← Back to Academy

Academy Node

Nmap Full Scan

Initial broad TCP scan to identify attack surface.

Beginner100 XPOSCP Workflow

Why it matters

Missing one service can kill an exam path.

How to identify it

  • Target IP obtained

Linux commands

nmap -p- --min-rate 10000 -T4 TARGET -oA fullscan
nmap -sCV -p PORTS TARGET -oA services

Expected output

  • Open ports
  • Service versions

Success looks like

  • Attack surface identified

Failure looks like

  • Filtered ports
  • Missing services

Troubleshooting

  • Run UDP later

Common mistakes

  • Skipping full port scan

What to try next

  • SMB enum
  • Web enum
  • LDAP enum

Recommended next lessons

ASREP Roast

ASREP roasting abuses AD users with Kerberos pre-authentication disabled. You can request encrypted ASREP material and attempt to crack it offline.

Kerberoast

Kerberoasting targets domain users with SPNs. You request service tickets and crack them offline.

GenericWrite

GenericWrite means you can modify certain attributes on the target AD object.

GenericAll

GenericAll is effectively full control over the target AD object.