Nmap Cheat Sheet for Pentesters and Security Analysts

🤖 AI Prompts Cheatsheet

Daniel Osei — AI-Assisted Security Engineer

What is Nmap?

Nmap (Network Mapper) is a powerful open-source tool used for network discovery and security auditing. It is widely used by security professionals to identify hosts and services on a computer network, allowing users to detect open ports, running services, and potential vulnerabilities.

Installation

Nmap can be installed on various operating systems including Windows, Linux, and macOS. For Linux users, you can typically install it using your package manager:

sudo apt install nmap  # For Debian/Ubuntu-based systems
sudo yum install nmap  # For CentOS/RHEL-based systems
brew install nmap      # For macOS with Homebrew

Basic Syntax

The basic syntax for running Nmap is as follows:

nmap [options] [target]

Discovery

Use Nmap to gather information about hosts in a network.

Ping Scan

To determine which hosts are up in a network:

nmap -sn 192.168.1.0/24

Service Version Detection

To detect the services running on open ports and their versions:

nmap -sV 192.168.1.1

Scanning

TCP Connect Scan

This scan attempts to connect to the target ports:

nmap -sT 192.168.1.1

Stealth Scan (SYN Scan)

A stealthy scan that uses SYN packets:

nmap -sS 192.168.1.1

UDP Scan

To scan UDP ports, which are often overlooked:

nmap -sU 192.168.1.1

Exploitation

Nmap can be helpful in identifying potential vulnerabilities based on service versions.

Script Scan

To run a specified script against the target, use:

nmap --script vuln 192.168.1.1

Analysis

After scanning, analyzing the results is crucial.

Output Formats

To save your scan results in various formats, use:

Flag	Description
-oN	Normal output
-oX	XML output
-oG	Grepable output
-oS	Script kiddie output

nmap -oX output.xml 192.168.1.1

Evasion

Some networks employ security measures that may block Nmap scans.

Fragmentation

To evade packet filters, use:

nmap -f 192.168.1.1

Reporting

When documenting your findings, presenting the output clearly is crucial.

Combine Output

You can combine different output formats:

nmap -oA fullscan 192.168.1.0/24

Quick Reference Table

Here’s a quick reference for essential Nmap flags:

Flag	Description
-sP	Ping scan
-sS	TCP SYN scan
-sU	UDP scan
-sV	Service version detection

Pro Tips

• Use -T to set timing templates (e.g., using -T4 for faster scans).
• Use –exclude to skip specific hosts that are known to be irrelevant or too noisy.
• Experiment with different –script options to expand your scanning capabilities beyond the basic scans.

Real-World Examples

Here are a few practical situations:

Identifying Open Ports

nmap -p 1-65535 -T4 -A 192.168.1.1

This command scans all ports and performs OS and service detection.

Scanning a Whole Subnet

nmap -sP 192.168.1.0/24

Quickly identifies all active devices in a subnet.

Detailed Service Detection

nmap -A -T4 -p 80,443 192.168.1.1

This command provides detailed information on web service versions running on specific ports.