nmap enumeración interna

nmap -sV -sC -Pn -p- --min-rate=1000 <internal_cidr>

Full TCP scan (all ports) and service fingerprinting against an internal network range.

Initial internal reconnaissance phase after foothold, to discover live hosts, services, and versions. This command assumes you are inside the network with access to the CIDR, without needing ping (-Pn). You use it to map the entire internal infrastructure in a single pass.

Never run this on a large internal network without explicit authorization from the client's blue team; it is extremely noisy and will saturate logs on all firewalls, IDS, and network monitoring systems. If the engagement is stealthy, replace it with a scan of common ports and then targeted scans.