> For the complete documentation index, see [llms.txt](https://leecybersec.gitbook.io/oscp/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://leecybersec.gitbook.io/oscp/scanning/scanning-1.md).

# Scanning

## Automation Scan

* [ ] [**AutoRecon**](https://github.com/Tib3rius/AutoRecon)
* [ ] [**onetwopunch**](https://github.com/superkojiman/onetwopunch)

## All Port Scan

#### TCP

```bash
nmap -p- -T3 $ip -o all_tcp.nmap
```

#### Scan

```bash
sudo nmap -sU -p- $ip -o all_udp.nmap
```

#### Create ports

```bash
ports=$(cat all_tcp.nmap | grep ^[0-9] | cut -d '/' -f1 | tr '\n' ',' | sed s/,$//); echo $ports
```

## Service Scan

```bash
nmap -sC -sV -p$ports $ip
```

## Script Scan

```bash
nmap --script smb-vul* -p 139,445 $ip
```

```bash
nmap -p 1433 --script ms-sql-brute --script-args userdb=customuser.txt,passdb=custompass.txt <host>
```