Scan Templates

Scan templates provide pre-configured scanning scenarios for common use cases. Templates combine port specifications, scan types, timing settings, and detection options into reusable configurations accessible via the --template flag.

Quick Start

# List all available templates
prtip --list-templates

# Use a built-in template
prtip --template web-servers 192.168.1.0/24

# Show template details before using
prtip --show-template stealth

# Override template settings with CLI flags
prtip --template stealth -T4 192.168.1.1  # Use stealth template but with T4 timing

Built-in Templates

ProRT-IP includes 10 built-in templates optimized for common scanning scenarios:

web-servers

Scan common web server ports with service and TLS certificate detection.

Use Case: Discovering web applications, identifying web frameworks, analyzing SSL/TLS configurations.

# Basic web server scan
prtip --template web-servers 10.0.0.0/24

# Web scan with verbose output
prtip --template web-servers -v 192.168.1.0/24

# Web scan with JSON output
prtip --template web-servers -oJ results.json target.com

databases

Scan common database ports including MySQL, PostgreSQL, MongoDB, Redis, MSSQL, CouchDB, and Cassandra.

Use Case: Database discovery, identifying exposed database services, inventory auditing.

# Database discovery scan
prtip --template databases 192.168.1.0/24

# Database scan with service version detection
prtip --template databases -sV db-servers.txt

Port Reference:

quick

Fast scan of top 100 most common ports without service detection.

Use Case: Rapid network reconnaissance, initial host enumeration, large network sweeps.

# Quick scan of a network
prtip --template quick 10.0.0.0/8

# Quick scan with output to file
prtip --template quick -oN quick-results.txt 192.168.0.0/16

thorough

Comprehensive scan of all 65,535 ports with service and OS detection.

Use Case: Complete host analysis, penetration testing, comprehensive security assessments.

# Thorough scan of a single host
prtip --template thorough target.com

# Thorough scan with all output formats
prtip --template thorough -oA full-scan target.com

Warning: Thorough scans take significantly longer. For a single host, expect 10-30 minutes depending on network conditions.

stealth

Evasive scanning to minimize detection using FIN scan, slow timing, randomization, and packet fragmentation.

Use Case: Penetration testing, IDS/IPS evasion testing, stealth reconnaissance.

# Stealth scan
prtip --template stealth -p 22,80,443 target.com

# Stealth scan with decoys
prtip --template stealth -D RND:5 target.com

Note: FIN scans may not work against all systems. Windows hosts and some firewalls don't respond to FIN packets as expected per RFC 793.

discovery

Host discovery only using ICMP ping without port scanning.

Use Case: Network mapping, identifying live hosts, pre-scan reconnaissance.

# Discover live hosts
prtip --template discovery 192.168.1.0/24

# Discovery with specific output
prtip --template discovery -oG live-hosts.gnmap 10.0.0.0/8

ssl-only

Scan HTTPS and other TLS-enabled ports with certificate analysis.

Use Case: SSL/TLS security assessments, certificate inventory, encryption compliance audits.

# SSL certificate scan
prtip --template ssl-only target.com

# SSL scan with verbose certificate details
prtip --template ssl-only -v --tls-details target.com

Port Reference:

admin-panels

Scan remote administration ports including SSH, Telnet, RDP, VNC, and management interfaces.

Use Case: Administrative access discovery, remote management auditing, attack surface assessment.

# Admin panel discovery
prtip --template admin-panels 192.168.1.0/24

# Admin scan with service version detection
prtip --template admin-panels -sV internal-servers.txt

Port Reference:

mail-servers

Scan email server ports including SMTP, IMAP, POP3, and their secure variants.

Use Case: Email infrastructure discovery, mail server inventory, email security assessments.

# Mail server discovery
prtip --template mail-servers mx-records.txt

# Mail scan with verbose output
prtip --template mail-servers -v mail.example.com

Port Reference:

file-shares

Scan file sharing protocols including FTP, SFTP, SMB, NFS, and rsync.

Use Case: File share discovery, network storage auditing, data exfiltration risk assessment.

# File share discovery
prtip --template file-shares 192.168.1.0/24

# File share scan with greppable output
prtip --template file-shares -oG shares.gnmap internal-network.txt

Port Reference:

Custom Templates

Create custom templates in ~/.prtip/templates.toml to define reusable scanning configurations tailored to your environment.

Template Configuration Format

[my-template-name]
description = "Human-readable description of the template"
ports = [80, 443, 8080]           # Optional: specific ports to scan
scan_type = "SYN"                 # Optional: SYN, Connect, UDP, FIN, NULL, Xmas, ACK, Idle
service_detection = true          # Optional: enable service detection
os_detection = false              # Optional: enable OS fingerprinting
timing = "T3"                     # Optional: T0-T5 timing template
max_rate = 1000                   # Optional: maximum packets per second
randomize = false                 # Optional: randomize port/target order
fragment = false                  # Optional: enable packet fragmentation
tls_analysis = false              # Optional: enable TLS certificate analysis
discovery_only = false            # Optional: host discovery only (no port scan)

Example Custom Templates

# ~/.prtip/templates.toml

# Internal network scan with company-specific ports
[internal-services]
description = "Scan internal company services"
ports = [80, 443, 8080, 8443, 9200, 9300, 5601, 3000, 8081, 8082]
scan_type = "Connect"
service_detection = true
timing = "T4"

# IoT device discovery
[iot-devices]
description = "Scan common IoT and embedded device ports"
ports = [80, 443, 23, 8080, 8443, 554, 1883, 8883, 5683]
scan_type = "SYN"
service_detection = true
timing = "T3"
tls_analysis = true

# High-speed reconnaissance
[speed-scan]
description = "Maximum speed network sweep"
scan_type = "SYN"
service_detection = false
timing = "T5"
max_rate = 100000

# Ultra-stealth assessment
[ultra-stealth]
description = "Minimal footprint stealth scan"
scan_type = "FIN"
timing = "T0"
max_rate = 10
randomize = true
fragment = true

Using Custom Templates

# Use custom template
prtip --template internal-services 10.0.0.0/8

# List all templates (built-in + custom)
prtip --list-templates

# Show custom template details
prtip --show-template internal-services

Template Inheritance

Custom templates with the same name as built-in templates override the built-in version:

# Override the built-in web-servers template
[web-servers]
description = "Custom web servers scan with additional ports"
ports = [80, 443, 8080, 8443, 3000, 5000, 8000, 8888, 9000, 9443]
scan_type = "SYN"
service_detection = true
tls_analysis = true
timing = "T4"  # Faster than default T3

Template Validation

Templates are validated when loaded. Invalid configurations will produce clear error messages:

$ prtip --template invalid-template
Error: Invalid custom template 'invalid-template' in ~/.prtip/templates.toml
  Caused by: Invalid scan_type 'INVALID': must be one of SYN, Connect, UDP, FIN, NULL, Xmas, ACK, Idle

Validation Rules

Testing Templates

Validate your custom templates before using them:

# Show template details (validates the template)
prtip --show-template my-custom-template

# Dry run with verbose output
prtip --template my-custom-template -v --dry-run 192.168.1.1

Template Override Behavior

CLI flags override template settings. This allows fine-tuning template behavior:

# Use stealth template but with T3 timing instead of T1
prtip --template stealth -T3 target.com

# Use web-servers template but add additional ports
prtip --template web-servers -p 80,443,8080,9000,9443 target.com

# Use thorough template but with faster timing
prtip --template thorough -T4 --max-rate 10000 target.com

Override Priority: CLI flags > Custom templates > Built-in templates > Defaults

Performance Characteristics

Note: Times are approximate and depend on network conditions, target responsiveness, and system resources.

CI/CD Integration

Templates integrate well with automated security pipelines:

# GitHub Actions example
- name: Scan web servers
  run: |
    prtip --template web-servers -oJ results.json ${{ env.TARGET }}

- name: Check for critical findings
  run: |
    jq '.ports[] | select(.state == "open")' results.json

# Jenkins/Shell script example
#!/bin/bash
TARGETS="192.168.1.0/24"
prtip --template databases -oG databases.gnmap $TARGETS
prtip --template admin-panels -oG admin.gnmap $TARGETS
prtip --template file-shares -oG shares.gnmap $TARGETS

# Parse results
grep "open" *.gnmap > all-open-ports.txt

See Also

• Configuration Guide - Global configuration options
• CLI Reference - Complete command-line reference
• Basic Usage - Getting started with scanning
• Timing Templates - T0-T5 timing details
• Evasion Techniques - Stealth scanning methods

Last Updated: 2025-11-21 ProRT-IP Version: v0.5.4