Active Reconnaissance

Nmap

Ping Sweep

nmap -sP 192.168.1.0/24 -oN scan-alive-hosts.txt
nmap -sP 192.168.1.1,5,100,150 -oN scan-alive-hosts.txt

General Scans for a host

Default script, All ports, Version + OS Discovery, TCP scan

nmap -sC -A -T4 -oN nmap-tcp-initial.txt 192.168.1.1 -p-

UDP Scan:

nmap -sU --top-ports 100 -oN nmap-udp-initial.txt 192.168.1.1

Shellshock

nmap <ip> -p 80,443 --script=http-shellshock --script-args uri=/cgi-bin/xx.cgi

GitHub - mubix/shellshocker-pocs: Collection of Proof of Concepts and Potential Targets for #ShellShockerGitHub

DNS Zone Transfer

dig @<dns_server> <domain_name> -t AXFR +nocookie

Massscan

GitHub - robertdavidgraham/masscan: TCP port scanner, spews SYN packets asynchronously, scanning entire Internet in under 5 minutes.GitHub

Build for doing large scale but fast scanning

Metasploit Scanning Modules

scanner/portscan

post/windows/gather/arp_scanner RHOST=<ip_range>

To use a session as a route:

post/multi/manage/autoroute

Searchsploit

Find known exploit. Usage:

searchsploit <keyword>

To copy the exploit script:

searchsploit <EDB-ID> -m <Output_Location>