Nmap Fundamentals Cheat Sheet
Nmap Fundamentals Cheat Sheet
🔍 Basic Scanning
Scan a target:
nmap [target]Exclude a host:
nmap --exclude [excluded_ip] [target]Use custom DNS servers:
nmap --dns-servers [DNS1],[DNS2] [target]Scan without pinging:
nmap -Pn [target]Scan without DNS resolution:
nmap -n [target]Scan a specific port:
nmap -p80 [target]Scan an IPv6 target:
nmap -6 [target]
📦 Scanning Port Ranges
Scan specific ports:
nmap -p 80,443,23 [target]Scan a port range:
nmap -p 1-100 [target]Scan all ports:
nmap -p- [target]Scan by protocol (TCP/UDP):
nmap -p T:25,U:53 [target]Scan by service name:
nmap -p smtp [target]Scan service name wildcards:
nmap -p smtp* [target]Scan all registered ports:
nmap -p 1-65535 [target]
🌐 Scanning Large Networks
Fast scan with minimal checks:
nmap -T4 -n -Pn -p- [target]
Timing Templates
No ping:
-PnNo reverse DNS:
-nNo port scan (host discovery only):
-snSlow scan (least aggressive):
-T0or-T1Normal scan:
-T3Fast scan (recommended):
-T4Very aggressive (not recommended):
-T5
⚙️ Nmap Specific Options
Select network interface:
nmap -e [interface] [target]Save output as text:
nmap -oN [filename] [target]Save output as XML:
nmap -oX [filename] [target]Save all formats:
nmap -oA [filename] [target]Show scan stats periodically:
nmap --stats-every [time] [target]
📡 Host Discovery (Ping Scans)
Default ping scan:
nmap -sP [target]TCP SYN ping scan:
nmap -sP -PS [target]TCP SYN ping on specific port:
nmap -sP -PS80 [target]Ping without ARP:
nmap -sP --send-ip [target]IP protocol ping scan:
nmap -sP -PO [target]ARP scan:
nmap -sP -PR [target]
🧬 Service & OS Fingerprinting
Detect service versions:
nmap -sV [target]Set version scan intensity:
nmap -sV --version-intensity 9 [target]Troubleshoot version scan:
nmap -sV --version-trace [target]Aggressive scan (OS + services + scripts):
nmap -A [target]RPC scan:
nmap -sR [target]Detect operating system:
nmap -O [target]Guess OS with full port scan:
nmap -O -p- --osscan-guess [target]Verbose OS detection:
nmap -O -v [target]
📜 Protocol & Firewall Detection
List supported IP protocols:
nmap -sO [target]Detect stateful firewalls (TCP ACK scan):
nmap -sA [target]
🧠 Nmap Scripting Engine (NSE)
Run a specific script:
nmap --script [script.nse] [target]Run scripts by category:
nmap --script [category] [target]Troubleshoot a script:
nmap --script [script] --script-trace [target]Update script database:
nmap --script-updatedb
Script Categories:
auth, broadcast, dos, default, discovery, external, intrusive, malware, safe, version, vuln
🧪 Nmap Examples
Detect service versions and OS:
nmap -sV -O [target]Detect web servers:
nmap -sV --script http-title [target]Scan top 10 common ports:
nmap --top-ports 10 [target]Discover hosts via broadcast ping:
nmap --script broadcast-pingGet WHOIS info:
nmap --script whois [target]Brute-force DNS records:
nmap --script dns-brute [target]MAC address spoofing scan:
nmap -v -sT -PN --spoof-mac [MAC] [target]Run all vulnerability scripts:
nmap -sV --script vuln [target]Run version and discovery scripts:
nmap -sV --script="version,discovery" [target]Detect sniffers:
nmap -sP --script sniffer-detect [target]
Comments
Post a Comment