Nmap Security Tool Cheatsheet

🛠 Security Tool Cheatsheet

Alex Morgan — Senior Penetration Tester

What is Nmap?

Nmap (Network Mapper) is an open-source tool for network exploration and security auditing. It can be used to discover hosts and services on a computer network by sending packets and analyzing the responses. Nmap is commonly used for network inventory, managing service upgrade schedules, and monitoring host or service uptime.

Installation

Nmap can be installed on various platforms. Here are installation commands for different operating systems:

# For Debian/Ubuntu
sudo apt install nmap

# For Red Hat/Fedora
sudo dnf install nmap

# For macOS
brew install nmap

# Windows (download from)
https://nmap.org/download.html

Basic Syntax

The basic syntax of Nmap is as follows:

nmap [options] {target}

Discovery

Basic Host Discovery

To ping a range of IP addresses to check which hosts are alive:

nmap -sn 192.168.1.1/24

Service Discovery

To identify services running on open ports:

nmap -sV 192.168.1.1

Scanning

Port Scanning

To scan for open ports on a target:

nmap -p 1-65535 192.168.1.1

Aggressive Scan

An aggressive scan mode is used to get further details:

nmap -A 192.168.1.1

Exploitation

Scan for Vulnerabilities

Use scripts to detect vulnerabilities:

nmap --script=vuln 192.168.1.1

Analysis

Save Scan Results

Output the results in different formats:

nmap -oA scan_results 192.168.1.1

Evasion

Use Fragmentation

To evade firewalls, fragment packets:

nmap -f 192.168.1.1

Reporting

XML Output

Export results in XML format for further analysis:

nmap -oX scan_results.xml 192.168.1.1

Quick Reference Table

Pro Tips

• Use -Pn to skip host discovery if you know the target is up.
• Combine scans: You can combine flags for comprehensive output, like nmap -sS -sV -A -O 192.168.1.1.
• Scan the top N ports: Use --top-ports 20.
• Script scanning capabilities can be pulsed by checking nmap -sC for default scripts.

Real-World Examples

To scan a server and output to all formats: nmap -sS -sV -A -oA server_scan_results 192.168.0.10

Identifying services on a web application:

nmap -sV -p 80,443 192.168.0.20

Using scripts to check for vulnerabilities:

nmap --script=http-vuln* 192.168.0.30