Nmap Output to Target Lists

Scan one service

SMB:

nmap -Pn -p445 --open -iL <TARGETS_FILE> -oA smb_open

MSSQL:

nmap -Pn -sT -p1433 --open -iL <TARGETS_FILE> -oA mssql_open

First-pass Windows ports

sudo nmap -sS -Pn --open \
  -p53,80,88,135,139,389,443,445,464,636,1433,3268,3269,3389,5985,5986,9389 \
  -iL <TARGETS_FILE> \
  -oA windows_common

-Pn treats every input as up. Use it deliberately rather than as a reflex on a large range.

Extract hosts by open port

When the scan was written with -oA, the greppable file is convenient for small follow-on lists:

awk '/3268\/open/ {print $2}' <SCAN>.gnmap | sort -u > ldap_gc_hosts.txt
awk '/445\/open/ {print $2}' <SCAN>.gnmap | sort -u > smb_hosts.txt
awk '/1433\/open/ {print $2}' <SCAN>.gnmap | sort -u > mssql_hosts.txt

Inspect a few input lines before depending on a parser:

head -n 5 <SCAN>.gnmap

For repeated use, Gnmap-Parser Revamped generates host lists, per-port files, service matrices, and CSV output without maintaining one awk command per port.

Keep MS17-010 separate

Use the NSE check only when validating MS17-010 specifically; it is not a general SMB enumeration command:

nmap -Pn -p445 --script smb-vuln-ms17-010 -iL <TARGETS_FILE> -oA ms17_010