port-scan

What this skill does

Uses nmap to detect open ports on a target host and collect service version and operating system information. Performs staged scanning from a fast top-port scan through detailed service version detection and OS fingerprinting, saving results in structured formats.

Important: This skill must only be used on systems where explicit written authorization has been obtained. Unauthorized port scanning is illegal in most jurisdictions and violates terms of service.

When to use

• Building a service inventory within a penetration testing scope
• Detecting unnecessarily exposed services
• Verifying service versions to map CVEs
• Periodically auditing network defense posture

Prerequisites

• Install nmap:

  # Ubuntu/Debian
  sudo apt-get install -y nmap
  # CentOS/RHEL
  sudo yum install -y nmap
  

• Written authorization for the target system is required.
• OS detection and some scan techniques require root/sudo privileges.
• Environment variable SECSKILL_TARGET: target IP, IP range, or hostname

Inputs

Variable	Required	Description
SECSKILL_TARGET	Required	Scan target (IP, CIDR, hostname)
SECSKILL_OUTPUT_DIR	Optional	Output directory for results (default: ./output)
SECSKILL_SCAN_SPEED	Optional	nmap speed template T1-T5 (default: T3)
SECSKILL_TOP_PORTS	Optional	Number of top ports to check in fast scan (default: 1000)

Workflow

Step 1: Confirm authorization and prepare environment

export TARGET="${SECSKILL_TARGET:?Set the SECSKILL_TARGET environment variable}"
export OUTDIR="${SECSKILL_OUTPUT_DIR:-./output}"
export SPEED="${SECSKILL_SCAN_SPEED:-T3}"
export TOP_PORTS="${SECSKILL_TOP_PORTS:-1000}"
mkdir -p "$OUTDIR"

echo "================================================================"
echo " WARNING: This scan must only be performed on authorized targets."
echo " Unauthorized scanning is illegal and carries legal liability."
echo "================================================================"
echo "[*] Scan target: $TARGET"
echo "[*] Output path: $OUTDIR"

SAFE_NAME=$(echo "$TARGET" | tr '/:' '__')