Comprehensive Nmap Cheatsheet for Security Professionals

📱 Mobile Security Tips

Sarah Chen — iOS Security Specialist

What is Nmap?

Nmap (Network Mapper) is an open-source tool designed for network exploration and security auditing. It’s commonly used by security professionals for discovering hosts and services on a computer network by sending packets and analyzing the responses.

Installation

Nmap can be installed on various operating systems. Use the following commands based on your OS:

• Windows: Download the installer from nmap.org and run it.
• Linux: Use your distribution’s package manager.

# Debian/Ubuntu
sudo apt install nmap

# CentOS/Fedora
sudo dnf install nmap

# Arch Linux
sudo pacman -S nmap

• macOS: Use Homebrew.

brew install nmap

Basic Syntax

The basic command structure for Nmap is:

nmap [Options] [Target]

Discovery

Basic Host Discovery

nmap -sn 192.168.1.0/24

Use this command to perform a simple ping scan over a subnet, identifying live hosts.

Service Discovery

nmap -sV 192.168.1.1

This command retrieves service versions for open ports on the target.

Scanning

Port Scanning

nmap -p 1-1000 192.168.1.1

Scans the first 1000 ports on the target IP.

Aggressive Scan

nmap -A -T4 192.168.1.1

The -A flag enables OS detection, version detection, script scanning, and traceroute.

Exploitation

Running Scripts

nmap --script vuln 192.168.1.1

Use the script engine to run vulnerability scans against the target.

Analysis

Output Formats

Capture output in different formats for analysis:

Example: Save to XML

nmap -p 1-65535 -oX scan.xml 192.168.1.1

Evasion

Bypass Firewalls

nmap -Pn -f 192.168.1.1

This command uses the -Pn flag to skip host discovery and -f to fragment packets, helping bypass simple packet filters.

Reporting

Generate Comprehensive Reports

nmap -oA my_scan 192.168.1.1

This creates all output formats (normal, XML, and grepable) with the prefix “my_scan”.

Pro Tips

• Use the -sC flag for quick script scanning, which utilizes Nmap’s built-in scripts.
• Explore different timing templates using the -T option to optimize scan speed and stealthiness.
• Combine host discovery and port scanning in a single command: nmap -sP -p- 192.168.1.0/24.

Real-World Examples

Scanning an Entire Subnet

nmap -A -sP 192.168.1.0/24

Identifying Specific Vulnerabilities

nmap --script http-vuln* -p 80,443 192.168.1.1

This command targets known HTTP vulnerabilities on specific ports.