Nmap Security Tool Cheatsheet

📱 Mobile Security Tips

Sarah Chen — iOS Security Specialist

What is Nmap?

Nmap (Network Mapper) is an open-source tool for network exploration and security auditing. It is widely used by penetration testers, network administrators, and security professionals to discover hosts and services on a computer network, thus creating a ‘map’ of the network.

Installation

Nmap can be installed on various operating systems. Below are the common installation commands:

# For Debian/Ubuntu
sudo apt install nmap

# For Red Hat/CentOS
sudo yum install nmap

# For macOS
brew install nmap

# For Windows
Download installer from the official website: https://nmap.org/download.html

Basic Syntax

The basic syntax for using Nmap is:

nmap [options] 

Discovery

Discovery commands help identify live hosts on a network.

# Ping scan to find live hosts
nmap -sn 192.168.0.0/24

Scanning

Scanning allows for gathering information about the services running on the hosts.

# Scan for open ports on a single host
nmap 192.168.1.1

# Scan a range of IPs for open ports
nmap 192.168.1.1-10

Exploitation

Nmap can be complemented with scripts for exploiting services.

# Run scripts for enumeration of the discovered services
nmap --script=vuln 192.168.1.1

Analysis

Analyze scan results to identify vulnerabilities.

# Save results to a file for further analysis
nmap -oN output.txt 192.168.1.1

Evasion

Use options to evade detection by security systems.

# Fragment packets to avoid detection
nmap -f 192.168.1.1

Reporting

Generate reports in different formats.

# Output results in XML format
nmap -oX output.xml 192.168.1.1

Quick Reference Table

Pro Tips

• Combine scans: Use multiple scan types (e.g., nmap -sS -sV 192.168.1.1 for stealth SYN scan with service version detection).
• Use -T to adjust timing: nmap -T4 192.168.1.1 (T4 is faster but more detectable).
• Utilize [NSE](https://nmap.org/nsedoc/) scripts for extended functionality (e.g., vulnerability checks).

Real-World Examples

1. Identify all services: nmap -sS -sV -O 192.168.1.1 (stealth SYN scan with service and OS detection).
2. Scan an entire subnet: nmap -p- 192.168.0.0/16 (scan all ports on the specified subnet).