Port Scanning for Penetration Testing

Port Enumeration

Port scanning is the method used to identify open ports and services on a network or system. In penetration testing, it helps security professionals detect vulnerabilities, understand the network structure, and pinpoint potential entry points for unauthorized access.

Nmap

Nmap, short for “Network Mapper,” is a powerful open-source tool used for network discovery and security auditing. It’s one of the most popular and widely used network scanning tools in the cybersecurity community. You can find a comprehensive cheat sheet and links to download Nmap.

Port Scanning

The following are some commands I commonly use with the Nmap tool to port scan targets and networks.

1
sudo nmap -sTCV -O -A 10.1.1.1 -p 1-65535 -oA All_TCP_ports     # Performs a TCP connect and default script scan of all ports on a target with output in all formats with advanced scanning techniques enabled
2
sudo nmap -sTCV -A -O -iL IPs.txt -Pn -p- -oX targets.xml       # Performs a TCP connect and default script scan of all ports on a list of targets with no ping and advanced scanning techniques enabled and output to XML file
3
sudo nmap -sTCV -A -v -Pn -p- 10.1.1.1                          # Performs a TCP connect and default script scan of all ports on a target with no ping enabled

Port Sweep

An Nmap port sweep is a technique used to scan a range of IP addresses for specific open ports. This method is useful for identifying which devices on a network are running specific services associated with particular ports.

1
sudo nmap -p80 10.1.1.1-254  # Performs a ping sweep of port 80 across the specified IP range
2
sudo nmap -p22 10.1.1.0/24   # Performs a ping sweep of port 22 across the specified CIDR

Masscan

Masscan is known for its speed, making it possible to scan the entire Internet in minutes. It uses asynchronous transmission to achieve high speeds, making it ideal for large-scale scanning operations. You can find Masscan here.

1
masscan -p1-65535 10.1.1.1 --rate=1000                     # Scans all TCP ports on the target IP with a rate of 1000 packets per second
2
masscan 10.1.1.1/24 -p80,443,22 --rate 5000                # Scans common ports on a subnet
3
masscan -iL targets.txt -p1-1000 --rate 10000              # Read target IPs from file
4
masscan 10.1.1.1/24 -p80 --source-ip 10.1.1.1              # Spoof source IP
5
masscan 10.1.1.1/24 -p80 --spoof-mac 00:11:22:33:44:55     # Spoof MAC address

Here is a list of common commands I use with Masscan and the most common ports I’ve seen on engagements.

1
sudo masscan -p 21,22,23,53,80,111,135,445,139,443,389,1521,3306,8080,8081,1433,8200,8500,8999,9000,10000,8443 10.1.1.0/24 --rate 1500
2
sudo masscan 10.1.1.0/22 -p 1-65535 --banners --rate 1000
3
sudo masscan -iL External_IPs.txt -p 1-65535 --rate 500 --http-user-agent "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:67.0) Gecko/20100101 Firefox/67.0"

You can use the following script to take in Masscan results and produce an output which can be fed into Nmap:

1
# This script will take in Masscan results and produce an output which can be fed into NMap
2
# Save your Masscan result as mscan.txt then run this script to produce nmap.txt then you can run:
3
# while read item; do sudo nmap -sV -sA -sU $item; done < nmap.txt
4

5
# If you want to export to .xml file you can use the following command and then later use this script to merge files: https://github.com/sidaf/scripts/blob/master/nmap_merge.py
6
# while read item; do filename=$(echo $item | grep -o "^\S*"); sudo nmap -sV -sA -sU -vv $item -oX $filename.xml; done < nmap.txt
7

8
import re
9
import socket
10

11
regex = re.compile(r"Discovered open port (\d+)\/(udp|tcp) on (\d+\.\d+\.\d+\.\d+)", re.I)
12

13
ip_list = {}
14

15
with open('mscan.txt') as f:
16
    lines = f.readlines()
17
    for line in lines:
18
        port = regex.match(line).group(1)
19
        protocol = regex.match(line).group(2)
20
        ip = regex.match(line).group(3)
21

22
        # Add the IP to dictionary if it's not already
23
        try:
24
            ip_list[ip]
25
        except KeyError:
26
            ip_list[ip] = {}
27

28
        # Add protocol to dictionary if it's not already
29
        try:
30
            ip_list[ip][protocol]
31
        except KeyError:
32
            ip_list[ip][protocol] = []
33

34
        # Append the port to the list
35
        ip_list[ip][protocol].append(port)
36

37
with open('nmap.txt', 'a') as f:
38
    sorted_ips = sorted(ip_list.items(), key=lambda item: socket.inet_aton(item[0]))
39
    for ip, protocols in sorted_ips:
40
        udp_ports = ""
41
        tcp_ports = ""
42

43
        # Check to see if any UDP ports were found
44
        try:
45
            for port in protocols['udp']:
46
                udp_ports += port + ','
47
        except KeyError:
48
            pass
49

50
        # Check to see if any TCP ports were found
51
        try:
52
            for port in protocols['tcp']:
53
                tcp_ports += port + ','
54
        except KeyError:
55
            pass
56

57
        # Print IP and ports to file ready for NMap scan
58
        if udp_ports and tcp_ports:
59
            line = ip + ' -p U:' + udp_ports + 'T:' + tcp_ports
60
        elif udp_ports:
61
            line = ip + ' -p U:' + udp_ports
62
        elif tcp_ports:
63
            line = ip + ' -p T:' + tcp_ports
64
        f.write(line + '\n')

Save your Masscan result as mscan.txt, and then run this script to produce nmap.txt. Then you can run:

1
while read item; do filename=$(echo $item | grep -o "^\S*"); sudo nmap -sCV -T4 -O --version-light -vv $item -oX $filename.xml; done < ../nmap.txt
2
while read item; do filename=$(echo $item | grep -o "^\S*"); sudo nmap -sCV -T4 -O -F --version-light -vv $item -oX $filename.xml; done < nmap.txt

Scanning the whole internet

You can scan the whole internet for port 80 for example using the following:

1
sudo masscan -p 80 0.0.0.0/0 --rate 1000000 --exclude 255.255.255.255 > port80.txt

Once you have a list of IP addresses with port 80 open you can run it through a tool like HTTPX to get the title of the web page running on the port.

1
httpx -l port80.txt -ports 80 -title -no-color > port80_titles.txt
2
httpx -list Web_Ports.txt -p 80,443 -silent -sc -location -title -server -mc 200 -fr

ZMap

ZMap is a free, open-source security scanner developed as a faster alternative to Nmap. ZMap can scan the entire IPv4 address space in 44 minutes on a single port using one gigabit per second of network bandwidth. It can complete a scan in under five minutes with a ten-gigabit connection. You can find the details, as well as installation instructions for Zmap, here.

1
zmap -p 80 10.1.1.0/24 -o results.csv                      # Scans port 80 across the specified subnet and outputs the results to a CSV file
2
zmap -p 22,80,443 --target-ip=10.1.1.1 -o output.txt       # Scan SSH, HTTP, and HTTPS on a single IP
3
zmap -p 23 -o telnet_scan.txt --rate=1000000               # Scan the whole internet for open Telnet ports

RustScan

RustScan is a fast port scanner written in Rust that quickly identifies open TCP ports and can automatically pipe the results into Nmap for service enumeration. You can find it here: https://github.com/RustScan/RustScan

1
rustscan -a 10.1.1.1                                    # Scan a target for open ports and pass them to Nmap
2
rustscan -a 10.1.1.1,10.1.1.2                           # Scan multiple targets
3
rustscan -a 10.1.1.0/24                                 # Scan a CIDR range
4
rustscan -a 10.1.1.1 -p 22,80,443,445,3389              # Scan a specific list of ports
5
rustscan -a 10.1.1.1 -r 1-1000                          # Scan a specific port range
6
rustscan -a 10.1.1.1 -r 1-65535                         # Scan the full TCP port range

Arguments after -- are passed straight through to Nmap, so any Nmap flags and output options can be used as normal.

1
rustscan -a 10.1.1.1 -- -sC -sV                                   # Run Nmap default scripts and service detection on discovered ports
2
rustscan -a 10.1.1.1 -- -sC -sV -Pn                               # Same as above, skipping the ping check for hosts that don't respond to ICMP
3
rustscan -a 10.1.1.1 -- -sT -sC -sV -T4 -Pn                       # Use a TCP connect scan instead of a SYN scan
4
rustscan -a 10.1.1.1 -- --script vuln -sV -Pn                     # Run Nmap's vulnerability scripts against discovered ports
5
rustscan -a 10.1.1.1 -r 1-65535 -- -sC -sV -Pn -oA initial        # Full port range scan piped into Nmap, saving output in all formats

RustScan scans in batches, and the batch size and connection timeout can be tuned to trade off speed against reliability and the likelihood of triggering defensive controls.

1
rustscan -a 10.1.1.1 -b 5000     # Increase batch size for faster scanning
2
rustscan -a 10.1.1.1 -t 5000     # Increase the connection timeout (ms) for slower or higher-latency networks

Option	Description
`-a`	Target IP, hostname, or list of addresses
`-p`	Specific ports
`-r`	Port range
`-b`	Batch size
`-t`	Connection timeout (ms)
`--`	Pass all following arguments to Nmap

Naabu

When pentesting a large number of systems, running detailed Nmap scans against every host can quickly become time-consuming. Naabu is a fast port scanner developed by ProjectDiscovery that’s great at first identifying which hosts and ports are actually reachable, before handing the interesting ones off to a tool like Nmap for detailed enumeration. Its simple output also makes it easy to pipe into other reconnaissance tools. You can find it here: https://github.com/projectdiscovery/naabu

1
naabu -host 10.1.1.1                        # Scan a single host
2
naabu -host 10.1.1.0/24                     # Scan a network range
3
naabu -list hosts.txt                       # Scan a list of targets

Combining with Other Tools

Naabu’s output pipes cleanly into other reconnaissance tools, which is particularly useful during external engagements where subdomains discovered via Subfinder need to be checked for exposed services.

1
subfinder -d example.com -silent | naabu -silent                    # Feed discovered subdomains straight into Naabu
2
naabu -list hosts.txt -silent | httpx -silent                       # Identify which open ports are actually serving HTTP
3
subfinder -d example.com -silent | naabu -silent | httpx -silent    # Chain subdomain enumeration, port discovery and HTTP probing together

Web applications, APIs and admin interfaces aren’t always exposed on 80/443 — non-standard ports such as 8000, 8080, 8081, 8443, 8888, 9000 and 9090 are worth including when scanning for web services.

ASN and Large Range Scanning

1
echo AS3741 | naabu -p 80,443 -passive -v -rate 10   # Scan the address space associated with an Autonomous System (only within authorised scope)
2
naabu -host 10.1.0.0/16 -p 80,443 -rate 1000 -silent # Scan a large range for HTTP/HTTPS services, tuning -rate to the target environment

Finding Exposed Configuration Files

Naabu can be chained with httpx and curl to search a large, authorised web estate for exposed configuration files, such as ASP.NET’s web.config or appsettings.json. A 200 response alone isn’t enough to confirm a file exists, since many applications return a 200 on custom error pages, so the response body should be validated too.

1
naabu -host <authorised-range> -p 80,443 -rate 1000 -silent | httpx -stream -silent -path /web.config -mc 200 | \
2
while read -r url; do
3
    curl -sk --max-time 10 "$url" | head -c 300 | grep -qiE '<configuration|connectionStrings|system.web|appSettings' && echo "$url"
4
done

1
naabu -host <authorised-range> -p 80,443 -rate 1000 -silent | httpx -stream -silent -path /appsettings.json -mc 200 | \
2
while read -r url; do
3
    body=$(curl -sk --max-time 10 "$url")
4
    printf "%s" "$body" | jq empty 2>/dev/null && echo "$url [$(printf "%s" "$body" | wc -c) bytes]"
5
done

If a configuration file is found, look for values such as connectionString, password, ApiKey, ClientSecret, machineKey, AWSSecretAccessKey or AzureWebJobsStorage before concluding anything sensitive was actually exposed.

The below adds parallelisation and additional keywords for sensitive files that I have come accross in real tests.

1
naabu -host <authorised-range> -p 80,443 -rate 5000 -silent | \
2
httpx -stream -silent -threads 300 -path /web.config -mc 200 | \
3
xargs -P 100 -I{} sh -c '
4
url="{}";
5
body=$(curl -sk --max-time 10 "$url");
6
printf "%s" "$body" | head -c 300 | grep -qiE "<configuration|connectionStrings|system.web|appSettings" || exit 0;
7
match=$(printf "%s" "$body" | grep -Eio "connectionString|password|pwd|User ID|uid=|ApiKey|ClientSecret|machineKey|validationKey|decryptionKey|StorageAccountKey|AccountKey|AccessKey|SecretKey|AWSAccessKeyId|AWSSecretAccessKey|AzureWebJobsStorage|smtp|mailSettings|appSettings|connectionStrings" | sort -fu | paste -sd "," -);
8
[ -n "$match" ] && echo "$url [$(printf "%s" "$body" | wc -c) bytes] [$match]"
9
'

This reports not only that a configuration file was found, but its approximate size and which sensitive keywords were present, for example:

1
https://example.com/web.config [2841 bytes] [connectionString,password]

PowerShell Port Scanning

If you are in a Windows environment or only have access to a compromised Windows host, an excellent set of scripts for native Windows PowerShell port scanning is Minimalistic TCP and UDP port scanners, which can be found here.

1
Import-Module .\port-scan-tcp.ps1
2
port-scan-tcp 10.1.1.1 8080                                   # Scanning a single IP and Port
3
port-scan-tcp 10.1.1.1 (21,22,23,25,80,443,445,3389)          # Scanning a single IP for a list TCP ports
4
port-scan-tcp (gc .\targets.txt) 22                           # Scanning a list of IPs in a file for port 22
5
1..255 | foreach { port-scan-tcp 10.1.1.$_ 8080}              # Scanning a range of IPs for a single Port

If you have no script execution, you can try using the Test-NetConnection cmdlet, which displays diagnostic information for a connection.

1
80,3601|%{ Test-NetConnection -Port $_ 10.1.1.1 -WA SilentlyContinue} | ?{$_.TCPTestSucceeded -eq $true} | select ComputerName,RemoteAddress,RemotePort    # Single IP with a list of ports
2
1..254 | % {"10.1.1.$($_): $(Test-Connection -count 1 -comp 10.1.1.$($_) -quiet)"}                                                                         # Test if a range of IPs are alive

Another native PowerShell script you can use to scan for hosts on a network is:

1
1..254 | ForEach-Object {
2
$ip = "10.1.1.$_"
3
$hostname = [System.Net.Dns]::GetHostEntry($ip).HostName
4
if ($hostname -ne $null) { Write-Host "IP: $ip, Hostname: $hostname" }
5
}

You can also use Test-Connection to perform a PowerShell Ping on a network to test for live hosts and return if they are reachable or not:

1
$baseIP = "10.1.1."
2

3
for ($i = 1; $i -le 254; $i++) {
4
    $ip = $baseIP + $i
5
    $result = Test-Connection -ComputerName $ip -Count 1 -Quiet
6
    if ($result -eq $true) {
7
        Write-Host "$ip is reachable"
8
    } else {
9
        Write-Host "$ip is unreachable"
10
    }
11
}

The above script can be used to take a file of IPs and write the results to a file:

1
$file = "IPs.txt"
2
$outputFile = "Ping_Responded.txt"
3
$ips = Get-Content $file
4

5
foreach ($ip in $ips) {
6
    $result = Test-Connection -ComputerName $ip -Count 1 -Quiet
7
    if ($result) {
8
        Write-Output "$ip is live" | Out-File -FilePath $outputFile -Append
9
    } else {
10
        Write-Output "$ip is dead" | Out-File -FilePath $outputFile -Append
11
    }
12
}