Nmap Security Tool Cheatsheet

📱 Mobile Security Tips

Sarah Chen — iOS Security Specialist

What is Nmap?

Nmap (Network Mapper) is an open-source tool for network discovery and security auditing. It is widely used in penetration testing, network inventory, managing service upgrade schedules, and monitoring host or service uptime.

Installation

Nmap is available on various platforms:

• On Linux, you can install it using your distribution’s package manager:

sudo apt-get install nmap  # Debian/Ubuntu

sudo dnf install nmap  # Fedora

sudo yum install nmap  # RHEL/CentOS

• On Windows, you can download an installer from the official site.
• On Mac, use Homebrew:

brew install nmap

Basic Syntax

The basic syntax for Nmap is:

nmap [options] {target}

Discovery

Use these commands to discover active hosts and services.

Ping Scan

nmap -sn 192.168.1.0/24

This command performs a ping scan to find live hosts in the subnet.

Service Version Detection

nmap -sV 192.168.1.10

Detects the service version running on open ports.

Scanning

Basic Scan

nmap 192.168.1.10

This performs a simple scan of the specified target.

Scanning Specific Ports

nmap -p 80,443 192.168.1.10

This scans only ports 80 and 443.

Exploitation

OS Detection

nmap -O 192.168.1.10

This attempts to determine the operating system of the target.

Aggressive Scan

nmap -A 192.168.1.10

This performs an aggressive scan to enable OS detection, version detection, script scanning, and traceroute.

Analysis

Scripting

nmap --script vuln 192.168.1.10

This runs vulnerability detection scripts against the target.

Output Formats

nmap -oX output.xml 192.168.1.10

Outputs the scan results in XML format for further analysis.

Evasion

Fragmentation

nmap -f 192.168.1.10

This fragments packets to evade detection.

Timing Options

nmap -T4 192.168.1.10

This sets the timing template for faster scans.

Reporting

Saving Your Scan

nmap -oN scan.txt 192.168.1.10

This saves a normal output of the scan results to a text file.

Quick Reference Table

Flag	Description
-sn	Ping scan (no port scan)
-sV	Service version detection
-O	OS detection
-A	Aggressive scan
–script	Script scanning
-oX	XML output
-f	Fragment packets
-T	Set timing template
-oN	Normal output

Pro Tips

• Combine options: You can combine multiple flags, e.g., nmap -sV -O -A 192.168.1.10 for a comprehensive output.
• Use nmap -v to increase verbosity of the output for more details.
• Schedule regular scans using cron jobs for continuous monitoring.

Real-World Examples

Scenario: Network Audit

nmap -sS -T4 -p- -oA audit_report 192.168.1.0/24

This will perform a stealth SYN scan for all ports against the specified network and save the output in all formats.

Scenario: Web Server Test

nmap -p 80,443 --script http-enum 192.168.1.10

This scans the web server for vulnerabilities related to the HTTP services running.