Comprehensive Nmap Cheatsheet for Security Analysts and Penetration Testers

🤖 AI Prompts Cheatsheet

Priya Nair — Prompt Engineering Expert

What is Nmap?

Nmap (Network Mapper) is an open-source utility for network discovery and security auditing. It can be used to discover hosts and services on a computer network, thus creating a sort of ‘map’ of the network. Security analysts and penetration testers commonly utilize Nmap for scanning networks.

Installation

To install Nmap, you can use the following commands based on your OS:

• sudo apt install nmap (Linux – Debian/Ubuntu)
• brew install nmap (macOS)
• Download the installer from nmap.org (Windows)

Basic Syntax

The basic syntax of Nmap is as follows:

nmap [scan type] [options] [target]

Discovery

Ping Scan

To quickly determine which hosts are up:

nmap -sn 192.168.1.0/24

Service Discovery

Find out what services are running on open ports:

nmap -sV 192.168.1.1

Scanning

TCP Scan

Conduct a TCP connect scan:

nmap -sT 192.168.1.1

UDP Scan

Perform a UDP scan for open ports:

nmap -sU 192.168.1.1

Exploitation

OS Detection

To guess the target’s OS:

nmap -O 192.168.1.1

Analysis

Output Formats

Export the results in different formats:

XML Format

nmap -oX result.xml 192.168.1.0/24

Grepable Format

nmap -oG result.gnmap 192.168.1.0/24

Evasion

Decoy Scan

Conceal your scanning source:

nmap -D RND:10 192.168.1.1

Slow Scan

Reduce detectability by slowing down the scans:

nmap --scan-delay 10s 192.168.1.1

Reporting

Generating Reports

Create a detailed report with host information:

nmap -sP 192.168.1.0/24 -oN report.txt

Quick Reference Table

Flag	Description
-sn	Ping scan
-sV	Service version detection
-sT	TCP connect scan
-sU	UDP scan
-O	OS detection
-oX	Output in XML format
-D	Decoy scanning
–scan-delay	Delay between probes
-oN	Normal output

Pro Tips

• Use -p- to scan all 65535 ports.
• Combine options by using a comma, e.g., -p 22,80,443.
• Use --script=default to use Nmap scripts for deeper analysis.

Real-World Examples

Identify Live Hosts in Subnet

nmap -sn 10.0.0.0/24

Check for Open Services

nmap -sV --top-ports 20 10.0.0.1

Aggressive Scan with OS Detection

nmap -A 10.0.0.1