yv1ing/z3r0/nmap

nmap

Use nmap for bounded, authorized network reconnaissance. Keep scan scope explicit, targeted, and matched to the task.

Help first

Before constructing or explaining any nmap command, execute the installed CLI help command and use that raw output as the source of truth:

nmap --help

Usage rules

• Work only on explicitly authorized hosts, networks, or local diagnostics.
• Keep scan scope, timing, ports, scripts, and output files explicit.
• Default to one host and a short explicit port list. Broader host ranges or port sets require explicit user authorization and conservative timing or rate limits.
• Do not use broad host discovery, full-port scans, OS detection, aggressive mode, or NSE categories by default.
• Save larger scan outputs to files rather than streaming them into the conversation.
• Treat NSE results and service versions as evidence to validate before reporting impact.

Common workflows

Targeted service/version scan for known ports:

nmap -sV --version-light -T2 --max-rate 20 -p 22,80,443 -oA nmap-target 192.0.2.10

Lightweight version check for web ports:

nmap -sV --version-light -T2 --max-rate 20 -p 80,443 -oN nmap-web.txt example.com

Targeted TCP check when host discovery is unreliable or blocked:

nmap -Pn --open -T2 --max-rate 20 -p 22,80,443 -oA nmap-tcp 192.0.2.10

Use NSE scripts only when the script purpose, target service, and authorization are explicit.

Output

• Report target scope, command used, open ports, detected services, versions, and any script findings.