Comprehensive Nmap Cheatsheet for Security Analysts

📱 Mobile Security Tips

Sarah Chen — iOS Security Specialist

What is Nmap?

Nmap (Network Mapper) is an open-source tool for network exploration and security auditing. It is widely used by security professionals to discover hosts and services on a computer network, thus creating a ‘map’ of the network. From simple pings to complex scans, Nmap is an essential tool for penetration testers and security analysts.

Installation

Nmap can be installed on various operating systems. Here’s how you can install it:

• For Ubuntu: sudo apt install nmap
• For macOS (using Homebrew): brew install nmap
• For Windows: Download the installer from the official Nmap website.

Basic Syntax

nmap [options] {target}

Discovery

Ping Sweep

To discover live hosts on a subnet, use:

nmap -sn 192.168.1.0/24

OS Detection

To detect the OS of a target:

nmap -O 192.168.1.1

Scanning

TCP SYN Scan

Perform a stealthy SYN scan:

nmap -sS 192.168.1.1

Service Version Detection

To identify service versions:

nmap -sV 192.168.1.1

Full TCP Scan

For a comprehensive TCP scan:

nmap -sT 192.168.1.1

Exploitation

Script Scanning

Utilize Nmap’s scripting engine for more detailed analysis:

nmap --script=script-name -p port 192.168.1.1

Analysis

Output Formats

Save your scan results to a file:

nmap -oN output.txt 192.168.1.1

Evasion

Timing Options

Adjust timing for stealthy scans:

nmap -T0 192.168.1.1 (T0 – Paranoid)

Reporting

XML Output for Reporting

Generate XML formatted output:

nmap -oX output.xml 192.168.1.1

Quick Reference Table

Flag	Description
-sS	TCP SYN scan (stealth)
-O	Operating system detection
-sV	Service version detection
-oN	Output results in normal format
–script	Execute NSE scripts

Pro Tips

• Using the -p flag: Specify individual ports, e.g., -p 22,80,443 for ports 22, 80, and 443.
• Stealth Scanning: Use -sP to ping only, without port scanning.
• Performance: Combine scans with the -T4 flag for faster results.

Real-World Examples

Network Inventory

nmap -sP 192.168.1.0/24

Service & OS Enumeration

nmap -sS -sV -O -p- 192.168.1.1

Stealth Scan with Output

nmap -sS -oN output.txt 192.168.1.1