>>107642296
>why does the nmap ping scan run faster on WSL (Windows Subsystem for Linux)
Probably because the ping binary on that system is lighter, or because WSL gets allocated more resources, or both. You could decisively answer this by using some mix and match logic.
>how to discover more hosts with nmap continued from >>107642718
-PS/PA/PU/PY[portlist]: TCP SYN/ACK, UDP or SCTP discovery to given ports
-PE/PP/PM: ICMP echo, timestamp, and netmask request discovery probes
-PO[protocol list]: IP Protocol Ping
-n/-R: Never do DNS resolution/Always resolve [default: sometimes]
--dns-servers <serv1[,serv2],...>: Specify custom DNS servers
--system-dns: Use OS's DNS resolver
Also you could try a different type of scan. Assume your permissions are low, you'd probably still want the -sT TCP connect scan rather than a ping scan. The portlist thing might be a good way to get more results, if you can figure out which ports you should be scanning.
>firewall evasion
Comment too long. Click here to view the full text.