> For the complete documentation index, see [llms.txt](https://docs.qu35t.pw/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.qu35t.pw/nmap.md).

# Nmap

Nmap is a free and open source tool used for vulnerability checking, port scanning and, of course, network mapping.

## Target

{% tabs %}
{% tab title="Scan a single IP" %}

```bash
nmap 10.10.10.10
```

{% endtab %}

{% tab title="Scan a range of IPs" %}

```bash
nmap 10.10.10.1-20
```

{% endtab %}

{% tab title="Scan a subnet" %}

```bash
nmap 10.10.10.0/24
```

{% endtab %}

{% tab title="Scan from a file" %}

```bash
nmap -iL list-of-ips.txt
```

{% endtab %}
{% endtabs %}

### Ports Scan <a href="#ports-scan" id="ports-scan"></a>

{% tabs %}
{% tab title="Scan a single port" %}

```bash
nmap -p 22 10.10.10.10
```

{% endtab %}

{% tab title="Scan a range of ports" %}

```bash
nmap -p 1-100 10.10.10.10
```

{% endtab %}

{% tab title="Scan 100 most common ports (Fast)" %}

```bash
nmap -F 10.10.10.10
```

{% endtab %}

{% tab title="Scan all 65535 ports" %}

```bash
nmap -p- 10.10.10.10
```

{% endtab %}
{% endtabs %}

### Scan Types <a href="#scan-types" id="scan-types"></a>

{% tabs %}
{% tab title="Treat all hosts as online" %}

```bash
nmap -Pn 10.10.10.10
```

{% endtab %}

{% tab title="Scan using TCP connect" %}

```bash
nmap -sT 10.10.10.10
```

{% endtab %}

{% tab title="Scan using TCP SYN scan (default)" %}

```bash
nmap -sS 10.10.10.10
```

{% endtab %}

{% tab title="Scan UDP ports" %}

```bash
nmap -sU 10.10.10.10
```

{% endtab %}
{% endtabs %}

### Services & OS Detection <a href="#services-os-detection" id="services-os-detection"></a>

{% tabs %}
{% tab title="Detect OS and Services (Aggressive)" %}

```bash
nmap -A 10.10.10.10
```

{% endtab %}

{% tab title="Scripts Scan" %}

```bash
nmap -sC 10.10.10.10
```

{% endtab %}

{% tab title="Service Version Detection" %}

```bash
nmap -sV 10.10.10.10
```

{% endtab %}
{% endtabs %}

### Output Formats <a href="#output-formats" id="output-formats"></a>

{% tabs %}
{% tab title="Save default output to file" %}

```bash
nmap -oN target.txt 10.10.10.10
```

{% endtab %}

{% tab title="Save results as XML" %}

```bash
nmap -oX target.xml 10.10.10.10
```

{% endtab %}

{% tab title="Save results in a format for grep" %}

```bash
nmap -oG target.txt 10.10.10.10
```

{% endtab %}

{% tab title="Save in all formats" %}

```bash
nmap -oA nmap/target 10.10.10.10
```

{% endtab %}
{% endtabs %}

### Scripts <a href="#scripts" id="scripts"></a>

{% tabs %}
{% tab title="Scan using default scripts" %}

```bash
nmap -sC -sV 10.10.10.10
```

{% endtab %}

{% tab title="Get help for a script" %}

```bash
nmap --script-help=ssl-heartbleed
```

{% endtab %}

{% tab title="Scan using a specific NSE script" %}

```bash
nmap -–script=ssl-heartbleed.nse 10.10.10.10
```

{% endtab %}

{% tab title="Scan with a set of scripts" %}

```bash
nmap --script=smb* 10.10.10.10
```

{% endtab %}
{% endtabs %}

## IPS / IDS Evasion

{% tabs %}
{% tab title="Decoys" %}
Scan by using Decoys.

```bash
nmap 10.10.10.10 -p 80 -sS -Pn -n --disable-arp-ping --packet-trace -D RND:5
```

Scan by using different source IP.

```bash
nmap 10.10.10.10 -n -Pn -p 445 -O -S 10.129.2.200 -e tun0
```

{% endtab %}

{% tab title="DNS proxying" %}
SYN-Scan from DNS port.

```bash
nmap 10.10.10.10 -p 50000 -sS -Pn -n --disable-arp-ping --packet-trace --source-port 53
```

SYN-Scan of a filtered port.

```bash
nmap 10.10.10.10 -p 50000 -sS -Pn -n --disable-arp-ping --packet-trace
```

{% endtab %}
{% endtabs %}

## References

* [Hacktricks - Tcp Port Discovery](https://book.hacktricks.xyz/generic-methodologies-and-resources/pentesting-network#tcp-port-discovery)
* [Hacktricks - Udp Port Discovery](https://book.hacktricks.xyz/generic-methodologies-and-resources/pentesting-network#udp-port-discovery)
* [Stationx - CheatSheet](https://www.stationx.net/nmap-cheat-sheet/)
* [Nmap - Official Website](https://nmap.org/)
* [Hackertarget - CheatSheet](https://hackertarget.com/nmap-cheatsheet-a-quick-reference-guide/)