Nmap Security Tool Cheatsheet

📱 Mobile Security Tips

Sarah Chen — iOS Security Specialist

What is Nmap?

Nmap (Network Mapper) is a powerful open-source tool for network discovery and security auditing. It is widely used by security analysts and penetration testers for mapping networks, discovering hosts and services, and identifying vulnerabilities.

Installation

Nmap can be installed on various operating systems. Here are the basic installation steps:

• Linux: Use your package manager, e.g., sudo apt install nmap for Debian-based systems.
• Windows: Download the installer from the official Nmap website.
• MacOS: Use Homebrew with brew install nmap.

Basic Syntax

The basic syntax of Nmap is:

nmap [options] 

Discovery

Ping Scan

To discover live hosts on a network:

nmap -sn 192.168.1.0/24

OS Detection

To determine the operating system of a host:

nmap -O 192.168.1.1

Scanning

Service Version Detection

To detect versions of the services running on open ports:

nmap -sV 192.168.1.1

All TCP Ports Scan

To scan all 65535 TCP ports:

nmap -p- 192.168.1.1

Exploitation

TCP SYN Scan

To perform a stealthy TCP SYN scan:

nmap -sS 192.168.1.1

Analysis

Output to XML for Reporting

To save the output in XML format for later analysis:

nmap -oX output.xml 192.168.1.1

Comprehensive Report

Generate a standardized report:

nmap -sS -sV -oN report.txt 192.168.1.1

Evasion

Fragment Scanning

Use fragmenting packets to bypass firewalls:

nmap -f 192.168.1.1

Decoy Scan

Use decoy IP addresses to obscure your source IP:

nmap -D RND:10 192.168.1.1

Reporting

Combine Output Formats

To output in multiple formats:

nmap -oA all_formats 192.168.1.1

Quick Reference Table

Flag	Description
-sP	Ping scan
-O	OS detection
-sV	Service version detection
-p	Port specification
-oN	Normal output
-oX	XML output
-D	Decoy

Pro Tips

• Use -sP for quick checks of online hosts before performing detailed scans.
• Combine -sS with -O for stealthy OS enumeration.
• Try using --min-rate to speed up scans on slow networks.

Real-World Examples

Example 1: Quick Network Inventory

Use this command to quickly scan your entire subnet and discover live hosts and open ports:

nmap -sS -sV 192.168.1.0/24

Example 2: Checking for Open Ports on a Web Server

To check for common web ports:

nmap -p 80,443,3000-4000 example.com