Asking for recommendation on network reconnaissance tools

Question

Team,
here is my scenario:
I have access to a client C and a server S (which is an EC2 instance). there is a "black box" in the middle which block free communication between C and S on some ports but allows on some other. 
I'm looking to run a tool, possibly a pair of tools on C and S to try all ports (TCP and UDP) and give me a list of ports on S which are accessible from C. think of it as a port scanner in which we have access to both client and server but no access to the core network.
any good recommendation? I don't know if nmap has this component.

Asking this for an anti-censorship cause, in case ethics of this question is a concern.

Riku_Kobayashi · Answer

Hello.

If you just want to do a port scan you can use the "nmap" command.  
https://linux.die.net/man/1/nmap

Is the "nmap" command not enough to meet your needs?  
```
# TCP
nmap -sT

# UDP
nmap -sU 
```

CeejayD · Answer

In scenarios where you have access to both the client and server but need to test connectivity through a 'black box' network (likely protected by a firewall), port scanning with nmap will most likely be blocked by the firewall/middle box. Instead, I suggest using netcat, which is typically pre-installed on many systems and supports both TCP and UDP connections. It's better to test specific ports or port ranges systematically rather than attempting to scan all 65,535 ports.

On client C (test connection):

for port in 22 80 443 8080 8443; do
nc -zv server_ip $port
done

Then expand to ranges if needed:

for port in {8000..8100}; do
nc -zv server_ip $port
done

On client C (test connection):
> for port in 22 80 443 8080 8443; do \
        nc -zv server_ip $port \
> done

Then expand to ranges if needed:
> for port in {8000..8100}; do \
>        nc -zv server_ip $port \
> done

Asking for recommendation on network reconnaissance tools

Add your answer

Relevant content