View Categories

Nmap cheat sheet

5

Nmap Cheat Sheet: From Beginner to Expert Pentesters

Basic Scanning #

  • Scan a single host:bashCopyEditnmap 192.168.1.1
  • Scan multiple hosts:bashCopyEditnmap 192.168.1.1 192.168.1.2 192.168.1.3
  • Scan a subnet:bashCopyEditnmap 192.168.1.0/24
  • Scan a range of IPs:bashCopyEditnmap 192.168.1.1-100
  • Scan a domain:bashCopyEditnmap example.com

Port Scanning #

  • Scan common ports (default):bashCopyEditnmap -F 192.168.1.1
  • Scan specific ports:bashCopyEditnmap -p 22,80,443 192.168.1.1
  • Scan all 65,535 ports:bashCopyEditnmap -p- 192.168.1.1
  • Scan UDP ports:bashCopyEditnmap -sU -p 53,161 192.168.1.1
  • Scan top 1000 ports faster:bashCopyEditnmap --top-ports 100 192.168.1.1

Advanced Scanning #

  • Service and version detection:bashCopyEditnmap -sV 192.168.1.1
  • OS detection:bashCopyEditnmap -O 192.168.1.1
  • Aggressive scan (OS, version, scripts, traceroute):bashCopyEditnmap -A 192.168.1.1
  • Scan with NSE (Nmap Scripting Engine):bashCopyEditnmap --script=vuln 192.168.1.1

Firewall Evasion & Stealth Scanning #

  • Fragment packets to bypass IDS/IPS:bashCopyEditnmap -f 192.168.1.1
  • Randomize scan order:bashCopyEditnmap -r 192.168.1.1
  • Decoy scan (confuses IDS):bashCopyEditnmap -D RND:10 192.168.1.1
  • Scan with spoofed source IP:bashCopyEditnmap -S 192.168.1.100 192.168.1.1
  • Scan using a fake MAC address:bashCopyEditnmap --spoof-mac 00:11:22:33:44:55 192.168.1.1
  • Idle scan (completely stealthy):bashCopyEditnmap -sI zombie_host 192.168.1.1

Bypassing Firewalls #

  • Use NULL scan (no TCP flags):bashCopyEditnmap -sN 192.168.1.1
  • Use FIN scan:bashCopyEditnmap -sF 192.168.1.1
  • Use XMAS scan:bashCopyEditnmap -sX 192.168.1.1
  • Use slow scan to avoid detection:bashCopyEditnmap -T2 192.168.1.1
  • Use an HTTP proxy to scan:bashCopyEditnmap --proxies http://proxy:8080 192.168.1.1

NSE (Nmap Scripting Engine) #

  • Detect vulnerabilities:bashCopyEditnmap --script=vuln 192.168.1.1
  • Check for SMB vulnerabilities:bashCopyEditnmap --script=smb-vuln* 192.168.1.1
  • Run multiple scripts:bashCopyEditnmap --script=http-enum,ftp-anon 192.168.1.1
  • Scan for CVE exploits:bashCopyEditnmap --script=vulners 192.168.1.1

Network Mapping & Host Discovery #

  • List live hosts (no port scan):bashCopyEditnmap -sn 192.168.1.0/24
  • Find open ports without pinging first:bashCopyEditnmap -Pn 192.168.1.1
  • Traceroute with Nmap:bashCopyEditnmap --traceroute 192.168.1.1

Saving and Exporting Results #

  • Save output in normal format:bashCopyEditnmap -oN output.txt 192.168.1.1
  • Save output in XML format:bashCopyEditnmap -oX output.xml 192.168.1.1
  • Save output in all formats:bashCopyEditnmap -oA scan_results 192.168.1.1
  • View Nmap XML output in a readable format:bashCopyEditcat output.xml | xsltproc -o output.html

Scan Timing and Performance #

  • Scan as fast as possible:bashCopyEditnmap -T5 192.168.1.1
  • Paranoid scan (avoiding detection):bashCopyEditnmap -T0 192.168.1.1
  • Aggressive scan (faster but noisy):bashCopyEditnmap -T4 192.168.1.1

Evading Intrusion Detection Systems (IDS) #

  • Use random port scanning:bashCopyEditnmap -p- -T2 --randomize-hosts 192.168.1.1
  • Scan with minimum packets per second:bashCopyEditnmap --min-rate 10 192.168.1.1

Detecting Honeypots #

  • Check for honeypots:bashCopyEditnmap --script=honeypot-detect 192.168.1.1

Brute-Forcing with NSE #

  • Brute force SSH login:bashCopyEditnmap --script=ssh-brute -p 22 192.168.1.1
  • Brute force HTTP authentication:bashCopyEditnmap --script=http-brute -p 80 192.168.1.1
  • Brute force MySQL login:bashCopyEditnmap --script=mysql-brute -p 3306 192.168.1.1

Related Docs