Cheatsheets

Nmap Security Tool Cheatsheet

by n8n admin

🛠 Security Tool Cheatsheet

Sarah Chen — SOC Analyst & Tool Specialist

What is Nmap?

Nmap (Network Mapper) is an open-source tool for network exploration and security auditing. It is widely used for discovering hosts and services on a computer network by sending packets and analyzing the responses. Nmap can also be used for tasks such as network inventory, managing service upgrade schedules, and monitoring host or service uptime.

Installation

Nmap can be installed on various operating systems. Below are the installation commands for different platforms:

  • Linux (Ubuntu/Debian): 
    • sudo apt install nmap
  • Linux (CentOS/RHEL): 
    • sudo yum install nmap
  • MacOS: Use Homebrew:
    • brew install nmap
  • Windows: Download the installer from the official site:
    • https://nmap.org/download.html

Basic Syntax

The basic syntax of an Nmap command is as follows:

nmap [options]

Discovery

Discovery options with Nmap allow you to identify active devices on a network.

nmap -sn 192.168.1.0/24

This command performs a ping scan on the specified subnet.

Scanning

During scanning, it’s crucial to identify open ports and services running on those ports.

nmap -sS -p 1-65535 192.168.1.1

Here, -sS indicates a TCP SYN scan, and -p specifies the port range to scan.

Exploitation

Nmap can also be coupled with scripts to automate exploitation processes.

nmap --script=http-enum -p 80 192.168.1.1

This command runs the http-enum script on port 80 to enumerate potential web applications.

Analysis

After scanning, you need to analyze the outputs for vulnerabilities.

nmap -oN scan_results.txt 192.168.1.1

Use -oN to save your scan output in a human-readable format.

Evasion

In scenarios where defenses like firewalls or IDS are in place, evasion techniques can be useful.

nmap -D RND:10 192.168.1.1

The -D option makes your scan appear to come from multiple sources, helping to obfuscate your actions.

Reporting

Report generation is crucial for documenting findings.

nmap -oX scan_results.xml 192.168.1.1

Use -oX to save the scan results in XML format for further processing or reporting.

Quick Reference Table

Flag Description
-sS TCP SYN scan (stealth scan)
-p Specifies ports to scan
-sn Ping scan (no port scan)
–script Runs specified Nmap scripts
-oN Output scan results in normal format
-oX Output scan results in XML format
-D Decoy scan to obfuscate source

Pro Tips

  • Use nmap -p- to scan all 65535 ports.
  • Regularly update Nmap to access the latest features and script libraries.
  • Combine Nmap with Grep for easier result filtering, e.g., nmap -sS 192.168.1.1 | grep open.

Real-World Examples

Here are some real-world use cases where Nmap shines:

  • Enumerating TCP Services: nmap -sV -p- 10.0.0.1
  • OS Detection: nmap -O 192.168.1.1
  • Firewall Evasion Testing: nmap -f 192.168.1.1 (Fragmentation scan)

With Nmap’s versatility, it is an essential tool in the arsenal of penetration testers and security analysts everywhere.

Related Posts