Fortify Your Network with Nmap: A Comprehensive Tool Cheatsheet

📱 Mobile Security Tips

Sarah Chen — iOS Security Specialist

What is Nmap?

Nmap (Network Mapper) is an open-source utility for network discovery and security auditing. It’s widely used by cybersecurity professionals to discover hosts and services on a computer network, thus creating a ‘map’ of the network. Nmap can also efficiently scan large networks and is indispensable for penetration testers and security analysts alike.

Installation

Nmap can be easily installed on various platforms. Here’s how you can install it:

• Windows: Download the installer from the official Nmap website and follow the instructions.
• Linux: Most distributions come with Nmap in their package managers. For example:

sudo apt-get install nmap  # For Debian-based systems (Ubuntu, etc.)

• Mac: Use Homebrew to install Nmap:

brew install nmap

Basic Syntax

The general syntax of Nmap is as follows:

nmap [Scan Type(s)] [Options] [Target]

Where Target can be an IP address, hostname, or a range of IPs.

Discovery

Scanning for Live Hosts

To quickly identify which devices are up in a network, use:

nmap -sn 192.168.1.0/24

This command sends ICMP echo requests to check which hosts are alive within the specified subnet.

OS Detection

To identify the operating system of a host, use the following:

nmap -O 192.168.1.1

The flag -O enables OS detection.

Scanning

Port Scanning

To scan for open ports on a target:

nmap -p 1-65535 192.168.1.1

This scans all TCP ports from 1 to 65535.

Service Version Detection

For a more detailed view of what services are running on open ports:

nmap -sV 192.168.1.1

The -sV flag queries open ports to determine the service/version running.

Exploitation

Running NSE Scripts

Nmap’s scripting engine (NSE) allows users to execute scripts against the target. For example, you might check for vulnerability:

nmap --script http-vuln-cve2017-5638 -p 80 192.168.1.1

Analysis

Output Formats

To output scan results in XML format (useful for further analysis):

nmap -oX result.xml 192.168.1.1

Evasion

Using Decoy Scanning

To obscure the origin of your scan, use the decoy option:

nmap -D RND:10 192.168.1.1

This command sends the scan packets from randomly chosen IPs.

Reporting

Combining Output Formats

To save in multiple formats simultaneously:

nmap -oA report 192.168.1.1

This will generate .gnmap, .xml, and .nmap files with the name report.

Quick Reference Table

Flag	Description
-sP	Ping scan – detects live hosts
-O	OS detection
-p	Specify port range to scan
-sV	Service version detection
–script	Run specific NSE scripts
-oX	Output scan results in XML
-D	Decoy scanning
-oA	Output in all formats

Pro Tips

• Use -sP for quick network inventory.
• Combine flags to enhance scans, e.g., nmap -sS -p 1-1000 -O 192.168.1.1 for stealthy service detection.

Real-World Examples

– For a full scan with Nmap on a critical server, you might use the following command:

nmap -A -T4 192.168.1.10

– To run a check on a web server for vulnerabilities:

nmap --script http-vuln-* -p 80 192.168.1.10