Comprehensive Nmap Cheatsheet for Security Analysts

📱 Mobile Security Tips

Sarah Chen — iOS Security Specialist

What is Nmap?

Nmap (Network Mapper) is a powerful open-source tool used for network discovery and security auditing. It allows analysts to discover hosts and services on a computer network by sending packets and analyzing the responses. Its versatility makes it essential for both SOC analysts and penetration testers.

Installation

Nmap can be easily installed on various operating systems. Here’s how:

• Linux: Use your package manager, e.g., sudo apt install nmap (Debian-based) or sudo yum install nmap (Red Hat-based).
• Windows: Download the installer from nmap.org.
• macOS: Use Homebrew: brew install nmap.

Basic Syntax

nmap [options] [target]

Basic targets can be IP addresses, hostnames, or subnets (e.g., 192.168.1.0/24).

Discovery

Ping Scan

Check if hosts are up.

nmap -sn 192.168.1.0/24

Service Version Detection

Identify services running on open ports.

nmap -sV 192.168.1.1

Operating System Detection

Determine OS and device types.

nmap -O 192.168.1.1

Scanning

Standard TCP Scan

Perform a basic TCP scan of common ports.

nmap 192.168.1.1

Scan Specific Ports

Scan a range or list of ports.

nmap -p 22,80,443 192.168.1.1

Stealth Scan

Conduct a SYN scan to bypass some firewalls.

nmap -sS 192.168.1.1

Exploitation

Script Scan

Run Nmap scripts that can exploit vulnerabilities.

nmap -sC 192.168.1.1

Brute Force Authentication

Use Nmap scripts to brute force logins.

nmap --script=http-brute 192.168.1.1

Analysis

Output Formats

Save the scan output in a specific format for further analysis.

nmap -oA myscan 192.168.1.1

XML Output

Generate XML output for integration with other tools.

nmap -oX myscan.xml 192.168.1.1

Evasion

Decoy Scan

Obscure the scan source address.

nmap -D RND:2 192.168.1.1

Use Specific Source Port

Use a specific port to evade detection.

nmap -p 443 --source-port 53 192.168.1.1

Reporting

Generate Comprehensive Reports

Combine output styles for detailed reporting.

nmap -oN report.txt -oG report.grep -oX report.xml 192.168.1.1

Quick Reference Table

Flag	Description
-p	Specifies ports to scan
-sS	SYN scan
-sV	Service version detection
-O	OS detection
–script	Run Nmap scripts
-oA	Output in all formats
-D	Decoy scan

Pro Tips

• Use nmap -A for aggressive scanning which includes OS and version detection.
• Schedule scans with cron jobs for regular monitoring.

Real-World Examples

Example 1: Scanning a Subnet

nmap -sS -p 1-1000 192.168.1.0/24

Example 2: Service Enumeration

nmap -sV -p 22,80,443 example.com