
- UDP scan: 600+ seconds ti