> For the complete documentation index, see [llms.txt](https://0xss0rz.gitbook.io/0xss0rz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://0xss0rz.gitbook.io/0xss0rz/pentest/protocols/port-scan.md).
# Port Scan
[](https://ko-fi.com/Y8Y41FQ2GA)
## Powershell
### Test-NetConnection
`PS C:\Users\jamie\Desktop> Test-NetConnection -Port 1433 192.168.210.15`
```powershell
$d='DC1';$p=53,88,135,389,445,3268,3269,636,9389;$u=53,88,389;$p|%{if(Test-NetConnection $d -Port $_){"TCP $_-Open"}else{"TCP $_-Closed"}};$u|%{try{$c=[net.sockets.udpclient]::new();$c.Connect($d,$_);$null=$c.Send((,0),1);"UDP $_-Open"}catch{"UDP $_-Closed"}finally{$c.Close()}}
```
### Test-TcpPort
{% embed url="" %}
## Scanning without Nmap
```
# Find IPs
for i in {1..255}; do (ping -c 1 192.168.1.${i} | grep "bytes from" &); done
# Find Ports
for i in {1..65535}; do (echo > /dev/tcp/192.168.1.1/$i) >/dev/null 2>&1 && echo $i is open; done
```
## NetScan - From Windows Host
{% embed url="" %}
## Rustscan
```
rustscan -a 192.168.75.0/24 --ulimit 5000
```
## Fscan
{% embed url="" %}
```
./fscan -h 172.17.0.0/24
./fscan -h 172.17.0.2 -p 1-65535
```
## Naabu
{% embed url="" %}
```
naabu -host target.com
naabu -host target.com | httpx -silent
```
## Masscan
```
masscan /16
masscan /24
```
-p: Ports
```
masscan /16 -p 80,443
masscan /16 -p 22-80
masscan /16 -p 0-65535
```
\--top-ports
```
masscan /16 --top-ports 100
```
## Nmap
Nmap binary:
{% embed url="" %}
For Windows - Zenmap
{% embed url="" %}
```shell-session
nmap -sV --open -oA nibbles_initial_scan 10.129.42.190
```
```shell-session
nmap -sC -p 22,80 -oA nibbles_script_scan 10.129.42.190
```
```shell-session
nmap -sV --script=http-enum -oA nibbles_nmap_http_enum 10.129.42.190
```
List of common ports:
{% content-ref url="/pages/fTaX4C0iticozvnz38VP" %}
[Common Ports](/0xss0rz/pentest/protocols/common-ports.md)
{% endcontent-ref %}
```
nmap -Pn -sC -sV --top-ports=1000 [IP]
```
### Fast scan
```
nmap -F [IP]
# Threads 5
nmap -sC -sV [IP] -T5
```
### Host file
```
nmap -iL targets.txt
```
### Nmap options
| **Nmap Option** | **Description** |
| -------------------- | ---------------------------------------------------------------------- |
| `10.10.10.0/24` | Target network range. |
| `-sn` | Disables port scanning. |
| `-Pn` | Disables ICMP Echo Requests |
| `-n` | Disables DNS Resolution. |
| `-PE` | Performs the ping scan by using ICMP Echo Requests against the target. |
| `--packet-trace` | Shows all packets sent and received. |
| `--reason` | Displays the reason for a specific result. |
| `--disable-arp-ping` | Disables ARP Ping Requests. |
| `--top-ports=` | Scans the specified top ports that have been defined as most frequent. |
| `-p-` | Scan all ports. |
| `-p22-110` | Scan all ports between 22 and 110. |
| `-p22,25` | Scans only the specified ports 22 and 25. |
| `-F` | Scans top 100 ports. |
| `-sS` | Performs an TCP SYN-Scan. |
| `-sA` | Performs an TCP ACK-Scan. |
| `-sU` | Performs an UDP Scan. |
| `-sV` | Scans the discovered services for their versions. |
| `-sC` | Perform a Script Scan with scripts that are categorized as "default". |
| `--script