Cyber Security Tools: Nmap Cheatsheet

📱 Mobile Security Tips

Sarah Chen — iOS Security Specialist

What is Nmap?

Nmap (Network Mapper) is a powerful open-source tool used for network discovery and security auditing. It can quickly scan networks to discover hosts, services, operating systems, and more, making it an essential tool for penetration testers and security analysts.

Installation

Nmap can be installed on various operating systems, including Windows, Linux, and macOS. It is available in most package managers.

# On Debian/Ubuntu-based systems
sudo apt install nmap

# On RedHat/CentOS-based systems
sudo yum install nmap

# On macOS using Homebrew
brew install nmap

Basic Syntax

The basic syntax of Nmap is:

nmap [SCAN TYPE] [Options] [Target]

Discovery

Simple Network Scan

nmap -sn 192.168.1.0/24

This command performs a ping scan on the subnet 192.168.1.0/24, discovering all active hosts without port scanning.

Service Version Detection

nmap -sV 192.168.1.1

Detects the services running on open ports of the target machine.

Scanning

Scan for Open Ports

nmap -p 1-1000 192.168.1.1

Scans the first 1000 ports of the given target.

Scan Multiple Targets

nmap 192.168.1.1,192.168.1.2

Simultaneously scans multiple hosts.

Exploitation

Run NSE Scripts

nmap --script=http-enum 192.168.1.1

Runs the HTTP enumeration script to gather information about web servers.

Analysis

Output in XML Format

nmap -oX output.xml 192.168.1.1

Saves the scan results in XML format for further analysis.

Evasion

Spoof MAC Address

nmap --spoof-mac 0 192.168.1.1

Randomizes the MAC address during the scan to evade detection.

Reporting

Output in grepable Format

nmap -oG output.txt 192.168.1.1

Outputs the scan results in a grepable format for easy parsing.

Quick Reference Table

Pro Tips

• Use -T4 for faster scans.
• Combine scan types to gather more comprehensive data (e.g., nmap -sS -sV.
• Schedule your scans using cron to automate regular audits.

Real-World Examples

Comprehensive Network Scan

nmap -sS -p- -A -T4 192.168.1.0/24

This command performs a stealth SYN scan on all ports with OS detection and service version enumeration on the subnet 192.168.1.0/24, running with a higher speed level.