Nmap Security Tool Cheatsheet for Analysts and Pentesters

📱 Mobile Security Tips

Sarah Chen — iOS Security Specialist

What is Nmap?

Nmap, short for “Network Mapper,” is a powerful open-source tool for network discovery and security auditing. It can be used to detect devices on a network, scan ports, determine services and operating system types, and perform various other tasks related to network security.

Installation

Nmap can be installed on various operating systems. Here are some quick installation commands:

# On Ubuntu/Debian
sudo apt install nmap

# On CentOS/RHEL
sudo yum install nmap

# On macOS with Homebrew
brew install nmap

Basic Syntax

The general syntax for using Nmap is:

nmap [Scan Type] [Options] [Target]

Discovery

Use discovery scans to identify hosts and services on a network.

Host Discovery

This command scans the network to find active hosts:

nmap -sn 192.168.1.0/24

Service Discovery

Identify services running on the discovered hosts:

nmap -sV 192.168.1.1

Scanning

Perform various types of scans to gather more detailed information.

TCP Connect Scan

This is the most straightforward type of scan:

nmap -sT 192.168.1.1

Stealth Scan

A stealthier approach to scanning:

nmap -sS 192.168.1.1

UDP Scan

Scan for open UDP ports:

nmap -sU 192.168.1.1

Exploitation

Though Nmap is primarily for scanning, it can be coupled with other tools for exploitation.

Nmap Script Engine (NSE)

Run scripts to exploit known vulnerabilities:

nmap --script vuln 192.168.1.1

Analysis

Analyze the results of your scans.

Output in Different Formats

Save the scan results in XML or grepable format:

nmap -oX scan_results.xml 192.168.1.1

Evasion

Sometimes, Nmap scans can be detected by intrusion detection systems (IDS). Use these options to evade detection.

Fragmentation

Fragment packets to bypass some firewalls:

nmap -f 192.168.1.1

Decoy Scan

Use decoy IPs to disguise your scan:

nmap -D RND:10 192.168.1.1

Reporting

Nmap makes it easy to generate reports for your scans.

Generating HTML Reports

Create a web-friendly report:

nmap -oH report.html 192.168.1.1

Quick Reference Table

Flag	Description
-sT	TCP Connect scan
-sS	SYN Stealth scan
-sU	UDP scan
-oX	Output in XML format
-f	Fragment packets
–script	Run scripts from NSE

Pro Tips

• Use -p to specify ports: Always specify the port range you wish to scan to speed up the process. For example, use nmap -p 22,80,443 192.168.1.1.
• Save Time with -iL: Load targets from a file to scan multiple hosts at once: nmap -iL targets.txt.
• Use Timing Options: Adjust scan speed with -T4 or -T5 for quicker scans.

Real-World Examples

Average Network Discovery: You can use the following command to perform a quick scan of your local network: nmap -sP 192.168.1.0/24.

Service Version Detection: This command can help identify versions of services running on a target machine, which can aid in vulnerability assessment: nmap -sV -p 1-1000 192.168.1.1.

Combining Outputs: To combine multiple outputs for organized reporting: nmap -oA myscan 192.168.1.1 which saves in .xml, .gnmap, and .nmap formats.