Recon / enumeration arsenal

Tool selection for port/host/service discovery on authorized lab targets only (in-scope hosts recorded in scope.txt). Pick the tool, run the exact command, log the reasoning in notes.md.

1. Port / service scanning

nmap — the workhorse; scriptable, accurate service/version detection, keeps you honest.

• nmap -sC -sV -oA recon/nmap-tcp $TARGET — -sC default NSE scripts, -sV version detection, -oA writes .nmap/.gnmap/.xml (feed later tools).
• nmap -p- --min-rate 5000 -oA recon/nmap-allports $TARGET — -p- all 65535 ports, --min-rate forces pace so it finishes.
• nmap -sC -sV -p 22,80,445 -oA recon/nmap-targeted $TARGET — re-scan only the ports -p- found, deeply.
• nmap -sU --top-ports 100 -oA recon/nmap-udp $TARGET — -sU UDP; slow, so cap to top ports.
• nmap -sV --version-intensity 9 -p 4444 $TARGET — max probe effort on a stubborn/unknown service port.
• nmap -Pn -sC -sV $TARGET — -Pn skip host-discovery ping (hardened hosts often drop ICMP → "host down").
• nmap --script "smb-enum-shares,smb-os-discovery" -p445 $TARGET — targeted NSE; --script vuln for a vuln sweep.
• Gotcha: run the fast -p- sweep FIRST, then -sC -sV only the open ports — scripts on all 65535 ports wastes minutes.