Open Ports

nmap -sS -p- --open --min-rate 10000 <target> | tee nmap/nmap_open_ports_TCP
nmap -sU -p- --open --min-rate 10000 <target> | tee nmap/nmap_open_ports_UDP

Extract Open Ports → File

cat nmap/nmap_open_ports_TCP | grep ' open ' | awk -F"/" '{print $1}' | paste -sd, > nmap/open_ports_TCP
cat nmap/nmap_open_ports_UDP | grep ' open ' | awk -F"/" '{print $1}' | paste -sd, > nmap/open_ports_UDP

Service Scans (using extracted ports)

nmap -sV -sC -p$(cat nmap/open_ports_TCP) <target> | tee nmap/nmap_service_scan_TCP
nmap -sU -sV -sC -pU:$(cat nmap/open_ports_UDP) --min-rate 10000 <target> | tee nmap/nmap_service_scan_UDP

SMB Scripts

See SMB Enumeration for smb-enum-users/groups/shares, smb-os-discovery, smb-vuln-* one-liners.