Using nmap to scan for DDOS reflectors

nmap -sU -A -PN -n -pU:19,53,123,161 -script=ntp-monlist,dns-recursion,snmp-sysdescr <target>

- ntp-monlist -> while any open NTP service can be used in a reflective DDOS attack the maximum amplification is achieved with NTP services that permit the monlist command to be executed. This script will do a check to see if monlist can be executed against an open NTP port.

- dns-recursion -> Normally public DNS servers will only answer DNS queries for which they are authoritative. A DNS server that permits and processes queries for names it is not authoritative are called recursive DNS servers and recursive DNS servers in most cases are misconfigured.

- nmp-sysdescr -> attempts to extract more information from the SNMP service.

- With the snmp-sysdescr script it will usually display more information which may tell you more about the device you are scanning