ToolsPort Scanner
networkSlow

Port Scanner

Network Mapping & Open Port Scanner

"High-speed network discovery, service fingerprinting, and attack surface mapping."

▶ Scan with Port Scanner
Overview

Port Scanner is Pentoolkit's primary network discovery engine. It sends crafted probes to discover which ingress ports are open on a target, what services are running on those ports, and which versions of those services are installed. From a single IP address to a full /16 network range, Port Scanner gives you a complete picture of what's exposed.

PTK exposes 10 different scan types — from a fast top-100-ports sweep to a deep full-port scan with script execution and OS detection. Each scan type produces structured findings with port numbers, service names, version strings, and CVE matches when a vulnerable version is detected.

Use Port Scanner as the first tool on any new target. Its findings tell you what attack surface exists before running deeper tools like Vulnerability Scanner or Web Scanner.

Scan options
OptionDescriptionEst. time
fast
Top 100 most common ports, fast timing
~2 min/host
shortDEFAULT
Top 1000 ports + service/version detection
~5 min/host
deep
All 65535 ports, scripts, OS detection
~16 min/host
stealth
SYN scan — less likely to be loggedRequires root
~3 min/host
decoy
Scan with randomized decoy IPsRequires root
~3 min/host
udp
UDP port scan (often skipped, very valuable)Requires root
~10 min/host
version-intense
Full version detection intensity
~8 min/host
script-vuln
Run vulnerability scripts on open ports
~10 min/host
discovery
Host discovery only — no port scan
~1 min/host
slow
Paranoid timing — IDS/IPS evasion
~20 min/host
Example findings
CRITICALPort 22 — SSH Exposed to 0.0.0.0/0
HIGHPort 3306 — MySQL Exposed Without Authentication
HIGHOpenSSH 7.9 — CVE-2023-38408 Remote Code Execution
MEDIUMPort 8080 — HTTP Admin Interface Accessible
What it discovers
  • Open ports exposing services to the internet
  • Service names and version strings (nginx 1.18.0, OpenSSH 7.9, etc.)
  • Outdated service versions with known CVEs
  • Operating system fingerprints
  • Firewall rules and filtered port behavior
  • UDP services (DNS, SNMP, RDP, TFTP)