Port Scanners

CLI Tools

nmap

Nmap is a powerful network scanning tool used to discover hosts, services, and vulnerabilities on a network.

Classic host discovery via ICMP echo:

# Ping sweep (no port scanning)
sudo nmap -sn 172.16.10.0/24
# Extract IPs
sudo nmap -sn 172.16.10.0/24 | grep 'report' | awk '{print $NF}'

The below command is also aimed at live host discovery, but avoid issues where all network hosts come back as alive due to firewall issues (remove -Pn flag if it is too slow):

# Top-1000 ports, no dns resolution, no ping request
sudo nmap -n -Pn --open -oG - 192.168.110.0/24 | awk '/Up$/{print $2}'

Banner grabbing:

sudo nmap -sV --script=banner.nse -iL live_hosts | grep "|_banner\||_http-server-header"

Exclude IPs:

sudo nmap -iL live_hosts -A --open --exclude 172.16.10.1

rustscan

arp-scan

nc

Bash

PS

IPv6 Firewall Bypass

The initial Nmap scan against the target over IPv4 did not show TCP port 5985 (WinRM) as open:

$ sudo nmap -p5985 10.10.10.10

PORT     STATE  SERVICE
5985/tcp closed unknown

This typically indicates that the port is closed or filtered by a firewall on the IPv4 interface. After gaining a foothold on the target, we can see that the service is indeed running:

> netstat -anot | findstr :5985
TCP    0.0.0.0:5985   0.0.0.0:0   LISTENING   4   InHost

The service is bound to 0.0.0.0, indicating it's listening on all IPv4 interfaces — but likely restricted by the Windows Firewall for remote connections. Suspecting the firewall might only apply to IPv4, we can re-scan using IPv6:

> ipconfig
IPv6 Address. . . . . . . . . . . : dead:beef::1001

$ sudo nmap -p5985 -6 dead:beef::1001

PORT     STATE SERVICE
5985/tcp open  wsman

WinRM is now visible and accessible — indicating firewall rules do not restrict IPv6 traffic the same way as IPv4. To make tooling easier, we can update /etc/hosts to resolve both IPv4 and IPv6 to the same hostname:

$ grep comp /etc/hosts
10.10.10.10       compatibility
dead:beef::1001   compatibility