Nmap Enumeration OSCP

Basic Nmap Enumeration for OSCP

Nmap · OSCP · Two-Step Enumeration

When it comes to the OSCP exam you need to be efficient and quick with your enumeration, but your technique must be accurate too. You don't want to miss any port. That's where Nmap shines, and using it right from the start can make or break your success in pwning a box.

In this post I'll walk you through a solid two-step Nmap technique that I personally used during my OSCP exam, and still use on THM or HTB boxes. No need for rustscan or autorecon. Just nmap. That's it. Nothing more. And it works every time. Plus you don't have to install anything, nmap comes installed with Kali.

01 — full scan

Step 1: Full TCP Port Scan

Before you dive into service enumeration or exploit searches, you need a clear view of what ports are open. I always start with this:

kali — full TCP port scan

└─$ sudo nmap -p- -Pn -n --open -vvv -oG openPorts 10.129.156.122 [sudo] password for kali: Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-02-04 11:24 CST Initiating SYN Stealth Scan at 11:24 Scanning 10.129.156.122 [65535 ports] Discovered open port 80/tcp on 10.129.156.122 Discovered open port 22/tcp on 10.129.156.122 Completed SYN Stealth Scan at 11:25, 19.67s elapsed (65535 total ports) Nmap scan report for 10.129.156.122

Flag breakdown: sudo is required for SYN scans. -p- scans all 65,535 TCP ports. -Pn skips host discovery and assumes the host is up. --open only shows open ports. -vvv is verbose, so you see what's happening in real time. -oG openPorts outputs in grepable format for quick parsing.

02 — targeted scan

Step 2: Targeted Service & Version Scan

Now that we know what's open, we narrow our focus to exactly those ports, and only those:

kali — targeted service & version scan

└─$ sudo nmap -p 22,80 -sCV 10.129.156.122 22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.11 80/tcp open http Apache httpd 2.4.41

Flag breakdown: -p 22,80 focuses only on the known open ports. -sC runs Nmap's default scripts. -sV grabs service versions, which is super useful for CVE hunting.

03 — why two steps

Why scan in two steps instead of one

I always start by scanning for open ports only, no version detection, no scripts, no banners. Why? Because it keeps the scan quick and light. You get results faster, and more importantly, you send less traffic over the wire.

When you're on the OffSec VPN, which can sometimes be a bit "fragile," minimizing network usage is key. The less bandwidth you use, the less likely you are to get false negatives or cause a VPN disconnection, and that's critical during a timed exam like the OSCP.

Another reason. On a real-world pentest, slamming the client's network with aggressive scans can lead to network instability or even bring services down. That's a fast way to get escorted out of the building, virtually or physically, and lose the contract or even your job.

⚠ don't be loud

If you're scanning blindly with -A or running heavy default scripts against all 65,535 ports, you're not being smart, you're being loud. And that can cost you time, CPU, and even trust.

04 — clipboard script

Copy open ports straight to your clipboard

I can read your mind. You're probably thinking: what if the initial scan turns up a lot of open ports, do I really have to copy and paste all of them by hand? That's a bit annoying. So I built a small solution based on the Spanish pentester SAvitar. It uses the nmap output from the -oG flag to copy those ports straight to your clipboard, so you can paste them right into the Step 2 command above. The script requires xclip, which can be installed via apt.

Here's the code:

extractPorts.sh

#!/bin/bash # Used: # nmap -p- --open -T5 -v -n ip -oG allPorts # Extract nmap information # Run as: # extractPorts allPorts function extractPorts(){ # say how to usage if [ -z "$1" ]; then echo "Usage: extractPorts <filename>" return 1 fi # Say file not found if [ ! -f "$1" ]; then echo "File $1 not found" return 1 fi #if this not found correctly, you can delete it, from "if" to "fi". if ! grep -qE '^[^#].*/open/' "$1"; then echo "Format Invalid: Use -oG <file>, in nmap for a correct format." return 1 fi ports="$(cat $1 | grep -oP '\d{1,5}/open' | awk '{print $1}' FS='/' | xargs | tr ' ' ',')"; ip_address="$(cat $1 | grep -oP '\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}' | sort -u | head -n 1)" echo -e "\n[*] Extracting information...\n" > extractPorts.tmp echo -e "\t[*] IP Address: $ip_address" >> extractPorts.tmp echo -e "\t[*] Open ports: $ports\n" >> extractPorts.tmp echo $ports | tr -d '\n' | xclip -selection clipboard echo -e "[*] Ports copied to clipboard\n" >> extractPorts.tmp cat extractPorts.tmp; rm extractPorts.tmp } extractPorts "$1"

I added it to Kali's /usr/bin with execute permissions so I can run it directly.

kali — installed in /usr/bin

└─$ ls -la extractPorts -rwxr-xr-x 1 root root 1294 Sep 12 2024 extractPorts

Usage is pretty simple. Run the command with your nmap output:

kali — extractPorts usage

└─$ extractPorts Usage: extractPorts <filename>

Enumeration is the foundation of every good attack. Mastering tools like Nmap will make you faster, smarter, and more effective, both during the OSCP exam and in real-world pentests. Stick to this two-step method and you'll be ahead of the game.

● takeaway

Two steps, every time: full port scan first, targeted service scan second. Simple beats aggressive, especially on a fragile VPN or a real client network.