Comprehensive Security Tool Cheatsheet for Nmap

🛠 Security Tool Cheatsheet

Alex Morgan — Senior Penetration Tester

What is Nmap?

Nmap (Network Mapper) is a powerful open-source tool used for network discovery and security auditing. Security professionals often use Nmap to identify live hosts, open ports, services running on those ports, and vulnerabilities associated with those services.

Installation

Nmap can be installed on various platforms:

• For Windows, download the installer from nmap.org.
• For macOS, use Homebrew: brew install nmap.
• For Linux, use your package manager, e.g., sudo apt install nmap or sudo dnf install nmap.

Basic Syntax

The basic syntax for using Nmap is:

nmap [OPTIONS] [TARGET]

Discovery

Ping Scan

A simple ping scan to discover live hosts.

nmap -sn 192.168.1.0/24

Service Version Detection

Detect the service versions of running applications.

nmap -sV 192.168.1.1

Scanning

Connect Scan

Perform a TCP connect scan to determine open ports.

nmap -sT 192.168.1.1

Stealth Scan

Perform a stealth SYN scan that is less likely to be logged.

nmap -sS 192.168.1.1

Exploitation

Script Scan

Use Nmap scripts to automate the exploitation and testing of vulnerabilities.

nmap -sC 192.168.1.1

Analysis

OS Detection

Identify the operating system of the target host.

nmap -O 192.168.1.1

Evasion

Fragmented Packets

Send fragmented packets to evade network intrusion detection systems.

nmap -f 192.168.1.1

Reporting

Output to XML

Save the scan results to an XML file.

nmap -oX scan_results.xml 192.168.1.1

Quick Reference Table

Pro Tips

• Use nmap -A for aggressive scans combining multiple features.
• Regularly refer to Nmap’s extensive documentation using man nmap for detailed command breakdowns.
• For more stealth, consider using nmap -D RND:10 to use decoy scanning.

Real-World Examples

Identifying Network Hosts

nmap -sn 10.0.0.0/24

Vulnerability Scanning

nmap --script vuln 192.168.1.1