Nmap Security Tool Cheatsheet

🛠 Security Tool Cheatsheet

Sarah Chen — SOC Analyst & Tool Specialist

What is Nmap?

Nmap (Network Mapper) is a powerful open-source tool used for network discovery and security auditing. It is ideal for identifying hosts and services on a network, conducting security assessments, and finding potential vulnerabilities.

Installation

You can install Nmap on various operating systems.

• Linux: Run sudo apt install nmap or sudo yum install nmap.
• macOS: Use Homebrew with brew install nmap.
• Windows: Download from the Nmap official site.

Basic Syntax

The basic syntax for using Nmap is:

nmap [options] [target]

Discovery

Ping Scan

To quickly check which hosts are up on a network, use:

nmap -sn 192.168.1.0/24

Service Discovery

To detect services and their versions, run:

nmap -sV 192.168.1.10

Scanning

Full TCP Scan

This command scans for open TCP ports:

nmap -sS 192.168.1.10

UDP Scan

To perform a UDP scan, use:

nmap -sU 192.168.1.10

Exploitation

Scan for Vulnerabilities

Integrate Nmap with scripts to find vulnerabilities:

nmap --script vuln 192.168.1.10

Analysis

Output Formats

Specify output format for further analysis:

nmap -oA output_file 192.168.1.10

Evasion

Aggressive Scan Flag

Bypass some firewall rules using:

nmap -A 192.168.1.10

Reporting

Generate Reports

Export your scan results to XML format:

nmap -oX report.xml 192.168.1.10

Quick Reference Table

Flag	Description
-sS	TCP SYN scan
-sU	UDP Scan
-sV	Service version detection
-A	Aggressive scan
-oA	Output in all formats

Pro Tips

• Use -p- to scan all ports (1-65535).
• Keen on stealth: Consider using -Pn to avoid pinging targets.
• Utilize timing templates like -T4 for faster scanning.

Real-World Examples

Example 1: Scanning a Range of IPs

To scan for open ports across a subnet:

nmap -p 22,80,443 192.168.1.0/24

Example 2: Scanning with OS Detection

To detect the OS of a device:

nmap -O 192.168.1.10