🔍 Recon and Enumeration
This section includes commands for host discovery, port scanning, and service enumeration.
➡️ Environment: See 00_environment_setup
🔎 Nmap
Fast scan:
Quickly discover open ports to expedite future scans
nmap --min-rate 4500 --max-rtt-timeout 1500ms -p- $IP
Full TCP scan + scripts:
nmap -sC -sV -T4 -Pn -p- -oA full_tcp $IP🧠 SMB Enumeration
nmap --script=smb-enum* -p 139,445 $IP
smbclient -L \\$IP\ -N
enum4linux-ng -A $IP
smbmap -H $IP🌐 HTTP/HTTPS
whatweb $URL
nikto -h $URL
ffuf -u $URL/FUZZ -w /usr/share/wordlists/dirb/common.txt -fs 4242SSL Enum:
sslscan $IP🔑 FTP/SSH
ftp $IP
hydra -l $USERNAME -P /usr/share/wordlists/rockyou.txt ftp://$IPhydra -l $USERNAME -P /usr/share/wordlists/rockyou.txt ssh://$IP🧪 Misc
nc -nv $IP $RPORT # Check open port manually
curl -I $URL # HTTP header check