Nmap & PowerShell Scanning Techniques

Published on January 17, 2025

Nmap Scanning Techniques

1. SYN (Stealth) Scan

The most popular scan, SYN scanning, sends SYN packets to initiate connections but doesn’t complete the three-way handshake. This minimizes detection. 

sudo nmap -sS <target-IP>
  • Faster and more efficient.
  • Avoids application logs.
  • Default scan if raw socket privileges are available.

2. TCP Connect Scan

A full TCP handshake is performed, making it more detectable. It’s used when raw sockets aren’t available or when scanning through proxies. 

nmap -sT <target-IP>

3. UDP Scan

UDP scans send empty packets to detect open ports. For common ports like SNMP (161), protocol-specific packets are sent. 

sudo nmap -sU <target-IP>
sudo nmap -sU -sS <target-IP>  (Combined with SYN Scan)

4. Network Sweeping

Find live hosts in a range with the -sn option. It uses ICMP, TCP SYN (port 443), and TCP ACK (port 80) packets for host discovery. 

nmap -sn <target-range>
nmap -oG ping-sweep.txt
grep Up ping-sweep.txt | cut -d " " -f 2

5. OS Fingerprinting

Identify the target’s operating system by analyzing TCP/IP stack variations. 

sudo nmap -O <target-IP> --osscan-guess

6. Nmap Scripting Engine (NSE)

Automate scanning tasks, such as vulnerability detection, with NSE scripts. 

nmap --script http-headers <target-IP>
nmap --script-help <script-name>

7. Top Ports Scan

Scan the most frequently open ports using the --top-ports option. 

nmap --top-ports=20 <target-range>

PowerShell for Port Scanning

When working in Windows environments, PowerShell can substitute for Nmap when third-party tools aren’t available.

1. Basic Port Check

Check if a specific port is open: 

Test-NetConnection -Port 445 <target-IP>

2. Automated Scanning

Scan multiple ports with a PowerShell one-liner: 

1..1024 | % {(New-Object Net.Sockets.TcpClient).Connect("<target-IP>", $_); "TCP port $_ is open"} 2>$null

3. Advantages of PowerShell

  • No installation required.
  • Works natively in restricted environments.

Key Takeaways

  • Traffic Awareness: Always monitor the impact of your scans.
  • Efficiency: Combine TCP and UDP scans for a complete picture.
  • Adaptability: Use PowerShell for reconnaissance in Windows environments.
  • Automation: Leverage Nmap’s scripting engine for advanced tasks.

With tools like Nmap and PowerShell, penetration testers can efficiently discover and map network vulnerabilities while minimizing their footprint. Whether you’re conducting a simple port scan or a full network sweep, these techniques will enhance your reconnaissance capabilities.

Linked Articles