nmap is not on a host; the flows will have no route until you place it.
1What is the scan for?
Adjust
1Which ports, how fast?
masscan finds open ports, not what runs on them; nmap after it names the services.
1Scan, then export the report
Targets
- Give the target these hosts.
- Scan from inside the network. Greenbone in rootless containers sees it through NAT and finds few hosts: set the target's Alive test to Consider Alive (slow on a large range), or run the scanner container as root on the host's network.
- In Greenbone: Scans › Reports, open the report.
- In its filter, tick every severity, Log included, and show all rows (
rows=-1): Log results name the services.
- Download it in the report format XML.
Real addresses go into the file, and into any link you share.
1What should nuclei look for?
Adjust
effractor's templates come with the command; nuclei's own must be installed. nmap before them finds the hosts and ports.
2Run it
Targets
Then the ACK scan, a run of its own: nmap does one kind of TCP scan per run. Paste both results, one after the other.
Run it on the host nmap is on. Real addresses go into the file, and into any link you share.