🛠 Security Tool Cheatsheet
Alex Morgan — Senior Penetration Tester
What is Nmap?
Nmap (Network Mapper) is a powerful open-source tool used for network exploration and security auditing. It allows users to discover hosts and services on a computer network by sending packets and analyzing the responses.
Installation
Nmap can be easily installed on different operating systems:
- On Linux: Use the package manager:
sudo apt install nmap # For Debian/Ubuntu
- On macOS: Use Homebrew:
brew install nmap
- On Windows: Download the installer from the official website.
Basic Syntax
The basic command structure for Nmap is as follows:
nmap [options]
Discovery
1. Service Discovery
Discover running services on a target:
nmap -sV
2. OS Detection
Identify the operating system of the target:
nmap -O
Scanning
1. TCP Connect Scan
Initiate a full TCP connect scan:
nmap -sT
2. SYN Scan (Stealth Scan)
Conduct a stealth scan to avoid detection:
nmap -sS
3. UDP Scan
Scan for open UDP ports:
nmap -sU
Exploitation
Nmap can also be used to assist in exploitation:
1. Running scripts
Use Nmap scripts to automate advanced scanning:
nmap --script
Analysis
1. Output Formats
Generate different output formats for analysis:
nmap -oN output.txt# Normal Output
nmap -oX output.xml# XML Output
Evasion
1. Fragmentation
Evade IDS/IPS with fragmented packets:
nmap -f
Reporting
1. Customizing Output
Add custom headers and formatting to report:
nmap -oG output.gnmap
Quick Reference Table
| Flag | Description |
|---|---|
| -sS | TCP SYN scan |
| -sV | Service/version detection |
| -O | OS detection |
| -oA | Output in all formats (normal, XML, grepable) |
| -f | Fragment packets |
Pro Tips
- Use your own response file to map port findings with scripts.
- Regularly update Nmap to ensure new features and updated scripts are available.
Real-World Examples
1. Full Network Scan
nmap -A -p- 192.168.1.0/24
2. Scanning a Specific Port
nmap -p 22,80,443 192.168.1.1