Nmap Security Tool Cheatsheet

🛠 Security Tool Cheatsheet

Alex Morgan — Senior Penetration Tester

What is Nmap?

Nmap (Network Mapper) is an open-source tool utilized for network discovery and security auditing. It allows users to discover hosts and services on a computer network by sending packets and analyzing the responses.

Installation

Nmap can be installed on various operating systems:

1. Linux: Use your package manager, e.g., sudo apt install nmap
2. macOS: Use Homebrew, e.g., brew install nmap
3. Windows: Download from the official Nmap site and run the installer.

Basic Syntax

The basic syntax of Nmap is:

nmap [Scan Type(s)] [Options] {target}

Discovery

Host Discovery

This is used to identify live hosts in a network.

nmap -sn 192.168.0.1/24

Service Version Detection

To identify service versions running on open ports.

nmap -sV 192.168.0.1

Scanning

TCP Connect Scan

To perform a full TCP connection.

nmap -sT 192.168.0.1

SYN Scan

To perform a stealthy scan. Most common scan type.

nmap -sS 192.168.0.1

Exploitation

OS Detection

To determine the operating system of a host.

nmap -O 192.168.0.1

Analysis

All In One Report

To produce a comprehensive summary.

nmap -A 192.168.0.1

Evasion

Use Decoy

To obfuscate your source address.

nmap -D RND:2 192.168.0.1

Reporting

Saving Output

To save scan results in various formats.

nmap -oN output.txt 192.168.0.1

Quick Reference Table

Pro Tips

• Utilize -T4 to speed up scans.
• Combine flags for efficient scanning, e.g., nmap -sS -A -O 192.168.0.1.
• For stealth, consider timing templates with -T0.

Real-World Examples

• Identifying active devices:

  nmap -sn 10.0.0.0/24

• Scanning for vulnerabilities:

  nmap -p 1-65535 -sV --script=vuln 192.168.0.1

• Performing a service scan:

  nmap -sS -sV -p 80,443 192.168.0.1