NMAP

Host Port Enumeration

1 Find all open ports

nmap -p- --min-rate 1000 -T4 -oA allport_scan --open <target> 

2 Scan found ports

Get found ports from previous scan:

cat allport_scan.nmap | grep open | cut -d '/' -f1 | grep -v '#' | tr '\n' ','

nmap -p80,22 -sC -sV -oA full_scan <target>