Nmap Security Tool Cheatsheet

🛠 Security Tool Cheatsheet

Alex Morgan — Senior Penetration Tester

What is Nmap?

Nmap (Network Mapper) is a powerful open-source tool used for network discovery and security auditing. It is widely utilized by network administrators and security professionals to gather information about network services, hosts, and vulnerabilities.

Installation

To install Nmap, use the following commands based on your operating system:

• Ubuntu/Debian: sudo apt install nmap
• CentOS/RHEL: sudo yum install nmap
• MacOS: brew install nmap

Basic Syntax

The basic syntax for using Nmap is:

nmap [options] [target]

Service Discovery

Basic Scan

nmap 

This command performs a basic scan of the target’s open ports.

Service Version Detection

nmap -sV 

This command detects versions of the services running on open ports.

Operating System Detection

nmap -O 

Utilize this command to determine the operating system of the target.

Scanning

Scanning Multiple IPs

nmap   

Scan multiple IP addresses in a single command.

Subnet Scanning

nmap 

Apply this command to scan an entire subnet.

Aggrieve Scanning

nmap -A 

This aggressive scan option performs OS detection, version detection, script scanning, and traceroute.

Exploitation

Using Nmap Scripts

nmap --script= 

Run a specific Nmap script against a target to perform advanced scans.

Analysis

Output Formats

nmap -oN  

Save output in a normal format to a file.

nmap -oX  

Save output in XML format that can be used for further processing or analysis.

Evasion

Decoy Scanning

nmap -D RND:10 

This command uses decoy IPs to obscure the source of the scan.

Timing Options

nmap -T4 

Adjust timing for faster scans (1 is slowest, 5 is fastest).

Reporting

Combine Output Formats

nmap -oN  -oX  

Generate both normal and XML output in one command.

Quick Reference Table

Flag	Description
-sV	Service version detection
-O	OS detection
-A	Aggressive scan mode
-oN	Normal format output
-oX	XML format output

Pro Tips

• Use -Pn: When scanning hosts that might block ICMP, the command nmap -Pn can help skip host discovery.
• Scan with a specific port range: Instead of scanning all ports, use nmap -p 1-1000 to limit the scan.

Real-World Examples

Example 1 – Quick Scan

nmap -T4 -F 

This command runs a quick (fast) scan of the target IP to get basic information.

Example 2 – Script-Based Scanning

nmap --script=vuln 

This command uses Nmap’s scripting engine to check for known vulnerabilities against the target IP.