Nmap Recon

**Judgement:** A strong, focused Nmap-centric recon skill that provides well-chosen commands and workflows for typical port scanning and service/vulnerability enumeration tasks. It is best suited for users who already have (or can install) Nmap and need structured guidance rather than raw documentation. **What it does well** - Supplies concrete, copy-paste-ready Nmap commands for common scenarios: quick scans, full port sweeps, SYN/stealth scans, UDP, vuln scripts, and aggressive enumeration. - Encourages good practice with `-sC -sV` and `-oA` output, plus examples for parsing `.gnmap`, `.nmap`, and `.xml` reports. - Provides sensible scan profiles and a step-by-step workflow from host discovery to deeper and vulnerability-focused scans. - Explains key options (timing templates, script categories, target specification), making it practical in real-world recon and testing contexts. **Key risks / limitations** - **Dual-use / legal risk:** Nmap scanning against networks or hosts without explicit authorization can be illegal or violate policies. While the skill does include a clear authorization warning and examples of what *not* to scan, misuse remains possible. - **Environmental dependency:** Requires Nmap (and sometimes `sudo`/root) plus common CLI tools (`grep`, `awk`, `xmllint`) to fully leverage parsing examples; functionality will be limited if these are missing. - **Scope:** Focused on core recon; it does not deeply cover advanced NSE usage, complex firewall/IDS evasion, or automated post-processing beyond basic parsing snippets. **Recommended scenarios** - Authorized penetration tests, red-team engagements, internal audits, and lab/CTF environments where Nmap is available and permitted. - Users who know what they want to scan (targets and scope defined) and need accurate, efficient Nmap commands and workflows rather than figuring out flags from scratch. - Situations where repeatable scans and scriptable parsing of Nmap output are valuable (e.g., recurring internal network assessments).

**Quick judgment:** Strong, practical Nmap-centric recon skill that covers the most common and useful scan modes, script categories, and basic output parsing. Technically capable and well-aligned with typical security workflows, assuming Nmap (and sometimes sudo) is available. **Risks:** Network scanning can be intrusive, detectable, and may be illegal or against policy if done without explicit authorization. Some profiles (aggressive, vuln scripts, high timing templates) can disrupt fragile services or trigger security alerts. Users must restrict usage to systems and networks they own or are formally permitted to test. **Recommended scenarios:** Best used in authorized penetration tests, internal security assessments, CTFs, and lab environments where Nmap is installed and network scanning is explicitly allowed. Suitable as a backbone for structured recon workflows—quick host discovery, port enumeration, service/OS fingerprinting, and targeted vulnerability checks—rather than for use on arbitrary or unapproved internet targets.