Professional network reconnaissance and port scanning using nmap. Supports various scan types (quick, full, UDP, stealth), service detection, vulnerability scanning, and NSE scripts. Use when you need to enumerate network services, detect versions, or perform network reconnaissance.
npxskills add brownfinesecurity/iothackbot--skill nmapLoading…
You are helping the user perform professional network reconnaissance and port scanning using nmap. This skill provides guidance for various scan types, output formats, and result analysis.
nmap-output/
├── nmap-portscan.nmap # Initial fast port discovery
├── nmap-portscan.xml
├── nmap-portscan.gnmap
├── nmap-services.nmap # Detailed service detection on open ports
├── nmap-services.xml
└── nmap-services.gnmap
IMPORTANT: Always save nmap output to an organized directory structure. By default, use ./nmap-output/ or specify a custom directory.
IMPORTANT: Unless the user explicitly requests a different scan type, ALWAYS use this two-phase approach:
sudo nmap -p- <target> -oA <output-dir>/nmap-portscan
Host Down Detection: If the scan output contains "Note: Host seems down", automatically retry with:
sudo nmap -p- -Pn <target> -oA <output-dir>/nmap-portscan
-Pn: Skip host discovery, treat host as onlineAfter Phase 1 completes, parse the open ports and run:
nmap -p <OPEN_PORT_LIST> -sV -sC <target> -oA <output-dir>/nmap-services
-p <OPEN_PORT_LIST>: Only scan the ports found to be open (e.g., -p 23,80,443,554,8000)-sV: Service version detection-sC: Run default NSE scripts for additional enumerationAfter Phase 1, extract open ports using:
# Extract open ports from .gnmap file
grep "Ports:" <output-dir>/nmap-portscan.gnmap | sed 's/.*Ports: //' | tr ',' '\n' | grep '/open/' | cut -d'/' -f1 | tr -d ' ' | tr '\n' ',' | sed 's/,$//'
Or parse from .nmap file (matches the STATE column exactly, so open|filtered ports are excluded):
awk '$2=="open"{split($1,p,"/"); ports=ports sep p[1]; sep=","} END{print ports}' <output-dir>/nmap-portscan.nmap
When the nmap-scan skill is invoked:
Create output directory
OUTPUT_DIR="./nmap-output"
mkdir -p "$OUTPUT_DIR"
Run Phase 1: Fast port discovery
sudo nmap -p- <target> -oA "$OUTPUT_DIR/nmap-portscan"
Check for "Host seems down" error
if grep -q "Host seems down" "$OUTPUT_DIR/nmap-portscan.nmap"; then
echo "Host appears down, retrying with -Pn flag..."
sudo nmap -p- -Pn <target> -oA "$OUTPUT_DIR/nmap-portscan"
fi
Parse open ports from results
OPEN_PORTS=$(awk '$2=="open"{split($1,p,"/"); ports=ports sep p[1]; sep=","} END{print ports}' "$OUTPUT_DIR/nmap-portscan.nmap")
Run Phase 2: Service detection on open ports
if [ -n "$OPEN_PORTS" ]; then
nmap -p "$OPEN_PORTS" -sV -sC <target> -oA "$OUTPUT_DIR/nmap-services"
else
echo "No open ports found, skipping service detection."
fi
Use for initial reconnaissance, when time is limited, or only when the user explicitly requests a quick/fast scan instead of the default two-phase strategy:
nmap -sV -sC <target> -oA <output-prefix>
-sV: Service version detection-sC: Run default NSE scripts-oA: Output in all formats (normal, XML, grepable)Use for thorough assessment when all ports must be checked:
nmap -sV -sC -p- <target> -oA <output-prefix>
-p-: Scan all 65535 portsUse when trying to avoid detection (requires root/sudo):
sudo nmap -sS -sV -sC <target> -oA <output-prefix>
-sS: SYN stealth scan (doesn't complete TCP handshake)Use when UDP services need to be enumerated:
sudo nmap -sU --top-ports 100 <target> -oA <output-prefix>
-sU: UDP scan--top-ports 100: Scan top 100 UDP ports (UDP scanning is slow)Use for maximum information gathering (noisy):
nmap -A -T4 <target> -oA <output-prefix>
-A: Enable OS detection, version detection, script scanning, traceroute-T4: Aggressive timing template (faster but more detectable)Use to check for known vulnerabilities:
nmap -sV --script vuln <target> -oA <output-prefix>
--script vuln: Run NSE vulnerability detection scriptsUse to identify operating system:
sudo nmap -O <target> -oA <output-prefix>
-O: Enable OS detectionRun Phase 1 (port discovery) and Phase 2 (service detection) per the Default Scanning Strategy and Implementation Workflow sections above. Then analyze:
Phase 3: Analysis
Based on service detection results, run specialized scans:
If web services found (80, 443, 8080, etc.):
nmap -p 80,443,8080,8443 --script http-* <target> -oA <output-dir>/nmap-web
If SSH found:
nmap -p 22 --script ssh-* <target> -oA <output-dir>/nmap-ssh
If RTSP found (554):
nmap -p 554 --script rtsp-* <target> -oA <output-dir>/nmap-rtsp
If ONVIF/camera suspected:
nmap -p 80,554,8000,8080 --script http-methods,http-headers <target> -oA <output-dir>/nmap-onvif
Always use -oA <prefix> to generate all three formats:
.nmap - Normal human-readable format.xml - XML format for parsing/importing into tools.gnmap - Grepable format for command-line processingUse -T<0-5> to control scan speed:
-T0 (Paranoid): Extremely slow, for IDS evasion-T1 (Sneaky): Very slow, for IDS evasion-T2 (Polite): Slow, less bandwidth intensive-T3 (Normal): Default, balanced speed-T4 (Aggressive): Fast, recommended for modern networks-T5 (Insane): Very fast, may miss resultsDefault: Use -T3 or omit (default is T3)
Fast scans: Use -T4 when speed is important and network can handle it
Stealth: Use -T1 or -T2 for evasion
nmap <ip-address>
nmap 192.168.1.0/24
nmap 192.168.1.1-254
nmap 192.168.1.1 192.168.1.10 192.168.1.100
nmap 192.168.1.0/24 --exclude 192.168.1.1,192.168.1.254
# Authentication scripts
nmap --script auth <target>
# Brute force scripts
nmap --script brute <target>
# Default safe scripts
nmap -sC <target> # equivalent to --script default
# Discovery scripts
nmap --script discovery <target>
# Vulnerability scripts
nmap --script vuln <target>
# All HTTP scripts
nmap --script "http-*" <target>
# RTSP enumeration
nmap -p 554 --script rtsp-methods,rtsp-url-brute <target>
# UPnP discovery
nmap -p 1900 --script upnp-info <target>
# MQTT discovery
nmap -p 1883,8883 --script mqtt-subscribe <target>
# Modbus enumeration
nmap -p 502 --script modbus-discover <target>
Open Ports and Services
Service Fingerprints
NSE Script Results
Operating System
Extract open ports:
grep "^[0-9]" nmap-output.nmap | grep "open"
Extract service versions:
grep -E "^[0-9]+/tcp.*open" nmap-output.nmap
Check for vulnerabilities in NSE output:
grep -i "vuln\|cve\|exploit" nmap-output.nmap
When scanning IoT devices, pay special attention to:
| Port | Service | Description |
|---|---|---|
| 21 | FTP | File transfer (often misconfigured) |
| 22 | SSH | Remote administration |
| 23 | Telnet | Insecure remote access |
| 80 | HTTP | Web interface |
| 443 | HTTPS | Secure web interface |
| 554 | RTSP | Video streaming |
| 1883 | MQTT | IoT messaging protocol |
| 3702 | WS-Discovery | ONVIF device discovery |
| 5000 | UPnP | Universal Plug and Play |
| 8000 | HTTP Alt | Alternative HTTP port |
| 8080 | HTTP Proxy |
Never run nmap without saving output:
# GOOD
nmap -p <ports> -sV -sC <target> -oA output/nmap-services
# BAD
nmap -sV -sC <target>
Use the default two-phase strategy (see the Default Scanning Strategy section) unless the user explicitly requests a different scan type.
Match timing to your needs:
# Pentest with authorization: Fast
nmap -sV -sC -T4 <target>
# Red team/stealth: Slow
nmap -sV -sC -T2 <target>
Always document:
Always save to an organized output directory (default ./nmap-output/). See the Implementation Workflow section for the full command sequence.
-T4 for faster scanning-p 1-1000 instead of -p---top-ports 100 instead of all ports-sS, -sT, -sA-Pn to skip host discovery-f for fragmented packets--source-port 53 or other trusted portsThese scan types require root:
-sS (SYN scan)-sU (UDP scan)-O (OS detection)If you see "Permission denied" or "Operation not permitted":
# Run with sudo
sudo nmap <options> <target>
TARGET="192.168.1.100"
OUTPUT_DIR="./nmap-output"
mkdir -p "$OUTPUT_DIR"
# Phase 1: Fast port discovery
sudo nmap -p- $TARGET -oA "$OUTPUT_DIR/nmap-portscan"
# Check for "Host seems down"
if grep -q "Host seems down" "$OUTPUT_DIR/nmap-portscan.nmap"; then
sudo nmap -p- -Pn $TARGET -oA "$OUTPUT_DIR/nmap-portscan"
fi
# Parse open ports
OPEN_PORTS=$(awk '$2=="open"{split($1,p,"/"); ports=ports sep p[1]; sep=","} END{print ports}' "$OUTPUT_DIR/nmap-portscan.nmap")
# Phase 2: Service detection
if [ -n "$OPEN_PORTS" ]; then
nmap -p "$OPEN_PORTS" -sV -sC $TARGET -oA "$OUTPUT_DIR/nmap-services"
fi
Run the default two-phase scan from Workflow 1, then add camera-specific checks:
TARGET="192.168.1.100"
OUTPUT_DIR="./nmap-output"
# If ONVIF camera detected, check HTTP methods
nmap -p 80 --script http-methods $TARGET -oA "$OUTPUT_DIR/nmap-http"
# Check RTSP service
nmap -p 554 --script rtsp-methods $TARGET -oA "$OUTPUT_DIR/nmap-rtsp"
OUTPUT_DIR="./nmap-output"
# After completing default two-phase scan, optionally add:
# UDP scan (top ports)
sudo nmap -sU --top-ports 100 <target> -oA "$OUTPUT_DIR/nmap-udp"
# OS detection
sudo nmap -O <target> -oA "$OUTPUT_DIR/nmap-os"
# Vulnerability scan
nmap -sV --script vuln <target> -oA "$OUTPUT_DIR/nmap-vuln"
Before starting scans, clarify:
Note: Output is saved to ./nmap-output/ by default.
A successful nmap scan includes:
Report results location
echo "Scan complete. Results saved to: $OUTPUT_DIR"
| Alternative HTTP port |
| 8883 | MQTT/TLS | Secure MQTT |
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Set up and use 1Password CLI (op). Use when installing the CLI, enabling desktop app integration, signing in (single or multi-account), or reading/injecting/running secrets via op.
CLI to manage emails via IMAP/SMTP. Use `himalaya` to list, read, write, reply, forward, search, and organize emails from the terminal. Supports multiple accounts and message composition with MML (MIME Meta Language).
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Set up and use 1Password CLI (op). Use when installing the CLI, enabling desktop app integration, signing in (single or multi-account), or reading/injecting/running secrets via op.
CLI to manage emails via IMAP/SMTP. Use `himalaya` to list, read, write, reply, forward, search, and organize emails from the terminal. Supports multiple accounts and message composition with MML (MIME Meta Language).