Nmap-Warrior

Nmap Warrior Python Script

Description

This python script automates the process of identifying live hosts from a specified list or a single target. When additional options are provided, the script extends its functionality to include open port scanning, service version detection, and scanning of the most commonly used UDP ports. Hosts are scanned in parallel, a run can be interrupted and resumed, and all target input is validated and executed without a shell. Designed for cross-platform compatibility, it operates on both Linux and Windows. This script significantly reduces the manual effort required for these tasks, making it an invaluable resource for security professionals seeking to efficiently collect information about hosts within their scope.

What makes this script effective?

It approaches four methods to find live hosts:

• Performs ping scan
• Performs TCP SYN ping scan
• Performs TCP ACK ping scan
• Performs UDP ping scan

Each method only re-probes the hosts that earlier methods left as down, so slower probes are spent only where they are needed.

It provides results in various useful formats:

• xml
• nmap
• gnmap
• Other grabbable formats

Additional Scanning Features:

• Open port scanning.

• Service version detection.

• Scanning of commonly used UDP ports.

• Parallel scanning — multiple hosts scanned at once (-w).

• Graceful interrupt & resume — stop with Ctrl-C and continue later with -r.

• Safe by design — targets are validated and nmap is invoked without a shell, so crafted targets or list entries cannot inject commands.

Installation

To get started, download the script and install the required dependency:

wget https://raw.githubusercontent.com/InfoSecWarrior/Offensive-Pentesting-Scripts/main/Nmap-Warrior/nmap-warrior.py

Install the necessary Python package:

pip3 install colorama

No extra packages are needed on Windows — the Administrator check uses the built-in ctypes module.

Usage

python3 nmap-warrior.py [-t|--target TARGET] [-l|--list LIST] [Options]

Options:

Flag	Description
-t, --target	Specify a target domain, IP address, CIDR range, or IPv6 address.
-l, --list	Provide a file containing a list of target hosts (one per line). Blank lines and # comments are ignored; entries are validated and de-duplicated.
-o, --output	Define an output folder (default: nmap_outputs). Must not already exist unless -r is used.
-s, --silent	Disable banner display.
-p, --portscan	Perform an open port scan (all TCP ports).
-v, --versionscan	Perform service version detection. Requires -p and root/Administrator.
-u, --udpscan	Perform UDP port scans with version detection. Requires root/Administrator.
-w, --workers	Number of hosts to scan in parallel (default: 5, max: 50).
-r, --resume	Continue an interrupted run: reuse the existing output folder and skip hosts already scanned.

Examples

1. Scan a single target:

python3 nmap-warrior.py -t 192.168.1.1

2. Scan multiple targets from a file and save results in a specific directory:

python3 nmap-warrior.py -l targets.txt -o /path/directory

3. Perform a port scan on live hosts, 10 at a time:

python3 nmap-warrior.py -t 192.168.1.0/24 -p -w 10

4. Perform version detection (needs root):

sudo python3 nmap-warrior.py -t 192.168.1.1 -p -v

5. Perform a UDP scan (needs root):

sudo python3 nmap-warrior.py -t 192.168.1.1 -u

6. Resume a scan that was interrupted:

python3 nmap-warrior.py -l targets.txt -p            # Ctrl-C partway through
python3 nmap-warrior.py -l targets.txt -p --resume   # picks up where it stopped

Parallel scanning

Hosts are scanned concurrently using a thread pool. Use -w to set how many run at once (default 5, capped at 50). Each host streams its live nmap output to its own .log file inside the output folder, and the script prints the exact command to watch it, e.g.:

tail -f nmap_outputs/<host>-TCP-Scan.log      # Get-Content -Wait on Windows

Higher -w multiplies your outbound packet rate (each TCP scan uses --min-rate 1000). On a slow or metered link, or against fragile targets, lower -w before anything else.

Interrupting & resuming

• Ctrl-C once stops cleanly: it terminates the running nmap processes, prints how many hosts finished and where the partial results are, and exits. No orphaned scans are left behind.
• Ctrl-C twice force-kills immediately, in case a scan is unresponsive.
• --resume re-runs the same command against the same output folder and skips every host whose scan already completed, rebuilding the aggregate files without duplicates. If the previous run was interrupted during host discovery, discovery is re-run from scratch so no live hosts are missed.

Each per-host scan is bounded by --host-timeout (TCP 30m, version 20m, UDP 15m) so a single filtered host can never stall the whole run. Hosts that hit their timeout are recorded in TIMED-OUT-HOSTS.txt and reported at the end.

Output files

Inside the output folder you'll find:

File	Contents
LIVE-HOSTS.txt / DOWN-HOSTS.txt	Hosts found up / down during discovery.
<host>-TCP-Scan.{nmap,gnmap,xml}	Per-host TCP scan (nmap -oA).
<host>-TCP-Version-Detection.* / <host>-UDP-Version-Detection.*	Per-host version / UDP results.
<host>-*.log	Live nmap output for each host (tailable during the scan).
ALL-HOSTS-TCP-OPEN-PORTS.gnmap	Combined greppable output of every host.
ALL-HOSTS-TCP-OPEN-PORTS.txt	IP:port,port per host.
ALL-HOSTS-TCP-OPEN-PORTS-STD.txt	IP:port, one per line.
ALL-HOSTS-UDP-OPEN-PORTS.gnmap	Combined greppable UDP output of every host (-u).
ALL-HOSTS-UDP-OPEN-PORTS.txt	IP:port,port per host (UDP).
ALL-HOSTS-UDP-OPEN-PORTS-STD.txt	IP:port, one per line (UDP).
TARGETS-CLEAN.txt	Validated, de-duplicated targets from -l.
TIMED-OUT-HOSTS.txt	Hosts whose scan hit the per-host timeout.

The aggregate files are updated as each host finishes, so you can watch results accumulate during the run rather than waiting for the end. The UDP aggregates mirror the TCP ones and record only ports nmap marks strictly open (open|filtered, which nmap could not confirm, is excluded).

Prerequisites

• Python 3.7+
• Nmap
• colorama (pip3 install colorama)
• root / Administrator — required for -v (version/OS detection) and -u (UDP scan)
• Notify (optional) — for push notifications via ProjectDiscovery notify

IPv6: individual IPv6 targets are scanned (the -6 flag is added automatically). Discovering a mixed IPv4/IPv6 list in one run is not supported — scan each family separately.