🛠Security Tool Cheatsheet
Alex Morgan — Senior Penetration Tester
What is Nmap?
Nmap, short for Network Mapper, is a powerful open-source tool for network discovery and security auditing. It’s widely used by penetration testers and security analysts to scan networks, identify open ports, services, and potential vulnerabilities.
Installation
Nmap can be installed on various platforms:
- Linux: Use your package manager, e.g.,
sudo apt install nmapfor Debian-based systems. - Windows: Download the installer from the Nmap official website.
- MacOS: Install via Homebrew with
brew install nmap.
Basic Syntax
The basic syntax of an Nmap command is:
nmap [options] {target}
Network Discovery
Basic Scan
nmap 192.168.1.0/24
This command scans all IPs in the 192.168.1.0 subnet for live hosts.
Service Version Detection
nmap -sV 192.168.1.1
Detects versions of services running on open ports.
Scanning
Port Scanning
nmap -p 80,443 192.168.1.1
Scans only ports 80 and 443 on the specified target.
TCP SYN Scan
nmap -sS 192.168.1.1
This stealth scan sends SYN packets without completing the TCP handshake, making it less detectable.
Exploitation
Script-Based Scanning
nmap --script http-vuln* 192.168.1.1
Runs vulnerability detection scripts that target HTTP services.
Analysis
Output in XML Format
nmap -oX scan_results.xml 192.168.1.1
Saves scan results in XML format for future analysis.
Evasion
Fragment Packets
nmap -f 192.168.1.1
Fragments packets to evade detection by firewalls.
Reporting
Output in Greppable Format
nmap -oG scan_results.grep 192.168.1.1
Outputs scan results in greppable format for easy parsing.
Quick Reference Table
| Flag | Description |
|---|---|
-sS |
TCP SYN scan (stealth scan) |
-sV |
Service version detection |
-oX |
Output in XML format |
-oG |
Output in greppable format |
Pro Tips
- Learn Nmap Scripting Engine (NSE): NSE scripts can automate complex scanning tasks, enhance your analysis, and perform custom checks.
- Combine Nmap with other tools: Use with tools like Metasploit to execute exploits or use output files in other analysis tools like Wireshark.
- Schedule Regular Scans: Schedule regular scans for critical assets, adjusting the timing and intensity according to operational needs.
Real-World Examples
Identify Open Ports and Services
nmap -sS -sV -p- 192.168.1.1
This command performs a full port scan on a target, identifying all open ports and services.
Scans with Specific Scripts
nmap --script http-enum -p 80,443 192.168.1.1
Use the http-enum script to enumerate possible directories on a web server.
Scan and Save Results
nmap -oA myscan 192.168.1.1
Saves the scan in three formats: XML, grepable, and normal.