Overview
This is a custom script I created to assist in external enumeration.
It discovers live hosts, runs quick and full TCP scans, builds a targeted port list for a final service scan, and finishes with quick/full UDP sweeps.
External Enumeration Script
#!/bin/bash
ip_address="$1"
mkdir nmap_scans
cd nmap_scans
# Verify whether host is up
echo "[+] Scanning for hosts that are up...";
echo "";
nmap -sn $ip_address -oG host.up;
echo "";
echo "=============================================";
echo "=============================================";
echo "";
# Ceate List of IPs that show as up
cat host.up | grep "Up" | cut -d " " -f 2 > alive.txt;
# Run quick scan to get started
echo "[+] Running quick port scan...";
echo "";
nmap -sT -F -Pn $(cat alive.txt) -oN initial.nmap;
echo "";
echo "=============================================";
echo "=============================================";
echo "";
# Scanning All Ports
echo "[+] Scanning all ports...";
echo "";
nmap -sT -p- -Pn $(cat alive.txt) -oN all-ports.nmap;
echo "";
echo "=============================================";
echo "=============================================";
echo "";
# Creating open ports file for python sorting
cat all-ports.nmap | grep -i open | cut -d '/' -f 1 > open.ports;
# Sorting open ports
open_port_file="open.ports"
sorted_out_file="open.ports.sorted"
# Read file, strip newlines, join with commas
tr '\n' ',' < "$open_port_file" | sed 's/,$//' > "$sorted_out_file"
# Initiating final port scan
echo "[+] Initiating final port scan..."
echo "";
nmap -p $(cat open.ports.sorted) -A -sT -T4 -Pn --open $(cat alive.txt) -oN final.nmap;
echo "";
echo "=============================================";
echo "=============================================";
echo "";
# Running Quick UDP Scan
echo "[+] Running quick UDP Scan"
echo "";
nmap -F -sU -T4 -Pn $ip_address -oN upd.initial.nmap
echo "";
echo "=============================================";
echo "=============================================";
echo "";
# Running FulL UDP Scan
echo "[+] Running full UDP Scan...this one will take awhile"
echo "";
nmap -p- -sU -T4 -Pn $ip_address -oN upd.full.nmap
# Cleaning up
rm -f open.ports open.ports.sorted alive.txt host.up;
echo "";
echo "[+] All finished..."