> For the complete documentation index, see [llms.txt](https://0xmrmasry.gitbook.io/blog/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://0xmrmasry.gitbook.io/blog/notes/ejpt/scanning.md).

# Scanning

This is the infrastrucutre part of the information gathering.

### Mapping a network

Mapping a network helps the pentester get an idea of how the network is structured.

### Ping sweep

Ping sweeping helps find all live hosts in a network range.

```
fping -a -g 192.168.1.0/24 2>/dev/null
nmap -sn 192.168.1.0/24
```

### OS fingerprinting

OS fingerprinting is the process of determinig the operating system used by a host on a network.

```
# OS Detection, no ping
nmap -Pn -O <target(s)>
```

### Port Scanning

Port scanning allows for discvoery of running daemons and services of each node on the network.

```
# TCP SYN scan or stealth scan
nmap -Ss <target>

# Scripts and version detection
nmap -sC -sV <target>

# All ports, scripts, version
nmap -sC -sV -p- <target>

# UDP and Version check
nmap -sU -sV <target>

# Most used scan
# OS, version, scripts, traceroute, and all ports
nmap -A -p- <target>
```