nmap & masscan port scanning

When it applies

You have in-scope hosts or IP ranges (confirmed in scope.txt — see tradecraft-scope-roe) and need the network attack surface: open ports, service versions, OS guesses. This is the active-scanning step that follows passive enumeration (recon-subdomain-enum, recon-arsenal) and feeds service-specific testing (network-service-attacks, web-arsenal for anything HTTP).

Why it works

nmap crafts raw packets to classify ports (open/closed/filtered) and then speaks each discovered service's protocol just enough to fingerprint its version; its NSE script engine adds per-service checks on top. masscan trades per-host depth for raw speed (its own TCP stack, millions of pps), so the efficient pattern is: masscan for breadth across many hosts/ports, nmap for depth on the hits.