advance nmap

Advance usage of nmap | cheatsheet | How to use nmap ?

What is nmap ?

Nmap ("Network Mapper") is a free and open source utility for network discovery and security auditing. Many systems and network administrators also find it useful for tasks such as network inventory, managing service upgrade schedules, and monitoring host or service uptime. Nmap uses raw IP packets in novel ways to determine what hosts are available on the network, what services (application name and version) those hosts are offering, what operating systems (and OS versions) they are running, what type of packet filters/firewalls are in use, and dozens of other characteristics. It was designed to rapidly scan large networks, but works fine against single hosts. Nmap runs on all major computer operating systems, and official binary packages are available for Linux, Windows, and Mac OS X. In addition to the classic command-line Nmap executable, the Nmap suite includes an advanced GUI and results viewer (Zenmap), a flexible data transfer, redirection, and debugging tool (Ncat), a utility for comparing scan results (Ndiff), and a packet generation and response analysis tool (Nping).

Port specification options

Syntax Example Description
nmap -p 23
Port scanning for specific port
nmap -p 23-100
Port scanning for specific port range
nmap -p U:110, T:23,443
U-UDP, T-TCP different port types scan
nmap -p-
Scan all ports from 1 to 65535
nmap -p smtp,http
Port scan for specific protocals
nmap -F
Fast port scan for speed up
-p "*"
Port scan using name
nmap -r
Sequential port scan
nmap --top-ports 2000
Port scan the top x ports
nmap -p0-
Leaving off end port in range makes the scan go through to port 65535

Scanning types of nmap

Syntax Example Description
nmap -sS
TCP SYN port scan
nmap -sT
TCP connect port scan
nmap -sA
TCP ACK port scan
nmap -sU
UDP port scan
nmap -Sf
TCP FIN scan
nmap -sX
XMAS scan
nmap -Sp
Ping scan
nmap -sA
TCP ACK scan
nmap -Sl
List scan
nmap -sW
TCP Window port scan
nmap -sM
TCP Maimon port scan

Host Discovery

Syntax Example Description
nmap -sL
No Scan. List targets only
nmap -sn
Disable port scanning
nmap -Pn
Disable host discovery. Port scan only
nmap -PS22-25,80
TCP SYN discovery on port x. Port 80 by default
nmap -PA22-25,80
TCP ACK discovery on port x. Port 80 by default
nmap -PU53
UDP discovery on port x. Port 40125 by default
nmap -PR
ARP discovery on local network
nmap -n
Never do DNS resolution

Target Specification

Syntax Example Description
Scan a single IP
Scan specific IPs
Scan a range
Scan a domain
Scan using CIDR notation
nmap -iL targets.txt
Scan targets from a file
nmap -iR 100
Scan 100 random hosts
nmap --exclude
Exclude listed hosts

Service and Version Detection

Syntax Example Description
nmap -sV
Attempts to determine the version of the service running on port
-sV --version-intensity
nmap -sV --version-intensity 8
Intensity level 0 to 9. Higher number increases possibility of correctness
-sV --version-light
nmap -sV --version-light
Enable light mode. Lower possibility of correctness. Faster
-sV --version-all
nmap -sV --version-all
Enable intensity level 9. Higher possibility of correctness. Slower
nmap -A
Enables OS detection, version detection, script scanning, and traceroute
nmap -O
Remote OS detection using TCP/IP stack fingerprinting
-O --osscan-limit
nmap -O --osscan-limit
If at least one open and one closed TCP port are not found it will not try OS detection against host
-O --osscan-guess
nmap -O --osscan-guess
Makes Nmap guess more aggressively
-O --max-os-tries
nmap -O --max-os-tries 1
Set the maximum number x of OS detection tries against a target

Timing and Performance

Syntax Example Description
nmap -T0
Paranoid (0) Intrusion Detection System evasion
nmap -T1
Sneaky (1) Intrusion Detection System evasion
nmap -T2
Polite (2) slows down the scan to use less bandwidth and use less target machine resources
nmap -T3
Normal (3) which is default speed
nmap -T4
Aggressive (4) speeds scans; assumes you are on a reasonably fast and reliable network
nmap -T5
Insane (5) speeds scan; assumes you are on an extraordinarily fast network

NSE Scripts

Switch Examples Description
nmap -sC
Scan with default NSE scripts. Considered useful for discovery and safe
--script default
nmap --script default
Scan with default NSE scripts. Considered useful for discovery and safe
nmap --script=banner
Scan with a single script. Example banner
nmap --script=http*
Scan with a wildcard. Example http
nmap --script=http,banner
Scan with two scripts. Example http and banner
nmap --script "not intrusive"
Scan default, but remove intrusive scripts
nmap --script snmp-sysdescr --script-args snmpcommunity=admin
NSE script with arguments
Send packets no faster than per second


Command Description
nmap -Pn --script=http-sitemap-generator
http site map generator
nmap -n -Pn -p 80 --open -sV -vvv --script banner,http-title -iR 1000
Fast search for random web servers
nmap -Pn --script=dns-brute
Brute forces DNS hostnames guessing subdomains
nmap -n -Pn -vv -O -sV --script smb-enum*,smb-ls,smb-mbenum,smb-os-discovery,smb-s*,smb-vuln*,smbv2* -vv
Safe SMB scripts to run
nmap --script whois*
Whois query
nmap -p80 --script http-unsafe-output-escaping
Detect cross site scripting vulnerabilities.
nmap -p80 --script http-sql-injection
Check for SQL injections

Firewall / IDS Evasion and Spoofing

Switch Examples Description
nmap -f
Requested scan (including ping scans) use tiny fragmented
nmap --mtu 32
Set your own offset size
nmap -D,,,
Send scans from spoofed IPs
nmap -D decoy-ip1,decoy-ip2,your-own-ip,decoy-ip3,decoy-ip4 remote-host-ip
Above example explained
nmap -S www.microso
Scan Facebook from Microso
nmap -g 53
Use given source port number
nmap --proxies,
Relay connections through HTTP/SOCKS4 proxies
map --data-length 200
Appends random data to sent packets

Example IDS Evasion command

nmap -f -t 0 -n -Pn --data-length 200 -D,,,

Options for output of map

Switch Example Description
nmap -oN normal.file
Normal output to the file normal file.
nmap -oX xml.file
XML output to the file xml.file
nmap -oG grep.file
Grepable output to the file grep.file
nmap -oA results
Output in the three major formats at once
-oG -
nmap -oG -
Grepable output to screen. -oN -, -oX - also usable
nmap -oN file.file --append-output
Append a scan to a previous scan file
nmap -v
Increase the verbosity level (use -vv or more for greater effect)
nmap -d
Increase debugging level (use -dd or more for greater effect)
nmap --reason
Display the reason a port is in a particular state, same output as -vv
nmap --open
Only show open (or possibly open) ports
nmap -T4 --packet-trace
Show all packets sent and received
nmap --iflist
Shows the host interfaces and routes
nmap --resume results.file
Resume a scan

Helpful Nmap Output examples

Command Desfription
nmap -p80 -sV -oG - --open | grep open
Scan for web servers and grep to show which IPs are running web servers
nmap -iR 10 -n -oX out.xml | grep "Nmap" | cut -d " " -f5 > live-hosts.txt
Generate a list of the IPs of live hosts
nmap -iR 10 -n -oX out2.xml | grep "Nmap" | cut -d " " -f5 >> live-hosts.txt
Append IP to the list of live hosts
ndiff scanl.xml scan2.xml
Compare output from nmap using the ndiff
xsltproc nmap.xml -o nmap.html
Convert nmap xml files to html files
grep " open " results.nmap | sed -r 's/ +/ /g' | sort | uniq -c | sort -rn | less
Reverse sorted list of how o

Other Useful Nmap Commands

Command Desfription
nmap -iR 10 -PS22-25,80,113,1050,35000 -v -sn
Discovery only on ports x, no port scan
nmap -PR -sn -vv
Arp discovery only on local network, no port scan
nmap -iR 10 -sn -traceroute
Traceroute to random targets, no port scan
nmap -sL --dns-server
Query the Internal DNS for hosts, list targets only
Spread the love

Leave a Comment

Your email address will not be published. Required fields are marked *