T1046

Network Service Discovery

Scanning ports and service versions to know what to attack.

How it shows up on Hack The Box

Every box starts here: an nmap of all TCP ports and then -sCV on the open ones. Inside the network without nmap, use bash with /dev/tcp or nc.

There are no catalog machines with this technique yet: practice it with the commands and guides in your own lab.

Taken from our cheatsheets and tool pages. Type your details and they are filled into every command.

Your values Saved in this browser and applied to every cheatsheet.

Target IP

Scan through the proxy Attacker

proxychains -q nmap -sT -Pn --top-ports 100 172.16.1.10

Only TCP connect (-sT) works through proxychains, without ping (-Pn).

All TCP ports (fast)

sudo nmap -p- --open -sS --min-rate 5000 -n -Pn 10.10.11.20 -oG puertos

Versions and default scripts

nmap -sCV -p22,80 10.10.11.20 -oN objetivo

Replace 22,80 with the ports from the previous step.

UDP (most common)

sudo nmap -sU --top-ports 100 --open -n -Pn 10.10.11.20

Known vulnerabilities

nmap --script vuln -p445 10.10.11.20

Search scripts by name

ls /usr/share/nmap/scripts/ | grep -i smb

Web path fuzzing with nmap

nmap --script http-enum -p80 10.10.11.20

Ports with bash Target

for p in $(seq 1 65535); do (echo > /dev/tcp/172.16.1.10/$p) 2>/dev/null && echo "$p abierto"; done

Ports with nc Target

nc -zv -w1 172.16.1.10 1-10000 2>&1 | grep -i succeeded

All in one, saving in all three formats

nmap -sCV -p- -T4 10.10.11.20 -oA nmap/completo

Discover live hosts on a network (no port scan)

nmap -sn 10.10.10.0/24

SMB scripts

nmap --script "smb-enum-shares,smb-os-discovery,smb2-security-mode" -p445 10.10.11.20

Show the help of an NSE script

nmap --script-help http-enum