Nmap Cheatsheet for Security Analysts and Pentesters

🛠 Security Tool Cheatsheet

Alex Morgan — Senior Penetration Tester

What is Nmap?

Nmap (Network Mapper) is a powerful open-source tool used for network discovery and security auditing. It allows users to discover hosts and services on a computer network, thus creating a ‘map’ of the network. It is widely used by security analysts and penetration testers for scanning networks and identifying services to exploit vulnerabilities.

Installation

To install Nmap, use the package manager compatible with your operating system.

# On Debian/Ubuntu
sudo apt-get install nmap

# On CentOS/RHEL
sudo yum install nmap

# On MacOS (using Homebrew)
brew install nmap

# For Windows
Download the installer from: https://nmap.org/download.html

Basic Syntax

The basic syntax for running Nmap is:

nmap [OPTIONS] {target}

Discovery

Discovery is primarily focused on identifying live hosts on the network.

Ping Sweep

nmap -sn 192.168.1.0/24

This scans the subnet and identifies active hosts without port scanning.

Service Discovery

nmap -sP 192.168.1.1

This command performs a ping scan to discover the target’s availability.

Scanning

Scanning focuses on identifying open ports and services running on hosts.

Basic Port Scan

nmap 192.168.1.1

This default command scans the most common 1,000 TCP ports.

Scan Specific Ports

nmap -p 22,80,443 192.168.1.1

Initiate a scan on specified ports (22, 80, and 443).

Exploitation

While Nmap is not an exploitation tool, it can help identify vulnerabilities.

Version Detection

nmap -sV 192.168.1.1

This attempts to determine the version of services running on open ports, which can reveal vulnerabilities.

Analysis

Analysis involves interpreting the data gathered during scans.

Save Scan Results

nmap -oN scan_results.txt 192.168.1.1

Saves the output of a scan in normal text format.

Evasion

Evading detection is essential in penetration testing.

Use Fragmentation

nmap -f 192.168.1.1

This command fragments packets to evade some types of intrusion detection systems.

Reporting

Good reporting can lead to improved security practices.

XML Output

nmap -oX scan_results.xml 192.168.1.1

Saves output in XML format for integration with security information and event management (SIEM) tools.

Quick Reference Table

Flag	Description
-sS	SYN scan (stealth scan)
-sU	UDP scan
-A	Enable OS detection, version detection, script scanning, and traceroute

Pro Tips

• Use -T4 for faster scans by increasing timing heuristics.
• Combine -sV and -A for comprehensive service detection.
• Consider using --script to run Nmap scripts for specific vulnerability detection.

Real-World Examples

1. To scan a range of IPs using a quick SYN scan:

nmap -sS 192.168.1.1-10

2. Conduct a stealth scan while running a version detection:

nmap -sS -sV -p 1-1000 192.168.1.1

3. For a comprehensive scan and save the results:

nmap -A -oN detailed_scan.txt 192.168.1.1