Comprehensive Cheatsheet for Nmap

📱 Mobile Security Tips

Sarah Chen — iOS Security Specialist

What is Nmap?

Nmap (Network Mapper) is a powerful open-source tool used for network discovery and security auditing. It helps security analysts and penetration testers to identify devices on a network, discover open ports, and gather detailed information about services running on those ports.

Installation

To install Nmap on different operating systems, follow the instructions below:

• On Windows: Download the installer from the official Nmap website and run it.
• On Ubuntu/Debian: Use the following command:

  sudo apt install nmap

• On MacOS: If you have Homebrew installed, run:

  brew install nmap

Basic Syntax

The basic syntax for Nmap is as follows:

nmap [options] {target}

Network Discovery

To discover hosts on a network, you can use the following commands:

nmap -sn 192.168.1.0/24

This command will send a ping scan to the entire subnet 192.168.1.0/24 to discover active hosts.

Port Scanning

To scan for open ports on a specific host:

nmap -sS 192.168.1.1

This performs a TCP SYN scan on host 192.168.1.1.

Service Version Detection

To obtain more information about the services and their versions running on a target, use:

nmap -sV 192.168.1.1

Operating System Detection

To identify the operating system the target is using:

nmap -O 192.168.1.1

Intense Scan

An intense scan combines several options and can be run with:

nmap -A 192.168.1.1

This option enables OS detection, version detection, script scanning, and traceroute.

Scanning Multiple Hosts

To scan multiple hosts or a range:

nmap 192.168.1.1 192.168.1.5

You can also specify an entire subnet with:

nmap 192.168.1.0/24

Quick Reference Table

Pro Tips

• Use the -oN flag to save output to a file for easier analysis.

nmap -oN scan_results.txt -A 192.168.1.1

• Combine flags for more specific scanning, like combining -p with -sV for version scanning on certain ports.
• Use -p- to scan all 65535 ports if you want a more comprehensive assessment.

nmap -p- 192.168.1.1

Real-World Examples

Consider a scenario where you need to assess the security of a web application on a given server. You could run:

nmap -p 80,443 -sV -O example.com

This command checks for open HTTP and HTTPS ports, retrieves version details, and identifies the OS, all of which are crucial for vulnerability assessment.

Conclusion

With this cheatsheet, you should have a solid foundation for using Nmap effectively in your security assessments. Remember to stay updated on Nmap’s capabilities as it continuously evolves to provide new features and options.