CheatSheet

External Enumeration

Custom Nmap workflow script for fast external enumeration.

Overview

This is a custom script I created to assist in external enumeration.

It discovers live hosts, runs quick and full TCP scans, builds a targeted port list for a final service scan, and finishes with quick/full UDP sweeps.

External Enumeration Script

#!/bin/bash

ip_address="$1"

mkdir nmap_scans
cd nmap_scans

# Verify whether host is up
echo "[+] Scanning for hosts that are up...";
echo "";
nmap -sn $ip_address -oG host.up;

echo "";
echo "=============================================";
echo "=============================================";
echo "";

# Ceate List of IPs that show as up
cat host.up | grep "Up" | cut -d " " -f 2 > alive.txt;

# Run quick scan to get started
echo "[+] Running quick port scan...";
echo "";
nmap -sT -F -Pn $(cat alive.txt) -oN initial.nmap;

echo "";
echo "=============================================";
echo "=============================================";
echo "";

# Scanning All Ports
echo "[+] Scanning all ports...";
echo "";
nmap -sT -p- -Pn $(cat alive.txt) -oN all-ports.nmap;

echo "";
echo "=============================================";
echo "=============================================";
echo "";

# Creating open ports file for python sorting
cat all-ports.nmap | grep -i open | cut -d '/' -f 1 > open.ports;

# Sorting open ports
open_port_file="open.ports"
sorted_out_file="open.ports.sorted"

# Read file, strip newlines, join with commas
tr '\n' ',' < "$open_port_file" | sed 's/,$//' > "$sorted_out_file"

# Initiating final port scan
echo "[+] Initiating final port scan..."
echo "";
nmap -p $(cat open.ports.sorted)  -A -sT -T4 -Pn --open $(cat alive.txt) -oN final.nmap;

echo "";
echo "=============================================";
echo "=============================================";
echo "";

# Running Quick UDP Scan
echo "[+] Running quick UDP Scan"
echo "";
nmap -F -sU -T4 -Pn $ip_address -oN upd.initial.nmap

echo "";
echo "=============================================";
echo "=============================================";
echo "";

# Running FulL UDP Scan
echo "[+] Running full UDP Scan...this one will take awhile"
echo "";
nmap -p- -sU -T4 -Pn $ip_address -oN upd.full.nmap

# Cleaning up
rm -f open.ports open.ports.sorted alive.txt host.up;
echo "";
echo "[+] All finished..."