Initial Service Discovery
#Create a working directory for one target
#mkdir -p $IP/{nmap,web,exploit,loot}
cd $IP
Run AutoRecon
#autorecon $IP --only-scans-dir
Run a fast TCP sweep
#nmap --min-rate 4500 --max-rtt-timeout 1500ms -p- -Pn $IP -oG nmap/all_tcp.gnmap
Extract open TCP ports#
TCP_PORTS=$(grep -oP '\d+/open' nmap/all_tcp.gnmap | cut -d/ -f1 | paste -sd, -)
echo "$TCP_PORTS"
Run service detection on open TCP ports
#nmap -sC -sV -T4 -Pn -p "$TCP_PORTS" $IP -oA nmap/full_tcp
Scan top 100 UDP ports
#nmap -sU --top-ports 100 -T4 -Pn $IP -oA nmap/top_udp
What to open next
#HTTP/HTTPS -> [80, 443 HTTP](<80-443-http>)
SMB -> [139,445 SMB](<139445-smb>)
FTP -> [20,21 FTP](<2021-ftp>)
SSH -> [22 SSH](<22-ssh>)
DNS -> [53 DNS](<53-dns>)
Kerberos -> [88 Kerberos](<88-kerberos>)
LDAP -> [389,636 LDAP(S)](<389636-ldaps>)
MSRPC -> [135 WMI,MSRPC](<135-wmimsrpc>)
WinRM -> [5985, 5986 WinRM](<5985-5986-winrm>)
MSSQL -> [1433 MSSQL](<1433-mssql>)
MySQL -> [3306 MySQL](<3306-mysql>)
RDP -> [3389 RDP](<3389-rdp>)
SMTP -> [25,587 SMTP](<25587-smtp>)
SNMP -> [161 SNMP](<161-snmp>)
NFS -> [2049 NFS](<2049-nfs>)