🛠Security Tool Cheatsheet
Alex Morgan — Senior Penetration Tester
What is Nmap?
Nmap (Network Mapper) is a powerful and flexible open-source security tool used for network discovery, security auditing, and penetration testing. It allows analysts to identify hosts, services, and vulnerabilities on a network.
Installation
Nmap can be installed on various platforms. Use the following commands:
# On Debian/Ubuntu:
sudo apt install nmap
# On CentOS/RHEL:
sudo yum install nmap
# On macOS (using Homebrew):
brew install nmap
# Windows:
Download installer from the official Nmap website.
Basic Syntax
The basic syntax for running Nmap is:
nmap [options] [target]
Discovery
Scan for Live Hosts
To discover live hosts on a network:
nmap -sn 192.168.1.0/24
This command performs a ping scan on the specified CIDR range.
Service Version Detection
To detect service versions running on open ports:
nmap -sV 192.168.1.1
The -sV option enables version detection.
Scanning
TCP Connect Scan
To perform a TCP connect scan:
nmap -sT 192.168.1.1
This command establishes a full TCP connection to the target ports.
Stealth SYN Scan
To perform a stealth SYN scan (recommended):
nmap -sS 192.168.1.1
The -sS option sends SYN packets and does not complete the handshake.
Exploitation
Script Scanning
To enhance the scan with Nmap scripts:
nmap -sC 192.168.1.1
The -sC option enables default Nmap scripts for additional checks.
Detecting Vulnerabilities
To scan for potential vulnerabilities:
nmap --script=vuln -p 80,443 192.168.1.1
This command runs vulnerability scripts against the specified ports.
Analysis
Output Formats
To save scan results in XML format:
nmap -oX scan_results.xml 192.168.1.1
The -oX option exports output in XML format.
Interactive Mode
To enter interactive mode for further analysis:
nmap -sS -O -v 192.168.1.1
This command uses verbose output for live monitoring while scanning.
Evasion
Bypassing Firewalls
To use decoy scanning to avoid detection:
nmap -D RND:10 192.168.1.1
The -D option creates multiple decoy packets to obscure the source IP.
Reporting
Generate Human-Readable Output
To create an easy-to-read report:
nmap -oN results.txt 192.168.1.1
The -oN option creates a human-readable output file.
Quick Reference Table
| Flag | Description |
|---|---|
| -sT | TCP Connect Scan |
| -sS | SYN Stealth Scan |
| -sV | Service Version Detection |
| -sC | Default Scripts |
| –script=vuln | Run vulnerability scripts |
| -oN | Output in human-readable format |
| -oX | Output in XML format |
| -D | Decoy scanning |
Pro Tips
- Combine options for more effective scans. For example,
nmap -sS -p 1-65535 -T4 192.168.1.1scans all ports quickly. - Use —excludefile option to specify hosts to skip during a scan.
- Review Nmap’s extensive script library for tailored scans.
Real-World Examples
1. To conduct a full scan of a network with version detection and OS fingerprinting:
nmap -A 192.168.1.0/24
2. To scan a single target’s operating system and run scripts:
nmap -O --script=all 192.168.1.1