Port & Service Discovery Skill

Use scoped Nmap discovery to identify services adjacent to web applications, including databases, remote administration, mail, caches, and non-standard API ports. An open port is an observation; service identity and unauthorized access require separate validation.

When to Use

• Running deep-invade Phase 6 on a high-value target.
• After surface recon shows no exploitable web vulnerabilities — pivot to infrastructure.
• When the target is a SaaS with backend APIs on non-standard ports.
• After discovering a staging subdomain — check for database/admin ports.

Prerequisites

• nmap available in the execution environment.
• Target domain or IP address.
• For full port scan: patience (can take 10-60 minutes for all 65535 ports).