Comprehensive Security Tool Cheatsheet for Nmap

📱 Mobile Security Tips

Sarah Chen — iOS Security Specialist

What is Nmap?

Nmap (Network Mapper) is a powerful open-source tool used for network discovery and security auditing. It is widely utilized by network administrators, security professionals, and penetration testers to discover hosts and services on a computer network, thus creating a ‘map’ of the network.

Installation

Nmap can be installed on various operating systems. Here are the quick commands for popular platforms:

# For Ubuntu/Debian
sudo apt-get install nmap

# For MacOS using Homebrew
brew install nmap

# For Windows, download the installer from https://nmap.org/download.html

Basic Syntax

nmap [options] [target]

Discovery

Use the following commands to perform network discovery:

# Discover live hosts in a subnet
nmap -sn 192.168.1.0/24

# Discover all devices in a local network with more verbosity
nmap -sP -v 192.168.1.0/24

Scanning

For scanning open ports and services, use:

# Scan for the most common 1000 ports
nmap -sS 192.168.1.5

# Scan a specific port
nmap -p 80,443 192.168.1.5

# Scan all ports (1-65535)
nmap -p- 192.168.1.5

Exploitation

Exploitation can be done in conjunction with Nmap scripts:

# Execute a script on a specific port
nmap --script http-vuln-* -p 80 192.168.1.5

Analysis

Analyzing vulnerabilities can be achieved with Nmap:

# Scan for OS detection and service/version detection
nmap -A 192.168.1.5

# Save output to a file for further analysis
nmap -oN output.txt 192.168.1.5

Evasion

To evade detection by firewalls and IDS:

# Scan using fragmented packets to evade firewalls
nmap -f 192.168.1.5

# Use TCP connect scan with a high timeout to evade slow responses
nmap -sT -p 80 --max-retries 1 --wait 2s 192.168.1.5

Reporting

For generating reports:

# Generate an XML report for use with other tools
nmap -oX report.xml 192.168.1.5

# Output to HTML format
nmap -oA output 192.168.1.5

Quick Reference Table

Pro Tips

• Use -Pn: To treat all hosts as online even if they did not respond to the ping.
• Increase verbosity: Use -v multiple times for more detailed output.
• Timing templates: Use -T0 to -T5 to control scan speed (0 = slower, stealthier; 5 = faster, noisier).

Real-World Examples

Nmap can be a game changer in multiple scenarios:

• Performing Compliance Audits: Use Nmap to check for open ports and services running on devices to ensure compliance with security policies.
• Assessing Web Application Security: Use specific scripts to check for vulnerabilities in web applications, such as cross-site scripting or SQL injection.