Nmap Security Tool Cheatsheet

📱 Mobile Security Tips

Sarah Chen — iOS Security Specialist

What is Nmap?

Nmap (Network Mapper) is a powerful open-source tool used for network discovery and security auditing. It is widely utilized by sysadmins and security professionals for discovering hosts and services on a computer network, thus creating a **map** of the network. Nmap can also be used to identify open ports, detect operating systems, and discern the state of various services.

Installation

To install Nmap on various platforms:

• Linux: Use the package manager for your distribution. For instance, on Ubuntu:

sudo apt install nmap

• macOS: Use Homebrew:

brew install nmap

• Windows: Download the installer from the official Nmap website.

Basic Syntax

The basic command structure for Nmap looks like:

nmap [options] [targets]

Discovery

Utilizing Nmap for network discovery is often the first step in any penetration testing or security assessment. Here are commands that can help:

• Ping Scan: Quickly discovers which hosts are up in a network.

nmap -sn 192.168.1.0/24

• Service Version Detection: Determines versions of services running on open ports.

nmap -sV 192.168.1.1

Scanning

Here are common flags for scanning:

• Scan a specific port:

nmap -p 22 192.168.1.1

• Scan multiple ports:

nmap -p 22,80,443 192.168.1.1

• Scan all 65535 ports:

nmap -p- 192.168.1.1

Exploitation

Nmap is not typically used for exploitation but can provide critical information for further exploitation:

• Operating System Detection: Identifies the operating system of the target.

nmap -O 192.168.1.1

Analysis

Post-scan, you may want to analyze and format the data:

• Export results to XML:

nmap -oX output.xml 192.168.1.1

• Export results to grepable format:

nmap -oG output.gnmap 192.168.1.1

Evasion

To avoid detection and improve stealth, you can modify your scans:

• TCP SYN Scan: Stealth scan.

nmap -sS 192.168.1.1

• Scan with custom timing template:

nmap -T2 192.168.1.1

Reporting

Once the scan completes, you may want to formulate reports:

• Output all formats at once:

nmap -oA output 192.168.1.1

Quick Reference Table

Flag	Description
-sP	Ping scan
-p	Specify port range
-O	OS detection
-oA	Output in all formats

Pro Tips

• Use -p- to scan all ports, but be aware it takes longer.
• Combine -sS and -A for stealthy scans that also enable service detection.
• Familiarize with scripting capabilities using the --script option for advanced tasks.

Real-World Examples

1. For a quick overview of a local subnet, run:

nmap -sn 10.0.0.0/24

2. To identify services and versions running on a specific host:

nmap -sV -p 22,80 10.0.0.5

3. For an OS fingerprinting scan:

nmap -O -p- 10.0.0.5

Utilizing these commands and tips will enhance your proficiency with Nmap, making your network security assessments more efficient and effective.