Comprehensive Nmap Cheatsheet for Security Analysts

📱 Mobile Security Tips

Sarah Chen — iOS Security Specialist

What is Nmap?

Nmap (Network Mapper) is an open-source tool for network discovery and security auditing. It is widely used by network administrators and penetration testers to discover hosts and services on a computer network. Nmap can quickly create a map of the network and provide valuable information about the hosts and services running.

Installation

Nmap can be installed on various platforms. Here’s how to install it on popular systems:

• Linux: Typically comes pre-installed or can be installed via package manager.
  sudo apt install nmap (Debian/Ubuntu)
  sudo yum install nmap (CentOS/Fedora)
• Windows: Download the installer from the official Nmap website.
• macOS: Use Homebrew.
  brew install nmap

Basic Syntax

nmap [options] 

Discovery

Use Nmap for network discovery to identify live hosts.

nmap -sn 192.168.1.0/24

This command performs a ping scan (No port scan) to discover live hosts in the specified subnet.

Scanning

Perform various types of scans using Nmap to gather information on open ports and services.

nmap -sS -p 1-65535 192.168.1.1

This command performs a TCP SYN scan on all ports (1-65535) of the target IP.

Exploitation

Use Nmap’s scripting engine to automate further analysis.

nmap --script vuln 192.168.1.1

This runs vulnerability detection scripts against the target IP.

Analysis

Gather detailed information about discovered services.

nmap -sV -A 192.168.1.1

This command detects versions of services and enables OS detection and script scanning.

Evasion

Avoid detection by firewalls and intrusion detection systems.

nmap -f 192.168.1.1

This command uses fragment packets to evade basic firewall filtering.

Reporting

Export scan results in various formats for reporting.

nmap -oN output.txt 192.168.1.1

This command outputs the results in a normal text file format.

Quick Reference Table

Pro Tips

• Combine options effectively; e.g., use -sS -p 1-1000 -A for fast scans with OS detection.
• Use -Pn to skip host discovery.
• Employ --top-ports to scan the most common ports quickly.

Real-World Examples

Here are some practical uses for Nmap:

• Identify all active devices on your network:

nmap -sn 10.0.0.0/24

• Scan for vulnerabilities on all web servers:

nmap --script http-vuln* -p 80,443 

• Conduct a stealth scan:

nmap -sS -T4 -p 1-1000 192.168.1.0/24