port-service-discovery

1# Port & Service Discovery Skill
2 
3Use scoped Nmap discovery to identify services adjacent to web applications,
4including databases, remote administration, mail, caches, and non-standard API
5ports. An open port is an observation; service identity and unauthorized access
6require separate validation.
7 
8## When to Use
9 
10- Running `deep-invade` Phase 6 on a high-value target.
11- After surface recon shows no exploitable web vulnerabilities — pivot to infrastructure.
12- When the target is a SaaS with backend APIs on non-standard ports.
13- After discovering a staging subdomain — check for database/admin ports.
14 
15## Prerequisites
16 
17- `nmap` available in the execution environment.
18- Target domain or IP address.
19- For full port scan: patience (can take 10-60 minutes for all 65535 ports).
20 
21## How to Run
22 
23```bash
24# Fast top-100 port scan (30 seconds)
25nmap -F --open -T4 TARGET -oN nmap_fast.txt
26 
27# Top 1000 ports (2-3 minutes)
28nmap --top-ports 1000 --open -T4 TARGET -oN nmap_1000.txt
29 
30# Service version detection on open ports
31nmap -sV -p $(grep 'open' nmap_fast.txt | cut -d/ -f1 | tr '\n' ',') TARGET
32 
33# Firewall bypass: fragment packets
34nmap -f -F TARGET
35```
36 
37## Quick Reference
38 
39| Port | Service | Finding Severity |
40|------|---------|-----------------|
41| 3306 | MySQL | Critical (if open to internet) |
42| 27017 | MongoDB | Critical (if no auth) |
43| 6379 | Redis | Critical (if no auth) |
44| 5432 | PostgreSQL | High |
45| 1433 | MS SQL Server | High |
46| 21 | FTP | High (anonymous login?) |
47…