Comprehensive Cheatsheet for Nmap: Network Scanning Tool

🛠 Security Tool Cheatsheet

Alex Morgan — Senior Penetration Tester

What is Nmap?

Nmap (Network Mapper) is an open-source tool designed for network discovery and security auditing. It is widely used by security professionals and system administrators to discover hosts and services on a computer network, thus creating a map of the network. With a variety of features, it is instrumental for penetration testers seeking to provide a detailed assessment of security posture.

Installation

To install Nmap on various operating systems, you can follow these basic commands:

# On Debian/Ubuntu:
sudo apt install nmap

# On CentOS/RHEL:
sudo yum install nmap

# On macOS (using Homebrew):
brew install nmap

Basic Syntax

The basic syntax of Nmap is as follows:

nmap [options] {target}

Discovery

Nmap is exceptionally effective for discovering hosts in a network. Here are some essential commands:

# Ping scan to identify live hosts:
nmap -sn 192.168.1.0/24

# Discover services running on specific hosts:
nmap -sP 192.168.1.5

Scanning

Nmap provides detailed scanning capabilities to uncover open ports and services. Consider the following:

# Scan all ports and services:
nmap -p- 192.168.1.5

# Perform TCP connect scan:
nmap -sT 192.168.1.5

Exploitation

Nmap can be useful to identify exploitable services:

# Scan for specific vulnerabilities (e.g., heartbleed):
nmap --script ssl-heartbleed -p 443 192.168.1.5

# Use scripts to find vulnerabilities:
nmap --script vuln 192.168.1.5

Analysis

These commands allow in-depth analysis and information gathering:

# Service and OS detection:
nmap -sV -O 192.168.1.5

# Perform a traceroute to find path to target:
nmap --traceroute 192.168.1.5

Evasion

In some scenarios, you may want to evade detection:

# Scan to avoid firewalls (fragmented packets):
nmap -f 192.168.1.5

# Use decoy to obfuscate source:
nmap -D RND:10 192.168.1.5

Reporting

Generate reports using Nmap in various formats:

# Output results to XML file:
nmap -oX output.xml 192.168.1.5

# Output results to a text file:
nmap -oN output.txt 192.168.1.5

Quick Reference Table

Pro Tips

• Use Nmap in combination with other tools like Metasploit for deeper penetration testing insights.
• Test with different scan types (TCP, UDP, etc.) to ensure a comprehensive evaluation.
• Familiarize yourself with common scripts by exploring the script library (located at /usr/share/nmap/scripts).

Real-World Examples

Here are some practical examples of Nmap usage in real-world scenarios:

• Identifying Open Services: Using a simple scan, you can identify all open ports:

nmap -sS 192.168.1.0/24

• Network Inventory: Regular scans can help maintain an inventory of assets in your network:

nmap -p- -oG - 192.168.1.0/24 | awk '/Up$/{print $2}'