Security Cheatsheet

📱 Mobile Security Tips

Sarah Chen — iOS Security Specialist

{
“title”: “Comprehensive Guide to Nmap for Security Analysts”,
“content”: “

What is Nmap?

Nmap (Network Mapper) is an open-source tool for network discovery and security auditing. It is commonly used by security professionals to discover hosts and services on a computer network, thus creating a ‘map’ of the network. Nmap can be employed for tasks such as managing service upgrade schedules, monitoring host or service uptime, and in-depth security audits.

Installation

Nmap is available on several platforms including Windows, Linux, and macOS. Here’s a quick guide on how to install Nmap:

• Windows: Download the installer from the official Nmap website and execute it.
• Linux: Use the package manager:

sudo apt install nmap  # For Debian/Ubuntu

sudo yum install nmap  # For CentOS/RHEL

• macOS: Install via Homebrew:

brew install nmap

Basic Syntax

The basic syntax for running Nmap is:

nmap [options] {target}

Discovery

Scanning Live Hosts

To discover live hosts on a network:

nmap -sn 192.168.1.0/24

-sn: Ping scan, which skips port scanning.

Service Discovery

To detect services running on hosts:

nmap -sV 192.168.1.1

-sV: Probe open ports to determine service/version info.

Scanning

Port Scanning

To scan specific ports:

nmap -p 22,80,443 192.168.1.1

-p: Specifies which ports to scan.

Full TCP Scan

To perform a full TCP scan:

nmap -sS -p- 192.168.1.1

-sS: SYN scan, and -p-: scan all ports.

Exploitation

Identifying Vulnerabilities

To look for known vulnerabilities:

nmap --script=vuln 192.168.1.1

–script=vuln: Run vulnerability scripts against targets.

Analysis

Output Formats

To save results in XML format for further analysis:

nmap -oX output.xml 192.168.1.1

-oX: Outputs scan results in XML.

Interactive Mode

To enter interactive mode with scanning live hosts:

nmap -sP 192.168.1.0/24 -oN -

-oN: Output scan results in normal format.

Evasion

Bypass Firewall Detection

To evade firewalls and IDS:

nmap -D RND:5 192.168.1.1

-D: Decoy scan, using random decoy IPs to mask true source.

Reporting

Generating Detailed Reports

To create a comprehensive report:

nmap -oA report 192.168.1.1

-oA: Output results in all formats (XML, normal, grepable).

Quick Reference Table

Flag	Description
-sn	Ping scan
-sV	Service/version detection
-p	Port specification
-sS	SYN scan
–script=vuln	Vulnerability scanning
-oX	Output in XML
-D	Decoy scanning
-oA	Output in all formats

Pro Tips

• Use Timing: To quickly scan without being detected, use -T4 for faster scans.
• Combine Scans: You can combine flags to save time; for example, nmap -sS -sV -T4 192.168.1.1.
• Script Engine: Take advantage of the Nmap Scripting Engine (NSE) for advanced functions by using --script followed by a specific script.

Real-World Examples

Scenario 1: Assessing a Corporate Network

In a corporate environment, you may want to identify live systems and the services running on them.

nmap -sS -sV -oA myscan 192.168.0.0/24

Scenario 2: Discovering Vulnerable Systems

When you need to find vulnerabilities in specific applications or services:

nmap --script=vuln -