nmap-scan

Nmap Scan — Port & Service Discovery

Run network reconnaissance using Nmap against an authorized target.

Decision Loop: In-the-Loop (target approval required before scanning)

Safety — MUST Confirm Before Scanning

Before executing ANY scan:

1. Display the target and scan mode to the user
2. Ask for explicit confirmation: "ยืนยันการสแกนเป้าหมาย (Confirm scan target): <target>?"
3. Do NOT proceed without user approval
4. Remind: "Scanning without authorization may be illegal"

Arguments

Parse the user's input for:

• <target> — IP address, hostname, or CIDR range (REQUIRED)
• --mode — Scan mode (default: standard)
• --ports — Custom port range (e.g., 1-1000, 80,443,8080)

Scan Modes

Mode	Flags	Description
quick	-F -T4	Top 100 ports, fast timing
standard	-sV -T3	Service version detection
full	-sV -sC -O -T3	Version + scripts + OS detection
stealth	-sS -T2	SYN scan, slower timing

Execution

After user confirmation, run:

# Build command based on mode
MODE_FLAGS="<flags from table above>"
PORT_FLAG=""  # Add "-p <ports>" if --ports specified

sudo nmap ${MODE_FLAGS} ${PORT_FLAG} -oN /tmp/nmap-output.txt -oX /tmp/nmap-output.xml <target> 2>&1

Important: Nmap often requires sudo for SYN scans and OS detection.

Output Format

Parse the Nmap output and present:

## ผลการสแกน Nmap (Nmap Scan Results)

### ข้อมูลเป้าหมาย (Target Info)
- **เป้าหมาย (Target)**: `<target>`
- **โหมด (Mode)**: standard (-sV)
- **เวลา (Time)**: <timestamp>
- **สถานะ (Status)**: Host is up (latency: Xms)

### พอร์ตที่เปิด (Open Ports)

| Port | State | Service | Version |
|------|-------|---------|---------|
| 22/tcp | open | ssh | OpenSSH 8.9p1 |
| 80/tcp | open | http | Apache httpd 2.4.52 |
| 443/tcp | open | https | nginx 1.18.0 |

### ระบบปฏิบัติการ (OS Detection)
- **OS**: Ubuntu Linux 22.04 (95% confidence)

### สรุป (Summary)
- พอร์ตที่เปิด (Open ports): X
- พอร์ตที่ปิด (Closed ports): Y
- พอร์ตที่กรอง (Filtered ports): Z

### คำแนะนำถัดไป (Next Steps)
1. Run `/nikto-scan <target>` on discovered web ports
2. Run `/nuclei-scan <target>` for vulnerability assessment
3. Run `/whatweb-scan <target>` for technology fingerprinting