skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

scanning-network-with-nmap-advanced

Performs network reconnaissance with Nmap host discovery, port scanning, NSE vulnerability scripts, and evasion techniques.

954|172|Updated Mar 13, 2026
Search Tags:#penetration testing#reconnaissance#vulnerability detection#port scanning#network scanning#Nmap#nse scripts
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill scanning-network-with-nmap-advanced
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: scanning-network-with-nmap-advanced
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/network-security/scanning-network-with-nmap-advanced
Command: npx skills add https://github.com/xalgord/xalgorix --skill scanning-network-with-nmap-advanced

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Manual network reconnaissance often misses live hosts, UDP services, and high-port services, producing incomplete asset inventories and unverified vulnerability findings during authorized security assessments.

Core Features & Use Cases

  • Layered Host Discovery: Combines ARP, ICMP, TCP, and UDP probes to find live hosts even when ICMP is filtered by firewalls.
  • Full-Range Port and Service Enumeration: Scans all 65535 TCP ports plus top UDP ports with version detection and OS fingerprinting.
  • NSE Vulnerability Scanning: Runs targeted scripts such as smb-vuln-ms17-010 and ssl-heartbleed to confirm exploitable conditions.
  • Firewall Evasion and Reporting: Applies fragmentation, decoys, source-port spoofing, and idle scans, then exports XML results to HTML, CSV, or Metasploit.
  • Use Case: A security team baselines a 5,000-host corporate network over a weekend window, discovering assets, enumerating services, confirming vulnerabilities, and generating per-subnet CSV reports for the vulnerability management platform.

Quick Start

Scan the authorized subnet 10.0.0.0/24 with Nmap to discover live hosts, enumerate open ports and service versions, and run vulnerability scripts with results saved in XML format.

Frequently Asked Questions about scanning-network-with-nmap-advanced

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan a network with Nmap for live hosts and open ports?▼

Use layered host discovery with nmap -sn -PE -PS21,22,80,443,445 -PU53,161 to find hosts even when ICMP is blocked, then run nmap -sS -p- -T4 on the live host list to scan all 65535 TCP ports.

How to detect vulnerabilities with Nmap NSE scripts?▼

Run nmap --script vuln against open ports for broad detection, or target specific issues with scripts like smb-vuln-ms17-010, ssl-heartbleed, and ssl-poodle. A default -sV -sC scan alone does not confirm vulnerabilities.

Why does my Nmap scan miss hosts or services?▼

ICMP-filtered networks make -sn mark live hosts as down, and default scans skip UDP and ports above 1000. Add TCP/UDP discovery probes or -Pn, scan with -p-, and include nmap -sU --top-ports 200 for services like SNMP and DNS.

Can Nmap bypass firewalls and IDS during a scan?▼

Yes, with explicit authorization. Techniques include packet fragmentation (-f), decoy addresses (-D RND:10), source-port spoofing (--source-port 53), idle scans (-sI), and slow timing (-T1 --max-rate 10) to evade rate-based detection.

What privileges does Nmap need for SYN scans and OS detection?▼

SYN scans (-sS), OS detection (-O), and raw packet techniques require root or sudo privileges. Without them, Nmap falls back to TCP connect scans, which are slower and more visible in logs.

When should I not use aggressive Nmap timing?▼

Avoid -T5 and high --min-rate values on production networks or congested segments, since they cause packet loss, false negatives, and can overwhelm older network devices. Use -T4 with tuned rates during maintenance windows.

Related Skills

Explore More Software Engineering Skills→
blacklanternsecurityblacklanternsecurity
253

pivoting-tunneling

Establish SSH, Ligolo-ng, Chisel, socat, and DNS/ICMP tunnels through compromised hosts.

Official
Advanced
webrix-aiwebrix-ai
1

vulnerability-prioritization

Correlate CVE scan results with infrastructure to prioritize patching and create Jira tickets.

Official
Advanced
dreadnodedreadnode
11

vuln-critic

Filter low-quality and false positive vulnerability findings from scanners and agent output.

Official
Intermediate
protoLabsAIprotoLabsAI
2

recon-sweep

Perform passive and scoped active reconnaissance on network targets and domains.

Official
Advanced