Parsing Output

Tools produce walls of text. The skill that makes a recon script useful is parsing - extracting just the IPs, ports, or hostnames you care about.

This lesson focuses on grep and cut, with sort and uniq for cleanup.

Start by keeping only the relevant lines. To pull open ports from Nmap output, grep for the word open.

grep -o prints only the matching part of each line, not the whole line. Combined with a regex it extracts precise tokens like IP addresses.

cut slices each line into fields by a delimiter and prints the ones you choose. To take a port number from 80/tcp open http, cut on the slash.

cut can also slice by character range with -c, useful for fixed-width output.

Pipe grep into cut to extract exactly one column from filtered lines - for example, all open port numbers.

sort orders lines and uniq removes adjacent duplicates (so sort first). Add -c to count occurrences.

Nmap's greppable format (-oG) is built for this. Each host is one line, easy to slice for live hosts.

When cut is not enough, sed substitutes patterns and tr translates or deletes characters - for example turning commas into newlines.

Put it together: extract live IPs, dedupe, and write a clean file the next tool can consume.

When you need logic plus columns, awk combines them. Here it prints only ports above 1023 from a parsed list.

Pick the right field extractor.

You learned to parse tool output into usable data:

• grep (and -o) filters and extracts matches.
• cut slices fields by delimiter or character position.
• sort | uniq -c orders, dedupes, and counts.
• Chain them to produce clean target lists for the next tool.

Next: building a complete recon tool.