nmap

Identify open ports and enumerate network services with Nmap.

811|123|Updated Nov 17, 2025
One-click install
npx skills add https://github.com/BrownFineSecurity/iothackbot --skill nmap
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: nmap
Source: https://github.com/BrownFineSecurity/iothackbot/tree/main/skills/nmap
Command: npx skills add https://github.com/BrownFineSecurity/iothackbot --skill nmap

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Network reconnaissance and port discovery can be slow and error-prone. This skill guides you through a structured two-phase approach to quickly identify open ports and then enumerate services, versions, and potential vulnerabilities.

Core Features & Use Cases

  • Two-Phase Scanning: Fast port discovery followed by targeted service detection.
  • Service Version & NSE Scripts: Identify running versions and run default NSE checks for deeper insights.
  • Organized Output: Clear results directories with standardized filenames for easy report generation.

Quick Start

  1. Phase 1: sudo nmap -p- <target> -oA nmap-portscan
  2. Phase 2: nmap -p <OPEN_PORTS> -sV -sC <target> -oA nmap-services

Frequently Asked Questions about nmap

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find open ports on a network host?

Port scanning identifies open ports by sending network packets to target addresses. Nmap performs comprehensive port discovery across all 65535 TCP and UDP ports or selective ranges, using fast SYN scans (requiring root privileges) to rapidly detect which ports accept connections and which services are listening.

What's the best way to enumerate service versions during network reconnaissance?

Service enumeration uses version detection flags (-sV) combined with default NSE scripts (-sC) to identify running software, versions, and potential vulnerabilities. A two-phase approach—fast port discovery followed by targeted service detection on open ports—balances speed with detailed intelligence gathering.

How do I perform OS fingerprinting on a target network?

OS fingerprinting analyzes network responses to determine operating systems running on discovered hosts. Nmap combines port scan results, service version data, and NSE script output to build fingerprints that reveal host platform details alongside service inventory.

Do I need root privileges to run comprehensive network scans?

SYN scans—the fastest port discovery method—require root privileges to send raw network packets. Standard user scans use TCP connect mode, which is slower but needs no elevated access; choose based on speed requirements and available permissions.

What's the difference between quick port scans and comprehensive reconnaissance?

Quick scans discover open ports rapidly using SYN methods on common ports or all 65535 ports without version detection. Comprehensive reconnaissance adds service version detection, NSE script enumeration, and OS fingerprinting to deliver deeper vulnerability intelligence and service inventory.