nmap -sV -sC

nmap -sV -sC -oN scan.txt <target>

TCP scan with service version detection and default NSE script execution against an authorized target.

Initial active reconnaissance phase when you already have explicit client authorization. It maps which services are running, at what exact version, and applies the ~600 default NSE scripts that surface weak configurations, default credentials, and known CVEs without having to execute exploits.

When stealth matters more than speed. This command triggers alerts on any minimally configured IDS due to the volume of simultaneous connections to multiple ports. The NSE scripts touch services in a detectable way — an HTTP banner grab with user-agent 'Nmap NSE' shows up in any decent web application log. If you're in an engagement that evaluates detection, your path starts and ends here.