Comprehensive Cheatsheet for Nmap

🛠 Security Tool Cheatsheet

Sarah Chen — SOC Analyst & Tool Specialist

What is Nmap?

Nmap, short for Network Mapper, is an open-source tool designed for network discovery and security auditing. It allows users to identify devices on a network, discover services those devices are offering, and assess the security of those services.

Installation

Nmap can be installed on various operating systems, including Windows, Linux, and macOS. On most Linux distributions, you can install it using the package manager. For example:

sudo apt install nmap  # For Debian/Ubuntu

For Windows, download the installer from the official Nmap website.

Basic Syntax

The basic syntax for Nmap commands is:

nmap [options] [targets]

Where [options] include a variety of flags and [targets] can be IP addresses or domain names.

Discovery

Nmap can be used effectively to discover hosts and services on a network. Here are some practical commands:

nmap -sn 192.168.1.0/24  # Ping scan to discover active hosts

This command performs a ping scan without port scanning, useful for quickly finding live hosts.

Scanning

To perform detailed port scanning, use the following command:

nmap -sS -p 1-65535 192.168.1.1  # TCP SYN scan on all ports

Using -sS initiates a stealth scan that doesn’t complete the TCP handshake.

Exploitation

With the correct options and flags, Nmap can aid in exploitation phases by finding vulnerable services:

nmap -sV --script=vuln 192.168.1.1  # Version detection and vulnerability detection

This scans services, identifies their versions, and runs relevant vulnerability scripts.

Analysis

For post-scan analysis, output formats can be important:

nmap -oA scan_output 192.168.1.1  # Output in all formats (normal, XML, grepable)

Evasion

To evade detection by firewalls and IDS, consider using:

nmap -f 192.168.1.1  # Fragment packets

Fragmentation can help bypass filtering mechanisms.

Reporting

To generate targeted reports, use:

nmap -oG report.txt 192.168.1.1  # Print results in grepable format

Quick Reference Table

Here’s a quick reference table for commonly used flags:

Pro Tips

• Use -Pn if the target might block ICMP traffic and you want to skip host discovery.
• Run Nmap as a non-root user with the --unprivileged flag to perform some scans without needing root privileges.

Real-World Examples

Using techniques learned, here are some real-world scenarios:

nmap -sS -p T:80,443 -A -T4 10.0.0.1  # Fast and aggressive scan

This command rapidly identifies web services and enables aggressive detection techniques.

nmap --top-ports 20 192.168.1.0/24  # Scanning the top 20 most common ports

This is a quick way to limit scans to the most used ports, saving time.