Network Security

Nmap Cheat Sheet

4 sections23 commands

Host Discovery

5 entries
  • nmap -sn <target>Ping scan (no port scan)
  • nmap -Pn <target>Skip host discovery
  • nmap -PS22,80,443 <target>TCP SYN ping on ports
  • nmap -PA80 <target>TCP ACK ping
  • nmap -PU53 <target>UDP ping

Scan Types

7 entries
  • nmap -sS <target>SYN scan (stealth)
  • nmap -sT <target>TCP connect scan
  • nmap -sU <target>UDP scan
  • nmap -sA <target>ACK scan (firewall detection)
  • nmap -sV <target>Version detection
  • nmap -O <target>OS detection
  • nmap -A <target>Aggressive (OS + version + scripts)

NSE Scripts

5 entries
  • nmap --script vuln <target>Run vulnerability scripts
  • nmap --script=http-enum <target>HTTP enumeration
  • nmap --script=smb-vuln* <target>SMB vulnerability check
  • nmap --script=dns-brute <target>DNS brute force
  • nmap --script=default <target>Run default scripts

Output & Timing

6 entries
  • nmap -oN output.txt <target>Normal output
  • nmap -oX output.xml <target>XML output
  • nmap -oG output.gnmap <target>Grepable output
  • nmap -T4 <target>Aggressive timing
  • nmap -p- <target>All 65535 ports
  • nmap -p 1-1000 <target>Port range
Back to cheat sheets