Nmap Security Tool Cheatsheet

📱 Mobile Security Tips

Sarah Chen — iOS Security Specialist

What is Nmap?

Nmap (Network Mapper) is a powerful open-source tool used for network discovery and security auditing. It allows administrators and security professionals to discover hosts and services on a computer network by sending packets and analyzing the responses. Its versatility makes it an essential tool for both SOC analysts and penetration testers.

Installation

Nmap can be installed on various operating systems. Below are the installation commands for different platforms:

• Linux (Debian/Ubuntu): sudo apt-get install nmap
• CentOS/RHEL: sudo yum install nmap
• Windows: Download the installer from the Nmap official site.
• MacOS: Install via Homebrew: brew install nmap

Basic Syntax

The basic syntax of Nmap is as follows:

nmap [Scan Type(s)] [Options] {target}

Discovery

Discover hosts in a network.

nmap -sn 192.168.1.0/24

This command performs a ping scan to discover all active hosts in the specified subnet.

Scanning

Scan for open ports and services.

nmap -sS -p 1-65535 192.168.1.1

This command performs a SYN scan on all ports of the target IP.

Exploitation

Using Nmap scripts for exploitation.

nmap --script vuln 192.168.1.1

This command runs vulnerability detection scripts against the target IP.

Analysis

Analyze services running on a host.

nmap -sV 192.168.1.1

This command detects service versions running on open ports.

Evasion

Evade network detection systems.

nmap -D RND:10 192.168.1.1

This command uses decoy options to mask the source of the scan.

Reporting

Generate scan output in different formats.

nmap -oA scan_results 192.168.1.1

This command outputs scan results in all available formats (normal, XML, and grepable).

Quick Reference Table

Pro Tips

Here are some pro tips to elevate your Nmap usage:

• Use -T4 to speed up scans on trusted networks.
• Combine scans for more comprehensive results: nmap -sS -sV -oN report.txt 192.168.1.1.
• Use the -iL option to read targets from a file for bulk scanning.

Real-World Examples

To showcase the practical application of Nmap, here are some real-world examples:

• To quickly identify live hosts and their respective open ports in a subnet:

nmap -sn 192.168.1.0/24 -p 1-1000

• To perform vulnerability scanning on a web server:

nmap --script http-enum -p 80,443 192.168.1.1

• To generate a full report of an internal network scan:

nmap -sS -sV -oA internal_scan_results 10.0.0.0/24