🛠Security Tool Cheatsheet
Alex Morgan — Senior Penetration Tester
What is Nmap?
Nmap (Network Mapper) is an open-source tool for network exploration and security auditing. It is widely used for discovering devices and services on a network, allowing security analysts and penetration testers to assess security and identify vulnerabilities.
Installation
Nmap is available on various platforms including Windows, Linux, and macOS. To install:
- **Linux**: Use the package manager; for example,
sudo apt install nmapon Ubuntu. - **Windows**: Download the installer from the official Nmap website.
- **macOS**: Use Homebrew:
brew install nmap.
Basic Syntax
The basic syntax for Nmap is:
nmap [options] [target]
Network Discovery
Ping Scan
nmap -sn 192.168.1.0/24
This command performs a ping scan on the subnet, identifying live hosts.
Service Discovery
nmap -sV 192.168.1.1
Detects running services and their versions on a specified host.
Scanning
Port Scanning
nmap -p 80,443 192.168.1.1
Scans specified ports (80 and 443) on the target IP address.
All Ports Scan
nmap -p- 192.168.1.1
Scans all 65535 TCP ports on the specified host.
Exploitation
OS Detection
nmap -O 192.168.1.1
Attempts to identify the operating system running on the target.
Analysis
Output Formats
nmap -oX scan.xml 192.168.1.0/24
Saves the scan results in XML format for further analysis.
Evasion Techniques
Fragmentation
nmap -f 192.168.1.1
Frags packets to evade some firewalls and IDS/IPS.
Decoy Scan
nmap -D RND:10 192.168.1.1
Obfuscates the source IP address by using decoys.
Reporting
Verbose Output
nmap -v 192.168.1.1
Provides detailed output of the scan process.
Quick Reference Table
| Flag | Description |
|---|---|
| -sn | Ping scan only |
| -sV | Service version detection |
| -p | Scan specified ports |
| -O | OS detection |
| -oX | Output to XML file |
| -f | Fragment packets |
| -D | Use decoys |
| -v | Verbose output |
Pro Tips
- Combine Scans: Use multiple flags together to save time, e.g.,
nmap -sV -O 192.168.1.1for service and OS detection in one go. - Scan Specific Subnet: Use CIDR notation to scan subnets effectively, e.g.,
nmap -sn 192.168.1.0/24. - Use Scripts: Leverage Nmap scripting engine (NSE) for additional functionality:
nmap --script=banner 192.168.1.1.
Real-World Examples
1. Identifying Live Hosts:
nmap -sn 10.0.0.0/24
2. Auditing a Range of IPs:
nmap -sV 10.0.0.0/24
3. Generating a CSV report:
nmap -oG - 192.168.1.0/24 | tee output.csv