> ## Documentation Index
> Fetch the complete documentation index at: https://notes.chaelsoo.me/llms.txt
> Use this file to discover all available pages before exploring further.

# nmap

Two-pass approach: fast `-p-` scan to find open ports, then `-sV -sC` on just those ports to avoid scanning 65535 ports with slow scripts.

```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
# Fast full TCP
nmap -p- --min-rate 5000 -T4 $IP

# Service + scripts
nmap -sV -sC -p <ports> $IP

# UDP top 100
nmap -sU --top-ports 100 $IP

# All formats output
nmap -sV -sC -p <ports> $IP -oA scan

# NSE scripts
nmap --script smb-vuln* $IP
nmap --script http-enum $IP
nmap --script ftp-anon $IP
```