Recon Port Scan by crazyMarky — AI Skill for Any LLM

Overview

Publisher	crazyMarky
Repository	`pentest-skills`
Skill name	`recon-port-scan`
Stars	342
Forks	37
Bundled files	11
License	Apache-2.0
Links	Skill source Repository

Markdown instructions

A SKILL.md file the model loads on demand, so it only costs tokens when a request actually matches.

Works with any LLM

AI skills are plain Markdown, not provider-specific code, so this works with GPT, Claude, Gemini, Grok, or a local model.

11 bundled files

Scripts, templates, and references the model can read while it works. Files are read-only and never executed.

Open source

Published by crazyMarky on GitHub. Read the source before you install it.

Installation

Install the Recon Port Scan AI skill in TypingMind to use it with any LLM, or drop it into another agent that reads SKILL.md.

Install in TypingMind

TypingMind installs a skill straight from its GitHub folder — it reads SKILL.md, bundles the resource files, and stores the result locally.

Open the app and go to Plugins → Skills.
Choose "Install from GitHub".
Paste the skill folder URL below and confirm.
https://github.com/crazyMarky/pentest-skills/tree/main/recon-port-scan
Enable the skill in any chat where you want it available.

Plugins → Skills → Add skill → From GitHub URL, then paste the folder URL and press Continue.

Install in another agent

Any agent that reads the Agent Skills format can use this skill — copy the folder into that agent's skills directory.

Claude Code — .claude/skills

git clone --depth 1 https://github.com/crazyMarky/pentest-skills.git /tmp/pentest-skills
mkdir -p .claude/skills
cp -r /tmp/pentest-skills/recon-port-scan .claude/skills/recon-port-scan

Restart Claude Code after copying so it picks up the new skill.

Use it in TypingMind

Enable Recon Port Scan in any TypingMind chat and the model takes it from there. Its name and description sit in the system prompt, and the moment a request matches, the model loads the full instructions itself — you never invoke it by hand, and it costs no tokens until it is actually used.

The model loads Recon Port Scan on its own as soon as a request matches it.

Works with any AI model

AI skills are plain Markdown instructions rather than provider-specific code, so Recon Port Scan is not tied to the model it was written for. Install it once in TypingMind and use it with GPT-5, Claude, Gemini, Grok, DeepSeek, Mistral, Llama, or a local model you run yourself — all on your own API keys.

Loaded only when it is needed

The system prompt carries just the name and description. The instructions are fetched on the first matching request, so an idle skill costs nothing.

Switch models mid-chat

Because the skill is instructions rather than code, changing model does not break it — the next model reads the same SKILL.md.

Skill instructions

This is the SKILL.md content the model loads. Read it before installing — a skill is instructions your model will follow.

Port Scanning / Reconnaissance

Authorization Warning

IMPORTANT: Port scanning without proper authorization is illegal. Always ensure you have:

Written permission from the target system owner
Defined scope of authorized testing
Legal compliance with local regulations

Prerequisites

Required tools that must be installed on your system:

nmap - sudo apt install nmap (Debian/Ubuntu) or brew install nmap (macOS)

Optional tools:

masscan - High-speed port scanner
rustscan - Modern fast scanner with nmap integration

Quick Start

Most commonly used commands for port scanning:

Fast Common Port Scan

bash
nmap -T4 -F <target>

Quick scan of top 100 common ports.

Full Port Scan with Service Detection

bash
nmap -sV -sC -p- <target>

Scan all 65535 ports with version detection and default scripts.

Stealth SYN Scan

bash
sudo nmap -sS -T2 -p- <target>

Stealthy scan (requires root).

High-Speed Large Range Scan

bash
masscan -p1-65535 <target/CIDR> --rate=10000

Fast scanning of large IP ranges.

Common Scenarios

Scenario 1: Quick Reconnaissance

When you need fast results on common ports:

bash
nmap -T4 -F <target>

Parameters:

-T4 - Aggressive timing template (faster)
-F - Fast mode, scan top 100 ports
<target> - IP address, hostname, or CIDR range

Example:

bash
nmap -T4 -F 192.168.1.100
nmap -T4 -F example.com
nmap -T4 -F 192.168.1.0/24

Scenario 2: Full Port Range Discovery

When you need to find all open ports (1-65535):

bash
nmap -p- <target>

Parameters:

-p- - Scan all 65535 ports

Example:

bash
nmap -p- 192.168.1.100

With version detection:

bash
nmap -sV -p- <target>

Scenario 3: Service Version Detection

When you need to identify running service versions:

bash
nmap -sV -sC <target>

Parameters:

-sV - Probe open ports for service/version info
-sC - Run default NSE scripts

Example:

bash
nmap -sV -sC 192.168.1.100

More aggressive version detection:

bash
nmap -sV --version-intensity 7 <target>

Scenario 4: Stealth Scanning

When you need to avoid detection:

bash
sudo nmap -sS -T2 -f --data-length 24 <target>

Parameters:

-sS - SYN scan (stealthier than connect scan)
-T2 - Polite timing (slower, less suspicious)
-f - Fragment packets
--data-length 24 - Append random data to packets

Example:

bash
sudo nmap -sS -T2 -f 192.168.1.100

Decoy scan:

bash
sudo nmap -D RND:10 -sS <target>

Scenario 5: UDP Port Scanning

When you need to discover UDP services:

bash
nmap -sU --top-ports 100 <target>

Parameters:

-sU - UDP scan
--top-ports 100 - Scan top 100 most common UDP ports

Example:

bash
nmap -sU --top-ports 100 192.168.1.100

Combined TCP + UDP scan:

bash
nmap -sS -sU <target>

Scenario 6: OS Fingerprinting

When you need to identify the operating system:

bash
sudo nmap -O <target>

Parameters:

-O - Enable OS detection

Example:

bash
sudo nmap -O 192.168.1.100

Combined with version detection:

bash
sudo nmap -sV -O <target>

Scenario 7: High-Speed Mass Scanning

When scanning large IP ranges:

bash
masscan -p1-65535 <CIDR> --rate=10000 -oL output.txt

Parameters:

-p1-65535 - Port range
--rate=10000 - Packets per second (adjust based on bandwidth)
-oL output.txt - Save results to file

Example:

bash
masscan -p1-65535 192.168.1.0/24 --rate=10000 -oL scan_results.txt

Follow-up with nmap for detailed scanning:

bash
# First, masscan to find open ports
masscan -p1-65535 192.168.1.0/24 --rate=10000 -oL - | grep open > open_ports.txt

# Then, nmap for service details on discovered ports
nmap -sV -p 80,443,22,3306 192.168.1.100

Scenario 8: RustScan (Modern Fast Scanner)

bash
rustscan -a <target> -- -sV

Parameters:

-a - Target address
-- - Separator for nmap arguments (passed through to nmap)

Example:

bash
rustscan -a 192.168.1.100 -- -sV -sC

Scenario 9: Output Formats

Save results in different formats:

bash
# All formats (normal, XML, grepable)
nmap -oA output <target>

# XML only (for parsing)
nmap -oX output.xml <target>

# Grepable format
nmap -oG output.gnmap <target>

# Normal output to file
nmap -oN output.txt <target>

Example:

bash
nmap -sV -p- -oA scan_results 192.168.1.100
# Creates: scan_results.nmap, scan_results.xml, scan_results.gnmap

Tool Selection Guide

Scenario	Recommended Tool	Command
Quick common port scan	nmap	`nmap -T4 -F <target>`
Full port range	nmap	`nmap -p- <target>`
Service version detection	nmap	`nmap -sV -sC <target>`
Large network / speed critical	masscan	`masscan -p1-65535 <target> --rate=10000`
Stealth required	nmap	`sudo nmap -sS -T2 <target>`
UDP service discovery	nmap	`nmap -sU --top-ports 100 <target>`
OS fingerprinting	nmap	`sudo nmap -O <target>`
Modern fast workflow	rustscan	`rustscan -a <target> -- -sV`

Tool Comparison:

Tool	Speed	Accuracy	Features	Use Case
nmap	Medium	High	Most comprehensive	General purpose
masscan	Very High	Medium	Basic port scan	Large networks
rustscan	High	High	nmap integration	Modern workflows

Timing Templates

Adjust scan speed with timing templates (0-5):

Level	Name	Description
`-T0`	Paranoid	Very slow, IDS evasion
`-T1`	Sneaky	Slow, IDS evasion
`-T2`	Polite	Medium-slow, reduces load
`-T3`	Normal	Default speed
`-T4`	Aggressive	Fast, recommended
`-T5`	Insane	Very fast, may be inaccurate

Example:

bash
nmap -T4 <target>     # Fast scan (recommended)
nmap -T2 <target>     # Slower, more stealthy
nmap -T5 <target>     # Maximum speed (may miss ports)

Script Categories

NSE (Nmap Scripting Engine) script categories:

bash
# Vulnerability detection
nmap --script=vuln <target>

# Auth bypass detection
nmap --script=auth <target>

# Brute force
nmap --script=brute <target>

# Information gathering
nmap --script=discovery,info <target>

Common Port Lists

Reference for common service ports:

Ports	Services
21	FTP
22	SSH
23	Telnet
25	SMTP
53	DNS
80, 8080, 8443	HTTP
110	POP3
135, 139, 445	SMB
143, 993	IMAP
443, 8443	HTTPS
3306	MySQL
3389	RDP
5432	PostgreSQL
5900	VNC
6379	Redis
27017	MongoDB

Resources

Scripts

scripts/parse_nmap_xml.py - Parse nmap XML output to structured JSON format
scripts/masscan_to_nmap.py - Convert masscan results to nmap-compatible format
scripts/merge_scan_results.py - Combine multiple scan result files

References

references/nmap_cheatsheet.md - Comprehensive nmap reference guide
references/masscan_guide.md - Detailed masscan usage documentation
references/rustscan_guide.md - RustScan quick reference
references/scanning_techniques.md - Advanced scanning techniques and evasion methods

Assets

assets/top-1000-ports.txt - Top 1000 common ports list
assets/top-100-ports.txt - Top 100 common ports list
assets/common-services.txt - Common service fingerprint data

Scenario 10: Persistent Storage of Scan Results

When you need to persist port scan results to the database for cross-session analysis and reporting:

bash
# Generate XML scan output
nmap -sV -p- 192.168.1.0/24 -oX scan.xml

# Store to database (flat hierarchy - no subsystem)
python .claude/skills/recon-port-scan/scripts/port_scan_storage.py \
  --xml-file scan.xml

# Store to database with subsystem
python .claude/skills/recon-port-scan/scripts/port_scan_storage.py \
  --xml-file scan.xml \
  --subsystem "External Network"

# Or pipe directly (flat hierarchy)
nmap -sV -p- target.com -oX - | \
  python .claude/skills/recon-port-scan/scripts/port_scan_storage.py

# Or pipe directly (with subsystem)
nmap -sV -p- target.com -oX - | \
  python .claude/skills/recon-port-scan/scripts/port_scan_storage.py \
    --subsystem "DMZ"

Parameters:

--subsystem - Subsystem name (optional, omit for flat hierarchy)
--scan-tool - Scan tool used (default: nmap)
--xml-file - Path to nmap XML file (optional, reads from stdin if not provided)

Database location: ./data/results.db

Related skills: results-storage - Query data, generate reports

Frequently asked questions

What does the Recon Port Scan AI skill do?

Port scanning and service identification using nmap, masscan, and rustscan. Use this skill when user needs to discover open ports, identify running services, detect service versions, or fingerprint operating systems on target hosts.

Why use Recon Port Scan on TypingMind?

Because you install it once and use it with any model. Recon Port Scan is plain Markdown rather than provider-specific code, so the same skill runs on GPT-5, Claude, Gemini, Grok, or a local model — and you can switch model mid-chat without it breaking. TypingMind runs on your own API keys, so you pay providers directly instead of a per-seat subscription, and your skills and chats stay in your own storage.

How do I install Recon Port Scan in TypingMind?

Open Plugins → Skills → Install from GitHub in TypingMind and paste https://github.com/crazyMarky/pentest-skills/tree/main/recon-port-scan. TypingMind reads its SKILL.md and bundles its files and installs it as a skill you can enable per chat.

Which AI models can use Recon Port Scan?

Any model you connect in TypingMind. AI skills are plain Markdown instructions rather than provider-specific code, so GPT, Claude, Gemini, Grok, and local models can all load this skill when a request matches it.

How many AI models can I use with Recon Port Scan?

As many as you like. As long as a model supports skills, you can use Recon Port Scan with it — GPT, Claude, Gemini, Grok, DeepSeek, Mistral, Llama and more — all on TypingMind with your own API keys.

Is the Recon Port Scan AI skill free?

Yes. It is published on GitHub by crazyMarky under the Apache-2.0 license. You only pay your own AI provider for the tokens you use.

What are AI skills?

An AI skill is a reusable instruction bundle that teaches an AI model how to do one specific task. It follows the open Agent Skills format: a SKILL.md file with a name and description, plus any scripts, templates or reference files the model may need. The model reads the instructions only when your request matches the skill, so an installed skill costs nothing until it is used.

How are AI skills different from plugins or MCP servers?

A plugin or MCP server gives a model new tools to call — code that runs somewhere and returns a result. An AI skill gives the model knowledge and process instead: how to approach a task, which steps to follow, what good output looks like. Skills are plain Markdown, so they need no server, no API key and no runtime, and they work with any model.

Overview

Installation

Install in TypingMind

Install in another agent

Use it in TypingMind

Works with any AI model

Skill instructions

Port Scanning / Reconnaissance

Authorization Warning

Prerequisites

Quick Start

Fast Common Port Scan

Full Port Scan with Service Detection

Stealth SYN Scan

High-Speed Large Range Scan

Common Scenarios

Scenario 1: Quick Reconnaissance

Scenario 2: Full Port Range Discovery

Scenario 3: Service Version Detection

Scenario 4: Stealth Scanning

Scenario 5: UDP Port Scanning

Scenario 6: OS Fingerprinting

Scenario 7: High-Speed Mass Scanning

Scenario 8: RustScan (Modern Fast Scanner)

Scenario 9: Output Formats

Tool Selection Guide

Timing Templates

Script Categories

Common Port Lists

Resources

Scripts

References

Assets

Scenario 10: Persistent Storage of Scan Results

Bundled files

Frequently asked questions

Related AI Skills

Set up your own AI workspace now