Nmap Security Tool Cheatsheet

📱 Mobile Security Tips

Sarah Chen — iOS Security Specialist

What is Nmap?

Nmap (Network Mapper) is a powerful open-source tool used for network discovery and security auditing. It can be used to discover hosts and services on a computer network, thus creating a ‘map’ of the network.

Installation

Nmap can be installed on various platforms such as Windows, macOS, and Linux. Here are the installation commands:

# On Debian/Ubuntu
sudo apt install nmap

# On CentOS/RHEL
sudo yum install nmap

# On macOS using Homebrew
brew install nmap

# On Windows download from the official site
https://nmap.org/download.html

Basic Syntax

The basic syntax for Nmap is as follows:

nmap [options] [target]

Discovery

Basic Host Discovery

Use this command to discover live hosts in the network.

nmap -sn 192.168.1.0/24

It performs a ping scan to identify which hosts are online.

Service Version Detection

To identify service versions running on open ports:

nmap -sV 192.168.1.1

This also attempts to determine software versions of detected services.

Scanning

Full TCP Connect Scan

For a detailed TCP connect scan:

nmap -sT 192.168.1.1

This connects to the target ports which may be detected by IDS/IPS systems.

Stealth SYN Scan

To perform a stealth scan:

nmap -sS 192.168.1.1

This scan sends SYN packets and is less likely to be logged.

Exploitation

Script Scanning

Use the Nmap scripting engine (NSE) to identify vulnerabilities:

nmap --script=vuln 192.168.1.1

This executes vulnerability detection scripts against the target.

Analysis

OS Detection

To determine the operating system of a target:

nmap -O 192.168.1.1

This uses TCP/IP stack fingerprinting to identify the OS.

Evasion

Fragmentation

To avoid detection by firewalls, fragment the packets:

nmap -f 192.168.1.1

This sends fragmented packets that may bypass basic filtering.

Reporting

Output to XML

For outputting results to an XML file for reporting:

nmap -oX report.xml 192.168.1.1

This saves the scan results in an XML format.

Quick Reference Table

Flag	Description
-sn	Ping scan, discover live hosts
-sV	Service version detection
-sS	Stealth SYN scan
–script	Execute scripts during the scan
-O	Operating system detection
-f	Fragment packets
-oX	Output results to XML file

Pro Tips

• Combine Options: You can combine options, e.g., nmap -sS -O -sV 192.168.1.1 to get a full scan in one command.
• Timing Options: Use -T4 for faster scans depending on your network conditions.
• Scan Multiple IPs: Specify multiple targets using commas nmap 192.168.1.1,192.168.1.2

Real-World Examples

1. Discover live hosts in a subnet with a ping scan:

nmap -sn 10.0.0.0/24

2. Scan for open ports and services on a specific host:

nmap -sS -sV 10.0.0.5

3. Generate a detailed report to XML:

nmap -oX scan_report.xml -sS -sV 10.0.0.5