Security Tool Cheatsheet for Nmap

🛠 Security Tool Cheatsheet

Sarah Chen — SOC Analyst & Tool Specialist

What is Nmap?

Nmap (Network Mapper) is a powerful open-source tool for network discovery and security auditing. It is widely used by security professionals to discover hosts and services on a computer network, thus creating a ‘map’ of the network. Nmap can also be used for identifying potential vulnerabilities in the scanned devices.

Installation

Nmap is available on multiple platforms including Windows, macOS, and Linux. Here are the installation methods for different systems:

• Linux (Debian-based): Use the command sudo apt install nmap
• Linux (Red Hat-based): Use the command sudo yum install nmap
• macOS: Use Homebrew: brew install nmap
• Windows: Download from the official site: nmap.org/download.html

Basic Syntax

The basic syntax for executing Nmap is as follows:

nmap [Scan Type(s)] [Options] [Target]

Network Discovery

Nmap can be used for discovering hosts in a network.

nmap -sn 192.168.1.0/24

This command performs a ping scan to identify live hosts in the specified subnet.

Scanning and Service Enumeration

Once hosts are identified, Nmap can scan them for open ports and services.

nmap -sS -sV -p 1-65535 192.168.1.10

This command performs a TCP SYN scan and service version detection on all ports of the specified target.

Exploitation

Nmap can assist in exploiting vulnerabilities as well.

nmap --script vuln 192.168.1.10

This command runs vulnerability scripts against the target, providing insights into potential exploits.

Analysis

Nmap can output results in different formats for analysis and reporting.

nmap -oA scan_results 192.168.1.10

This command saves the results in all supported formats (.nmap, .xml, .gnmap) for later analysis.

Evasion Techniques

To evade detection by firewalls and IDS, use these commands:

nmap -D RND:10 192.168.1.10

This command uses decoy scanning techniques, making it harder for security devices to trace the source of the scan.

Reporting

Reporting the results in a summarized way can be done as follows:

nmap -oX scan_report.xml 192.168.1.10

This command outputs the scan in XML format, suitable for integrating with other tools.

Quick Reference Table

Pro Tips

• Use nmap -sS -A to enable aggressive scan mode, which performs OS detection, version detection, script scanning, and traceroute.
• Combine results with grep for easier searching: nmap -p 80,443 192.168.1.0/24 | grep "open".
• For stealthy scans, use timing templates: nmap -sS -T2 192.168.1.10.

Real-World Examples

Here are some practical examples of Nmap in use:

• Discover all devices in a subnet: nmap -sn 10.0.0.0/24.
• Scan a specific host for open ports: nmap -p 22,80,443 10.0.0.5.
• Find OS and version details: nmap -O -sV 10.0.0.5.