Comprehensive Cheat Sheet for Nmap

🛠 Security Tool Cheatsheet

Alex Morgan — Senior Penetration Tester

What is Nmap?

Nmap (Network Mapper) is a powerful open-source tool for network exploration and security auditing. It’s primarily used by network administrators, SOC analysts, and penetration testers to discover hosts and services on a computer network, thus creating a “map” of the network.

Installation

Nmap is available on various operating systems, including Windows, Linux, and macOS. You can download it from the official website or install it using package managers.

• sudo apt install nmap (Linux – Debian/Ubuntu)
• brew install nmap (macOS)
• For Windows, download the installer from the official Nmap website.

Basic Syntax

nmap [options] [target]

Discovery

Host Discovery

Use the following command to discover live hosts on a network:

nmap -sn 192.168.1.0/24

This performs a ping scan across the specified subnet.

Service Discovery

To discover open ports and services running on a target:

nmap -sV 192.168.1.1

This command identifies the service versions.

Scanning

TCP Connect Scan

To perform a TCP connect scan, which establishes a full TCP connection:

nmap -sT 192.168.1.1

Stealth SYN Scan

The SYN scan is faster and stealthier:

nmap -sS 192.168.1.1

Exploitation

Nmap can be used alongside scripts to exploit vulnerabilities:

nmap --script http-vuln-cve2014-3704 -p 80 192.168.1.1

The above command checks for a specific vulnerability in the HTTP service.

Analysis

Output Formats

Nmap supports different output formats to assist in analysis:

Flag	Description
-oN	Normal output
-oG	Grepable output
-oX	XML output
-oA	All formats (Nmap, grepable, XML)

Evasion

Packet Fragmentation

To evade firewalls/destructive detection systems, consider packet fragmentation:

nmap -f 192.168.1.1

Decoy Scan

Decoy scans make it appear as if multiple hosts are scanning the target:

nmap -D RND:10 192.168.1.1

Reporting

After scanning and analysis, generating reports is crucial:

nmap -oA report 192.168.1.1

Quick Reference Table

Command	Description
nmap -sn [target]	Ping scan detection
nmap -sS [target]	Stealth SYN scan

Pro Tips

• Use nmap -p- [target] to scan all ports, not just the most common ones.
• Combine scripts and options effectively using nmap --script -p [port] [target] for more targeted exploration.

Real-World Examples

Example: Full Network Scan

nmap -sS -sV -oN scan_report.txt 192.168.1.0/24

This command performs a full SYN scan, detects service versions, and saves the output in a text file.

Example: Finding Vulnerabilities

nmap -sS --script vuln 192.168.1.1

This targets the host and detects vulnerabilities using Nmap scripts.