Question

During an internal engagement, you run Nmap against a /24 subnet and export the results with the -oX flag to results.xml. Your team lead asks you to quickly produce a clean list of only the hosts that have TCP port 3389 open, so it can be fed into a follow-up RDP audit script. Which approach most efficiently produces this filtered list from the existing scan output?

Accepted Answer

Convert the XML output to a grepable format (or parse it) and extract addresses where port 3389 shows state 'open', for example using nmap -oG or a script that reads the XML and filters on port/state

Answer

Re-run Nmap with -p 3389 --open across the subnet and manually copy the results into a text file

Answer

Open results.xml in a browser and visually scan each host block for the 3389 entry, pasting matches by hand

Answer

Import results.xml into Nessus and rely on its RDP plugin to regenerate the host list