Networking · Port Scanning · Penetration Testing
Nmap
Cheatsheet
A comprehensive reference for Nmap (Network Mapper) — covering scan types, flags, output formats, NSE scripts, firewall evasion, and real-world examples with quiz and slideshow.
What is Nmap?
Nmap (Network Mapper) is a free, open-source network discovery and security auditing tool created by Gordon "Fyodor" Lyon in 1997. It is the industry standard for network reconnaissance.
What it does: Discovers hosts on a network, determines what services (ports) are open, identifies operating systems, and detects firewall rules — using raw IP packets.
Real-world use: Network inventory, vulnerability scanning, security audits, penetration testing, and CTF challenges. Essential for CEH, OSCP, and CompTIA PenTest+ certifications.
⚠️ Legal Warning: Only scan systems you own or have explicit written permission to scan. Unauthorised scanning may violate computer crime laws including the Computer Fraud and Abuse Act (US) and Computer Misuse Act (UK). Always obtain written authorisation before scanning.
1. Basic Scans
# Default scan (top 1000 ports, SYN if root, Connect if not) nmap 192.168.1.1 nmap 192.168.1.0/24 # scan entire subnet nmap 10.0.0.1-50 # range of IPs nmap -iL targets.txt # scan from file # Specific ports nmap -p 80 192.168.1.1 # single port nmap -p 80,443,8080 192.168.1.1 # multiple ports nmap -p 1-1000 192.168.1.1 # port range nmap -p- 192.168.1.1 # ALL 65535 ports nmap --top-ports 100 192.168.1.1 # top 100 common ports
2. Scan Types
| Flag | Scan Type | Notes |
|---|---|---|
| -sS | TCP SYN Scan (Stealth) | Default when root. Sends SYN, doesn't complete handshake. Fast and less detectable. |
| -sT | TCP Connect Scan | Default without root. Completes full TCP handshake. More detectable, logged. |
| -sU | UDP Scan | Scans UDP ports. Slow but essential — DNS(53), DHCP(67), SNMP(161) are UDP. |
| -sA | TCP ACK Scan | Maps firewall rules — determines filtered vs unfiltered ports. |
| -sN | TCP Null Scan | No flags set. Can bypass some firewalls. Open ports don't respond. |
| -sF | FIN Scan | Sends FIN flag. Works on RFC-compliant systems. Bypasses some firewalls. |
| -sX | Xmas Scan | Sets FIN, PSH, URG flags — "lit up like a Christmas tree". |
| -sW | Window Scan | Like ACK scan but examines TCP window field. Can differentiate open/closed. |
| -sn | Ping Scan (No port) | Discovers live hosts only, no port scanning. Fast host discovery. |
| -Pn | Skip host discovery | Treats all hosts as up. Use when ICMP is blocked. |
# Examples nmap -sS 192.168.1.1 # SYN stealth scan (requires root) nmap -sU -p 53,161 192.168.1.1 # UDP scan DNS and SNMP nmap -sn 192.168.1.0/24 # ping sweep — find live hosts nmap -Pn 192.168.1.1 # skip ping, scan all ports nmap -sS -sU 192.168.1.1 # combine TCP + UDP scan
3. Service & OS Detection
# Service version detection nmap -sV 192.168.1.1 # detect service versions nmap -sV --version-intensity 9 192.168.1.1 # max intensity (0-9) # OS detection nmap -O 192.168.1.1 # OS fingerprinting (requires root) nmap -O --osscan-guess 192.168.1.1 # aggressive OS guess # Combined aggressive scan nmap -A 192.168.1.1 # -sV + -O + scripts + traceroute nmap -A -T4 192.168.1.0/24 # aggressive scan of subnet
4. Timing & Performance
| Flag | Template | Description |
|---|---|---|
| -T0 | Paranoid | 5 min delay between probes. Extremely slow — IDS evasion |
| -T1 | Sneaky | 15 sec delay. Very slow — avoids most IDS detection |
| -T2 | Polite | 0.4 sec delay. Slow — reduces bandwidth usage |
| -T3 | Normal | Default. Balanced speed and stealth |
| -T4 | Aggressive | Fast — assumes reliable network. Common for CTFs/labs |
| -T5 | Insane | Very fast — may miss results on slow networks |
5. Nmap Scripting Engine (NSE)
NSE allows Nmap to run scripts for advanced detection, vulnerability scanning, and exploitation. Scripts are in /usr/share/nmap/scripts/
# Run default scripts nmap -sC 192.168.1.1 # equivalent to --script=default nmap -sV -sC 192.168.1.1 # version + default scripts (common combo) # Run specific scripts nmap --script=http-title 192.168.1.1 nmap --script=vuln 192.168.1.1 # all vuln-category scripts nmap --script=exploit 192.168.1.1 # Script categories nmap --script=auth 192.168.1.1 # authentication checks nmap --script=brute 192.168.1.1 # credential brute-force nmap --script=discovery 192.168.1.1 nmap --script=dos 192.168.1.1 # ⚠️ dangerous — DoS scripts # Useful individual scripts nmap --script=http-enum 192.168.1.1 # enumerate web directories nmap --script=smb-vuln-ms17-010 192.168.1.1 # check EternalBlue nmap --script=ftp-anon 192.168.1.1 # check FTP anonymous login nmap --script=ssh-brute 192.168.1.1 # SSH brute force nmap --script=dns-zone-transfer --script-args dns-zone-transfer.domain=target.com ns1.target.com
6. Output Formats
# Save output nmap -oN scan.txt 192.168.1.1 # normal text format nmap -oX scan.xml 192.168.1.1 # XML (parseable by tools) nmap -oG scan.gnmap 192.168.1.1 # greppable format nmap -oA scan 192.168.1.1 # all three formats at once # Verbosity nmap -v 192.168.1.1 # verbose nmap -vv 192.168.1.1 # very verbose nmap -d 192.168.1.1 # debug mode nmap --reason 192.168.1.1 # show why port is open/closed
7. Firewall Evasion & Spoofing
# Fragment packets (bypass simple packet filters) nmap -f 192.168.1.1 # fragment packets into 8-byte chunks nmap -ff 192.168.1.1 # 16-byte chunks nmap --mtu 24 192.168.1.1 # custom MTU (must be multiple of 8) # Decoys (mix real scan with fake source IPs) nmap -D RND:10 192.168.1.1 # 10 random decoy IPs nmap -D 10.0.0.1,10.0.0.2,ME 192.168.1.1 # Spoof source nmap -S 192.168.1.50 192.168.1.1 # spoof source IP nmap -e eth0 -S 192.168.1.50 192.168.1.1 # Source port (bypass firewalls allowing port 53) nmap --source-port 53 192.168.1.1 # Scan via proxy nmap --proxies socks4://proxy:port 192.168.1.1
8. Complete Real-World Examples
# Full pentest recon scan (save all formats) nmap -sS -sV -sC -O -A -T4 -p- --open -oA full_scan 192.168.1.1 # Quick host discovery + top ports nmap -sn 192.168.1.0/24 && nmap -T4 --top-ports 1000 192.168.1.0/24 # Web server recon nmap -p 80,443,8080,8443 -sV --script=http-title,http-headers 192.168.1.1 # SMB vulnerability check (MS17-010 / EternalBlue) nmap -p 445 --script=smb-vuln-ms17-010 192.168.1.0/24 # Check for default credentials nmap -p 22 --script=ssh-brute 192.168.1.1 nmap -p 21 --script=ftp-anon,ftp-brute 192.168.1.1 # UDP scan key services nmap -sU -p 53,67,68,69,123,161,162 192.168.1.1