Skip to content

Nmap

Executive Summary

Nmap is used for host discovery, port scanning, service detection, script scanning, and network mapping.

Use this cheatsheet for quick scan syntax during enumeration and validation.

Basic Scans

Scan a single host:

nmap TARGET_IP

Scan multiple hosts:

nmap TARGET1 TARGET2 TARGET3

Scan a subnet:

nmap 192.168.1.0/24

Scan from a file:

nmap -iL targets.txt

Host Discovery

Ping scan:

nmap -sn 192.168.1.0/24

Treat host as alive:

nmap -Pn TARGET_IP

ARP discovery on local network:

sudo nmap -PR -sn 192.168.1.0/24

Port Scanning

Top 1000 TCP ports:

nmap TARGET_IP

Specific ports:

nmap -p 22,80,443 TARGET_IP

Port range:

nmap -p 1-1000 TARGET_IP

All TCP ports:

nmap -p- TARGET_IP

Fast all-port scan:

nmap -p- --min-rate 1000 TARGET_IP

UDP scan:

sudo nmap -sU TARGET_IP

Top UDP ports:

sudo nmap -sU --top-ports 100 TARGET_IP

Scan Types

TCP SYN scan:

sudo nmap -sS TARGET_IP

TCP connect scan:

nmap -sT TARGET_IP

UDP scan:

sudo nmap -sU TARGET_IP

Null scan:

sudo nmap -sN TARGET_IP

FIN scan:

sudo nmap -sF TARGET_IP

Xmas scan:

sudo nmap -sX TARGET_IP

Service and Version Detection

Service detection:

nmap -sV TARGET_IP

Default scripts and service detection:

nmap -sC -sV TARGET_IP

Aggressive scan:

nmap -A TARGET_IP

Version intensity:

nmap -sV --version-intensity 9 TARGET_IP

NSE Scripts

Run default scripts:

nmap -sC TARGET_IP

Run specific script:

nmap --script SCRIPT_NAME TARGET_IP

Run script category:

nmap --script vuln TARGET_IP

Run scripts against specific port:

nmap -p 445 --script smb-enum-shares TARGET_IP

List local scripts:

ls /usr/share/nmap/scripts/

Search scripts:

ls /usr/share/nmap/scripts/ | grep smb

Timing and Performance

Timing templates:

nmap -T4 TARGET_IP

Minimum packet rate:

nmap --min-rate 1000 TARGET_IP

Limit retries:

nmap --max-retries 2 TARGET_IP

Scan faster with no DNS:

nmap -n TARGET_IP

Output

Normal output:

nmap -oN scan.txt TARGET_IP

Grepable output:

nmap -oG scan.gnmap TARGET_IP

XML output:

nmap -oX scan.xml TARGET_IP

All formats:

nmap -oA scan TARGET_IP

Firewall and Evasion Options

Disable host discovery:

nmap -Pn TARGET_IP

Fragment packets:

sudo nmap -f TARGET_IP

Use decoys:

sudo nmap -D RND:5 TARGET_IP

Spoof source port:

sudo nmap --source-port 53 TARGET_IP

Append random data:

nmap --data-length 24 TARGET_IP

Common Service Scans

SMB:

nmap -p 445 --script smb-enum-shares,smb-enum-users TARGET_IP

FTP:

nmap -p 21 --script ftp-anon,ftp-syst TARGET_IP

HTTP:

nmap -p 80,443 --script http-title,http-headers TARGET_IP

DNS:

nmap -p 53 --script dns-zone-transfer TARGET_IP

SNMP:

sudo nmap -sU -p 161 --script snmp-info TARGET_IP

RDP:

nmap -p 3389 --script rdp-enum-encryption TARGET_IP

Practical Workflow

Step Command
Discover hosts nmap -sn SUBNET
Scan all TCP ports nmap -p- --min-rate 1000 TARGET_IP
Scan found ports nmap -sC -sV -p PORTS TARGET_IP
Run service scripts nmap --script CATEGORY -p PORT TARGET_IP
Save output nmap -oA scan TARGET_IP

Notes

  • Use -Pn when ICMP is blocked.
  • Use -n to skip DNS and speed up scans.
  • UDP scans are slower and often require root.
  • Raw packet scans may fail through proxies or tunnels.
  • Always save scan output for comparison and reporting.