> For the complete documentation index, see [llms.txt](https://mvc1009.gitbook.io/hackingnotes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://mvc1009.gitbook.io/hackingnotes/enumeration/port-scanning.md).

# Port Scanning 📟

The best option to identify Ports, Protocols, and Services (PPS) on a target would be to scan all ports (65535) of the remote system.

## TCP Scanning

### Nmap

#### Simply Scan

```
nmap -p- --open T5 -v -n IP
nmap --top-ports 5000 --open -T5 -v -n IP
```

#### Complex Scan

```
nmap -sV -A --script=default,vuln -p PORTS IP
```

### Masscan

Masscan is the fastest port scanner, it can scan the whole internet in 6 minutes.

```
sudo masscan -p[PORTS] [IP/MASK] --rate=1000 -e [IFACE] --router-ip [GATEWAY]
```

### Bash Port Scanner

This one is created by [@s4vitar](https://www.youtube.com/channel/UCNHWpNqiM8yOQcHXtsluD7Q):

```
#!/bin/bash
# Usage ./portScanner.sh IP

trap ctrl_c INT
function ctrl_c(){
  echo -e "\n\n[*] Exiting....\n"
  tput cnorm; exit 0
}
for port in $(seq 1 65535);do
  timeout 0.1 bash -c "echo '' < /dev/tcp/$1/$port" 2>/dev/null && echo "Port $port - OPEN" &
done; wait
tput cnorm
```

Another bash port scanner, but this time more simply.

```
for port in {1..65535}; do timeout 0.1 bash -c "echo >/dev/tcp/10.10.10.10/$port" && echo "port $port is open"; done;
```

####

## UDP Scanning

Pentesters often forgot to scan for open UDP ports, although UDP scanning can be unrealiable, there are plenty of attack vectors lurking behind open UDP ports.

```
sudo nmap -sU IP
```

{% hint style="info" %}
**Hint:** You can launch a syn scan and udp scan at same time:

`sudo nmap -sS -sU IP`
{% endhint %}