Advanced scanning techniques allow pentesters to collect deeper, more precise information about targets. These scans go beyond basic host and port discovery. They help identify service versions, detect firewalls, map filtering behavior, uncover hidden hosts, analyze packet responses, and perform stealthy enumeration. Advanced scanning gives a clearer understanding of the environment and reveals insights that basic scans cannot provide.

Version Detection

Version detection identifies the exact software running behind an open port. Knowing the version helps match services to known vulnerabilities.

Nmap Version Scan

nmap -sV 10.10.10.5

This sends crafted probes to each service and analyzes the response to identify:

Software name
Version number
Protocol details

Aggressive Version Detection

nmap -sV --version-all 10.10.10.5

This sends more probes and fingerprints services more deeply.

OS Detection

OS detection analyzes how a system responds to packets. Each OS has a unique TCP/IP stack behavior.

Standard OS Scan

nmap -O 10.10.10.5

Aggressive OS Scan

nmap -O --osscan-guess 10.10.10.5

Pentesters use OS detection to plan privilege escalation and choose correct exploits.

Stealth Scanning

Stealth scans help avoid triggering firewalls, IDS, or logging systems. These scans limit the number of completed connections.

SYN Stealth Scan

nmap -sS 10.10.10.5

This sends only a SYN packet and does not complete the handshake. It is quieter and faster than full connect scans.

Fragmented Packet Scan

nmap -f 10.10.10.5

This splits packets into smaller fragments to bypass simple packet filters.

Decoy Scan

nmap -D RND:10 10.10.10.5

This sends packets from multiple spoofed addresses to confuse defenders.

Idle Scan (Zombie Scan)

nmap -sI 10.10.10.100 10.10.10.5

This uses a third-party “zombie” host to perform the scan, hiding the pentester's IP completely.

Firewall and Filtering Analysis

Advanced scans help map firewall rules and filtering behavior.

ACK Scan (Mapping Firewalls)

nmap -sA 10.10.10.5

ACK scans reveal whether a firewall is stateful and which ports are filtered.

Window Scan

nmap -sW 10.10.10.5

This identifies filtering behavior by analyzing TCP window sizes.

FIN Scan

nmap -sF 10.10.10.5

FIN scans attempt to bypass firewall rules that block SYN scans.

XMAS Scan

nmap -sX 10.10.10.5

This sends unusual flag combinations to detect filtering and service behavior.

NSE (Nmap Scripting Engine) Scanning

NSE scripts perform automated enumeration and vulnerability checks.

Running Default Scripts

nmap -sC 10.10.10.5

This runs commonly used scripts for service enumeration.

Script + Version Scan

nmap -sC -sV 10.10.10.5

This combines scripts with version detection for deeper analysis.

Running a Specific Script

nmap --script http-title 10.10.10.5

Running a Category of Scripts

nmap --script vuln 10.10.10.5

This checks for known vulnerabilities on detected services.

UDP Deep Scanning

UDP enumeration is slow, but advanced techniques help collect more accurate results.

Full UDP Scan

nmap -sU -p- 10.10.10.5

Combined TCP and UDP Scan

nmap -sS -sU 10.10.10.5

UDP scans discover services like SNMP, DNS, and TFTP.

Timing Control

Fine-tuning speed improves accuracy and reduces detection risk.

Slow but stealthy

nmap -T1 10.10.10.5

Fast and aggressive

nmap -T5 10.10.10.5

Pentesters adjust timing based on network stability, firewalls, and detection concerns.

Evading Detection

Advanced scans help bypass network monitoring.

Randomizing packet order

nmap --scanflags SYNACK 10.10.10.5

Spoofing MAC Address

nmap --spoof-mac 00:11:22:33:44:55 10.10.10.5

Randomizing targets

nmap --randomize-hosts 10.10.10.0/24

These techniques reduce the chances of detection in monitored networks.

Why Advanced Scanning Matters

Advanced scanning reveals deeper information about targets, including hidden hosts, filtered ports, OS behavior, service versions, and firewall rules. These techniques allow pentesters to bypass restrictions, map segmentation, and plan precise attack strategies. Mastering advanced scanning ensures efficient and accurate enumeration before exploitation.

Intel Dump

Advanced scanning identifies OS, versions, and filtering behavior
Stealth methods reduce detection
Firewall scans map rules and filtering
NSE scripts automate deep enumeration and vulnerability checks
Timing and evasion options help bypass monitoring
Combined techniques create a complete network fingerprint