Nmap

Source: man nmap / nmap.org Author: Johan Beysen

---

1. What Is Nmap?

Nmap (Network Mapper) is the standard tool for network discovery and port scanning. It maps open ports, running services, versions and the OS.

---

2. Basic Syntax

nmap [options] [target]

Component	Example
Single IP	nmap 192.168.1.1
Subnet	nmap 192.168.1.0/24
IP range	nmap 192.168.1.1-50
Hostname	nmap target.com

---

3. Scan Types

3.1 Discovery Scans

# Host discovery (no port scan)
sudo nmap -sn 192.168.1.0/24

# Ping scan
sudo nmap -PE 192.168.1.0/24

3.2 Port Scans

# TCP SYN scan (stealthy, default as root)
sudo nmap -sS 192.168.1.1

# TCP Connect scan (without root)
nmap -sT 192.168.1.1

# UDP scan
sudo nmap -sU 192.168.1.1

# Scan all ports (1-65535)
sudo nmap -p- 192.168.1.1

# Specific ports
sudo nmap -p 22,80,443,8080 192.168.1.1

# Top 1000 ports (default)
sudo nmap 192.168.1.1

3.3 Service & Version Detection

# Service + version detection
sudo nmap -sV 192.168.1.1

# OS detection
sudo nmap -O 192.168.1.1

# Aggressive scan (sV + sC + O + traceroute)
sudo nmap -A 192.168.1.1

---

4. NSE Scripts

# Run default scripts
sudo nmap -sC 192.168.1.1

# Specific script
sudo nmap --script=http-title 192.168.1.1

# Script category
sudo nmap --script=vuln 192.168.1.1
sudo nmap --script=safe 192.168.1.1

# Multiple scripts
sudo nmap --script=http-enum,http-methods 192.168.1.1

Commonly used script categories

auth, broadcast, brute, default, discovery, dos, exploit, external, fuzzer, intrusive, malware, safe, version, vuln

---

5. Output Formats

# Normal output to a file
nmap -oN scan.txt 192.168.1.1

# XML output (for tools like Metasploit)
nmap -oX scan.xml 192.168.1.1

# Grepable output
nmap -oG scan.gnmap 192.168.1.1

# All formats at once
nmap -oA scan 192.168.1.1

Good habit

Always use -oA scan_name so the output is available in every format for later analysis.

---

6. Speed & Timing

Flag	Name	Use
-T0	Paranoid	IDS evasion, very slow
-T1	Sneaky	IDS evasion
-T2	Polite	Less bandwidth
-T3	Normal	Default
-T4	Aggressive	Fast, reliable network
-T5	Insane	Maximum speed

Production environments

Only use -T4 or higher on networks you're confident can handle it. -T5 can crash services.

---

7. Handy Combinations

# Standard pentest scan
sudo nmap -sV -sC -oA initial_scan 192.168.1.1

# Full scan with all ports
sudo nmap -sV -sC -p- -oA full_scan 192.168.1.1

# Quick subnet recon
sudo nmap -sn 192.168.1.0/24 -oG alive_hosts.gnmap

# Vulnerability scan
sudo nmap --script=vuln -oN vuln_scan.txt 192.168.1.1

# SMB specific
sudo nmap -p 139,445 --script=smb-vuln* 192.168.1.1

---

8. Evasion Techniques

# Fragment packets
sudo nmap -f 192.168.1.1

# Use decoys
sudo nmap -D RND:10 192.168.1.1

# Spoof the source port
sudo nmap --source-port 53 192.168.1.1

# Slow down the scan
sudo nmap --scan-delay 1s 192.168.1.1

Authorization only

Evasion techniques are only allowed in authorized penetration tests. Unauthorized use is a criminal offense.

---