skills.rest
EntroVyx
EntroVyxCOMMUNITY
Explore all skills by this author →
GitHub

port-service-discovery

Identify open network ports and service versions with nmap.

3|1|Updated Jul 2, 2026
Search Tags:#security#vulnerability#infrastructure#nmap#port-scan#recon
One-click install
npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill port-service-discovery-entrovyx
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: port-service-discovery
Source: https://github.com/EntroVyx/hermes-agent-offsec/tree/main/skills/offsec/recon/port-service-discovery
Command: npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill port-service-discovery-entrovyx

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires curl, nmap, python3, masscan, subfinder, httpx, nuclei.

What problem does it solve?

This skill addresses the visibility gap in infrastructure security by identifying exposed services and potential entry points that standard web-based scanners often overlook.

Core Features & Use Cases

  • Multi-Layer Discovery: Performs fast port scanning and service version detection to map the infrastructure layer.
  • Critical Exposure Assessment: Automatically probes for common misconfigurations like open MySQL, Redis, MongoDB, and anonymous FTP access.
  • Use Case: Use this during a deep-hunt engagement to identify backend APIs or misconfigured databases on a target that appears secure from the web surface.

Quick Start

Run the port service discovery skill against the target domain example.com to identify open ports and potential service vulnerabilities.

Frequently Asked Questions about port-service-discovery

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan for open ports and detect service versions during a recon engagement?▼

Port scanning and service version detection identify open network ports and exposed infrastructure to uncover misconfigurations. Using nmap, this process maps the infrastructure layer and reveals backend services that standard web scanners often overlook.

What is the best way to find exposed databases and misconfigured services on a target?▼

Finding exposed databases involves probing for common misconfigurations like open MySQL, Redis, MongoDB, and anonymous FTP access. This critical exposure assessment automatically identifies potential entry points and backend APIs during a deep-hunt engagement.

Do I need nmap and python3 to perform infrastructure-level port scanning?▼

Yes, you need nmap, python3, and standard network utilities to perform port scanning and banner grabbing. These dependencies are required to execute the scanning techniques and identify infrastructure-level vulnerabilities accurately.

How does port service discovery uncover backend APIs on a target that appears secure from the web surface?▼

Port service discovery uncovers backend APIs by performing multi-layer discovery and fast port scanning to map the infrastructure layer. It identifies exposed services and potential entry points that standard web-based scanners overlook, revealing hidden attack surfaces.

Can I use masscan and subfinder alongside nmap for attack surface analysis?▼

Yes, masscan, subfinder, httpx, and nuclei are supported dependencies alongside nmap. Using these tools together enables comprehensive offensive security recon, target dossier building, and manual attack surface analysis by combining rapid scanning with deep probing.

Related Skills

Explore More Software Engineering Skills→
AeonDaveAeonDave
15

nmap

Scan networks for hosts, ports, services, and operating systems.

Community
Intermediate
alicangnllalicangnll

Automated Exploit Generation

Generate exploit code for software vulnerabilities using pwnlib, ROPgadget, and shellcode.

Community
Advanced
macaughmacaugh
5

Service Fingerprinting

Detect network services and versions on discovered hosts via active probing.

Community
Advanced
zebbernzebbern
34

External Network Penetration Testing

Executes multi-phase external network penetration testing with OSINT, reconnaissance, and vulnerability scanning.

Community
Advanced