PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Recon series #4: Port scanning – uncovering attack vectors by revealing open ports and hidden services

yeswehack.com | blog | #bug-bounty | #nmap | #shodan | #recon | #masscan | #port-scanning
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Recon series #4 on port scanning: passive scans via Shodan and Censys, active TCP/UDP techniques, banner grabbing, firewall evasion, and tools including Nmap, Masscan, Naabu and httpx.
Published
Collected

Related coverage

blog · netlas.io
Best Nmap Alternatives
Guide to Nmap alternatives across web and CLI: fast mass scanners Masscan and ZMap, vulnerability audits with OpenVAS, and browser-based services like Nmap.online and ZoomEye—plus where the terminal still wins.
blog · yeswehack.com
Recon series recap: The ultimate guide to Bug Bounty reconnaissance and footprinting
Recap of a six-part recon series covering hidden endpoints, subdomain enumeration, HTTP fingerprinting, hidden parameters and Google dorking, with tools like Nmap, Shodan and the Wayback Machine.
blog · yeswehack.com
Recon Series #2: Subdomain enumeration – expand attack surfaces with active, passive techniques
Recon series #2 on subdomain enumeration: passive techniques via Censys, Shodan and SecurityTrails, Google dorking, DNS brute-forcing and vhost fuzzing, demonstrated on the ATG bug bounty program.
blog · netlas.io
Top 6 Most Widely Used Port Scanners in Cybersecurity
Reviews six widely-used port scanners including Nmap, Zenmap, Netcat, Wireshark, Unicornscan and Angry IP Scanner, covering how scanning uncovers vulnerabilities and examples for auditing open ports.
blog · netlas.io
Top 15 OSINT Tools for Expert Intelligence Gathering
Curated list of 15 free OSINT tools—theHarvester, SecurityTrails, BGPView, Mitaka, Shodan, SpiderFoot, Maltego, Nmap and more—with use cases, legal notes and market context.
research · portswigger.net
Exposing Intranets with reliable Browser-based Port scanning
Gareth Heyes builds a reliable browser-based port scanner, distinguishing open ports via Chrome's chrome-error:// behavior and counting iframe onload events.
Back