Nmap Security Tool Cheatsheet

🤖 AI Prompts Cheatsheet

Daniel Osei — AI-Assisted Security Engineer

What is Nmap?

Nmap, short for Network Mapper, is an open-source tool for network exploration and security auditing. It is often used by security professionals to discover hosts and services on a computer network by sending packets and analyzing the responses.

Installation

Nmap can be installed on various platforms. Here’s how to install it on common operating systems:

• Linux: Use the package manager. For Debian/Ubuntu: sudo apt install nmap. For Red Hat/CentOS: sudo yum install nmap.
• Windows: Download the installer from the Nmap official site.
• macOS: Install using Homebrew: brew install nmap.

Basic Syntax

The basic syntax for Nmap is:

nmap [options] [target]

Discovery

Use Nmap for network discovery to identify devices on a network.

nmap -sn 192.168.1.0/24

This command performs a ping scan across the subnet 192.168.1.0/24 to discover live hosts.

Scanning

Port scanning is a primary feature of Nmap.

nmap -p 1-65535 -T4 target_ip

This scans all ports (1-65535) on the specified target with a faster timing template (T4).

Exploitation

While Nmap itself does not exploit vulnerabilities, it can help identify potential attack vectors.

nmap --script=vuln target_ip

This runs Nmap’s vulnerability scanning scripts against the target to identify known vulnerabilities.

Analysis

Gather and analyze information about services running on hosts.

nmap -sV -p 80,443 target_ip

This command detects service versions for HTTP and HTTPS ports.

Evasion

In environments where security measures block scans, use evasion techniques.

nmap -D RND:10 target_ip

This command uses decoy scans, generating random source IP addresses to evade detection.

Reporting

Create detailed reports for your scans.

nmap -oN results.txt target_ip

This saves the output of the scan to a text file named results.txt.

Quick Reference Table

Pro Tips

• Use the -T5 flag for maximum speed, but keep in mind this can overwhelm the target.
• To scan for OS fingerprinting, use -O.
• For more detailed information, use --script=default to run default scripts along with your scan.

Real-World Examples

Consider a situation where you need to assess your company’s network:

nmap -sS -sV -O -p 1-65535 --min-rate 1000 -oN company_scan_results.txt 192.168.1.0/24

This comprehensive scan identifies all open ports, services and versions, performs OS detection, and outputs results to a file.

This cheatsheet provides a quick reference for using Nmap effectively in different phases of security assessments.