Nmap scan output for other nmap scan

Question

I was wondering if it was possible to output the result of a nmap scan (>, oN/-oX/-oS/-oG, or an other way) in a way that I would be able to import the results for another nmap scan.

For example, first scan is a ping scan, it outputs the results in a file. Later I decide to do a SYN scan for each of the hosts that was alive (in the first scan). Is there a way for this? Do I have to make a script that would do this task? Thanks

Answer 1

Nmap's -iL option will take as input a file with one target specification per line. If you are using -oA or -oG, you can quickly grab this from the grepable output of a prior scan result using awk:

nmap -sn 192.0.2.0/24 -oA previous
awk '/Status: Up/{print $2}' previous.gnmap > targets.txt
nmap -Pn -iL targets.txt

The same info can be pulled from other output formats, but use the tools that are appropriate and available to you. Also remember that a host's state can change over time, so using -Pn to skip host discovery in the second nmap command above would not be recommended if a day or more elapsed between scans.

Answer 2

You will need to run a script to modify the output file to just the IPs in the format that the -iL parameter will accept (spaces between or newlines).

Man page: https://nmap.org/book/man-target-specification.html

Answer 3

Schroeder answered your question to chain/append/add from a previous scan, so I will ask: Is there a specific reason you are solely relying on "ping" for determining whether or not a system is up? Doing so (using ping) can leave you blind to devices that do not respond to ping. I prefer to use arp-scan to determine what is live, and work from there. However, if you want something to do what you'd like, you're better off writing a shell script. If you're running DHCP in your network, chances are there is either more or less.

nmap -sP 10.10.10.0/24 | awk '/report/{print "nmap -sS -Pn -vvv -oX myoutput.xml "$5}' | sh

Explained:

• nmap -sP 10.10.10.0/24 scan the 10.10.10.0 block
• grep (using awk) the word report then reprint "nmap -sS -Pn -vvv -oX myoutput.xml against hosts that are alive
• run

Personally, I don't rely on ping.