Nmap Cheatsheet for Security Analysts and Penetration Testers

🤖 AI Prompts Cheatsheet

Priya Nair — Prompt Engineering Expert

What is Nmap?

Nmap (Network Mapper) is a powerful open-source tool used for network discovery and security auditing. It allows users to discover hosts and services on a computer network and create a map of the network, identifying vulnerabilities and potential attack vectors.

Installation

Nmap can be installed on various platforms. Here are the commands for popular operating systems:

• sudo apt install nmap (Ubuntu/Debian)
• brew install nmap (macOS)
• choco install nmap (Windows)

Basic Syntax

The basic syntax of Nmap is:

nmap [options] [targets]

Discovery

Nmap can be used to discover hosts and services running on a network. Here are some common commands:

nmap -sn 192.168.1.0/24  # Ping scan to discover live hosts
nmap -sP 192.168.1.0/24  # Similar to -sn, but produces more output

Scanning

Identify open ports and running services on a target:

nmap -sS -p 1-65535 target.example.com  # TCP SYN scan all ports
nmap -sV target.example.com  # Version detection

Exploitation

While Nmap is primarily a scanning tool, information gleaned during scans can aid in exploitation:

nmap --script vuln target.example.com  # Run vulnerability scripts against the target

Analysis

Nmap can provide detailed information about a target:

nmap -O target.example.com  # OS detection
nmap -A target.example.com  # Aggressive scan for OS, version, scripts

Evasion

Use Nmap’s evasion techniques to avoid detection:

nmap -D RND:10 target.example.com  # Decoy scan with random decoys
nmap --badsum target.example.com  # Generate bad checksums

Reporting

Nmap allows for exporting scans to various formats:

nmap -oX scan.xml  # Output in XML format
nmap -oG scan.gnmap  # Grepable output

Quick Reference Table

Pro Tips

• Use the -T option: Control timing to speed up scans without missing important results. E.g., nmap -T4 target.example.com.
• Save scan results: Use -oN for normal format (e.g., nmap -oN results.txt target.example.com).
• Use Nmap scripts: Leverage Nmap’s scripting engine for advanced scanning and testing. E.g., nmap --script http-vuln* target.example.com.

Real-World Examples

nmap -sS -p 80,443 -T4 target.example.com  # Stealth scan on HTTP/HTTPS with timing
nmap -sP 192.168.1.0/24  # Ping scan to enumerate hosts in the local network

This cheatsheet provides all essential commands and techniques within Nmap, making it easier for SOC analysts and penetration testers to perform effective security assessments.