Nmap

Nmap is a free and open source tool used for vulnerability checking, port scanning and, of course, network mapping.

Target

Scan a single IP

nmap 10.10.10.10

Scan a range of IPs

nmap 10.10.10.1-20

Scan a subnet

nmap 10.10.10.0/24

Scan from a file

nmap -iL list-of-ips.txt

Ports Scan

Scan a single port

nmap -p 22 10.10.10.10

Scan a range of ports

nmap -p 1-100 10.10.10.10

Scan 100 most common ports (Fast)

nmap -F 10.10.10.10

Scan all 65535 ports

nmap -p- 10.10.10.10

Scan Types

Treat all hosts as online

nmap -Pn 10.10.10.10

Scan using TCP connect

nmap -sT 10.10.10.10

Scan using TCP SYN scan (default)

nmap -sS 10.10.10.10

Scan UDP ports

nmap -sU 10.10.10.10

Services & OS Detection

Detect OS and Services (Aggressive)

nmap -A 10.10.10.10

Scripts Scan

nmap -sC 10.10.10.10

Service Version Detection

nmap -sV 10.10.10.10

Output Formats

Save default output to file

nmap -oN target.txt 10.10.10.10

Save results as XML

nmap -oX target.xml 10.10.10.10

Save results in a format for grep

nmap -oG target.txt 10.10.10.10

Save in all formats

nmap -oA nmap/target 10.10.10.10

Scripts

Scan using default scripts

nmap -sC -sV 10.10.10.10

Get help for a script

nmap --script-help=ssl-heartbleed

Scan using a specific NSE script

nmap -–script=ssl-heartbleed.nse 10.10.10.10

Scan with a set of scripts

nmap --script=smb* 10.10.10.10

IPS / IDS Evasion

Decoys

Scan by using Decoys.

nmap 10.10.10.10 -p 80 -sS -Pn -n --disable-arp-ping --packet-trace -D RND:5

Scan by using different source IP.

nmap 10.10.10.10 -n -Pn -p 445 -O -S 10.129.2.200 -e tun0

DNS proxying

SYN-Scan from DNS port.

nmap 10.10.10.10 -p 50000 -sS -Pn -n --disable-arp-ping --packet-trace --source-port 53

SYN-Scan of a filtered port.

nmap 10.10.10.10 -p 50000 -sS -Pn -n --disable-arp-ping --packet-trace

References

• Hacktricks - Tcp Port Discovery

• Hacktricks - Udp Port Discovery

• Stationx - CheatSheet

• Nmap - Official Website

• Hackertarget - CheatSheet