> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/enum/network-discovery/port-scanning.md).
# Port Scanning
## Port scanning with netcat
### TCP Scanning with netcat
Do a TCP Netcat port scan on ports 3388-3390 on `192.168.50.152`.
We'll use the `-w` option to specify the connection timeout in seconds, as well as `-z` to specify zero-I/O mode, which is used for scanning and sends no data.
```bash
kali@kali:~$ nc -nvv -w 1 -z 192.168.50.152 3388-3390
(UNKNOWN) [192.168.50.152] 3390 (?) : Connection refused
(UNKNOWN) [192.168.50.152] 3389 (ms-wbt-server) open
(UNKNOWN) [192.168.50.152] 3388 (?) : Connection refused
sent 0, rcvd 0
```
Another way is to use a Bash `for` loop to scan a single port on multiple machines (`172.16.50.0/24`)
```bash
for i in $(seq 1 254); do nc -zv -w 1 172.16.50.$i 445; done
```
The Bash **for** loop sweeps for hosts with an open port 445 on the /24 subnet. We can use Netcat to make the connections, passing the **-z** flag to check for a listening port without sending data, **-v** for verbosity, and **-w** set to **1** to ensure a *lower time-out threshold*.
### UDP Scanning with netcat
Do a UDP Netcat port scan against ports 120-123 on `192.168.50.149`.
We'll use the only `nc` option we have not covered yet, `-u`, which indicates a UDP scan.
```bash
kali@kali:~$ nc -nv -u -z -w 1 192.168.50.149 120-123
(UNKNOWN) [192.168.50.149] 123 (ntp) open
```
### Usage information nc -h
```bash
┌──(kali㉿kali)-[~]
└─$ nc -h
[v1.10-47]
connect to somewhere: nc [-options] hostname port[s] [ports] ...
listen for inbound: nc -l -p port [-options] [hostname] [port]
options:
-c shell commands as `-e'; use /bin/sh to exec [dangerous!!]
-e filename program to exec after connect [dangerous!!]
-b allow broadcasts
-g gateway source-routing hop point[s], up to 8
-G num source-routing pointer: 4, 8, 12, ...
-h this cruft
-i secs delay interval for lines sent, ports scanned
-k set keepalive option on socket
-l listen mode, for inbound connects
-n numeric-only IP addresses, no DNS
-o file hex dump of traffic
-p port local port number
-r randomize local and remote ports
-q secs quit after EOF on stdin and delay of secs
-s addr local source address
-T tos set Type Of Service
-t answer TELNET negotiation
-u UDP mode
-v verbose [use twice to be more verbose]
-w secs timeout for connects and final net reads
-C Send CRLF as line-ending
-z zero-I/O mode [used for scanning]
port numbers can be individual or ranges: lo-hi [inclusive];
hyphens in port names must be backslash escaped (e.g. 'ftp\-data').
```
ncat -h
```bash
┌──(kali㉿kali)-[~]
└─$ ncat -h
Ncat 7.94SVN ( https://nmap.org/ncat )
Usage: ncat [options] [hostname] [port]
Options taking a time assume seconds. Append 'ms' for milliseconds,
's' for seconds, 'm' for minutes, or 'h' for hours (e.g. 500ms).
-4 Use IPv4 only
-6 Use IPv6 only
-U, --unixsock Use Unix domain sockets only
--vsock Use vsock sockets only
-C, --crlf Use CRLF for EOL sequence
-c, --sh-exec Executes the given command via /bin/sh
-e, --exec Executes the given command
--lua-exec Executes the given Lua script
-g hop1[,hop2,...] Loose source routing hop points (8 max)
-G Loose source routing hop pointer (4, 8, 12, ...)
-m, --max-conns Maximum simultaneous connections
-h, --help Display this help screen
-d, --delay
## Port scanning with PowerShell
### Simple TCP port scanner
This example will scan TCP-ports 1-1024 on IP `10.10.30.55`.
```powershell
1..1024 | % {Write-Output ((New-Object Net.Sockets.TcpClient).Connect("10.10.30.55", $_)) "Open port on - $_"} 2>$null
```
## References
**nc** - Linux manual page:
**ncat** - Linux manual page:
**ncat** - Users' Guide:
**netcat** - Wikipedia: