Network
Nmap
Network mapper for host discovery, port scans, and service/version detection on in-scope ranges.
What it is
Nmap is the default first scan on authorized internal and external assessments. Use it to confirm live hosts, map TCP/UDP services, and fingerprint versions before any heavier tooling. Timing templates and scan types should follow the RoE — slow and tagged scans on production, faster only on lab or explicitly approved windows.
Reach for it when
Kickoff of an external, internal, or cloud-adjacent network assessment when you have a written scope of CIDRs or hostnames.
Watch-outs
Do not scan out-of-scope ranges, partner networks, or cloud metadata endpoints. -T5, UDP floods, and default NSE exploit scripts are out unless the RoE says otherwise. On HIPAA/PCI jobs, log the exact command and window.
Typical invocation
nmap -sV -sC -T3 -oA recon/scope 10.20.4.0/24
Authorized assessments only. Stay inside the rules of engagement.
Pin to a kit
Open an engagement first.