NMAP Cheat Sheet

Computer NetworkNetworkMCA

Nmap is a free open source tool, employed to discover hosts and services on a computer network by sending packets and analyzing the retrieved responses. Nmap offers some features for probing computer networks, including host discovery and service and operating system detection.

  • Nmap can provide further information on targets, including reverse DNS names, device types, and MAC addresses.

  • Host discovery – Identifying hosts on a network. For example, listing the hosts that respond to TCP and/or ICMP requests or have a particular port open.

  • Port scanning – Enumerating the open ports on target hosts.

  • OS detection – Determining the operating system and hardware characteristics of network devices.

  • Version detection – Interrogating network services on remote devices to determine the application name and version number.

  • Scriptable interaction with the target support using the Nmap Scripting Engine (NSE).

Usage of Nmap

  • Auditing the security of a device or firewall by identifying the network connections which can be made to, or through it.

  • Identifying open ports on a target host in preparation for auditing.

  • Network inventory, network mapping, and maintenance and asset management.

  • Auditing the security of a network by identifying new servers.

  • Generating traffic to hosts on a network, response analysis and response time measurement.

  • Finding and exploiting vulnerabilities in a network.

  • DNS queries and subdomain search

NMAP Commands Cheatsheet

The following section explains the usage of category-wise NMAP diverse commands with examples as following -

Basic Scanning Commands

GoalCommandExample
Scan a Single Targetnmap [target]nmap 192.168.0.1
Scan Multiple Targetsnmap [target1, target2, etcnmap 192.168.0.1 192.168.0.2
Scan a Range of Hostsnmap [range of ip addresses]nmap 192.168.0.1-10
Scan an Entire Subnetnmap [ip address/cdir]nmap 192.168.0.1/24
Scan Random Hostsnmap -iR [number]nmap -iR 0
Excluding Targets from a Scannmap [targets] – exclude [targets]nmap 192.168.0.1/24 –exclude 192.168.0.100, 192.168.0.200
Excluding Targets Using a Listnmap [targets] – excludefile [list.txt]nmap 192.168.0.1/24 –excludefile notargets.txt
Perform an Aggressive Scannmap -A [target]nmap -A 192.168.0.1
Scan an IPv6 Targetnmap -6 [target]nmap -6 1aff:3c21:47b1:0000:0000:0000:0000:2afe

Discovery Options

GoalCommandExample
Perform a Ping Only Scannmap -sP [target]nmap -sP 192.168.0.1
Don’t Pingnmap -PN [target]nmap -PN 192.168.0.1
TCP SYN Pingnmap -PS [target]nmap -PS 192.168.0.1
TCP ACK Pingnmap -PA [target]nmap -PA 192.168.0.1
UDP Pingnmap -PU [target]nmap -PU 192.168.0.1
SCTP INIT Pingnmap -PY [target]nmap -PY 192.168.0.1
ICMP Echo Pingnmap -PE [target]nmap -PE 192.168.0.1
ICMP Timestamp Pingnmap -PP [target]nmap -PP 192.168.0.1
CMP Address Mask Pingnmap -PM [target]nmap -PM 192.168.0.1
IP Protocol Pingnmap -PO [target]nmap -PO 192.168.0.1


ARP Pingnmap -PR [target]nmap -PR 192.168.0.1
Traceroutenmap –traceroute [target]nmap –traceroute 192.168.0.1
Force Reverse DNS Resolutionnmap -R [target]nmap -R 192.168.0.1
Disable Reverse DNS Resolutionnmap -n [target]nmap -n 192.168.0.1
Alternative DNS Lookupnmap –system-dns [target]nmap –system-dns 192.168.0.1
Manually Specify DNS Server(s)nmap –dns-servers [servers] [target]nmap –dns-servers 201.56.212.54 192.168.0.1
Create a Host Listnmap -sL [targets]nmap -sL 192.168.0.1/24

Advanced Scanning Options

GoalCommandExample
TCP SYN Scannmap -sS [target]nmap -sS 192.168.0.1
TCP Connect Scannmap -sT [target]nmap -sT 192.168.0.1
UDP Scannmap -sU [target]nmap -sU 192.168.0.1
TCP NULL Scannmap -sN [target]nmap -sN 192.168.0.1
TCP FIN Scannmap -sF [target]nmap -sF 192.168.0.1
Xmas Scannmap -sX [target]nmap -sX 192.168.0.1
TCP ACK Scannmap -sA [target]nmap -sA 192.168.0.1
Custom TCP Scannmap –scanflags [flags] [target]nmap –scanflags SYNFIN 192.168.0.1
IP Protocol Scannmap -sO [target]nmap -sO 192.168.0.1
Send Raw Ethernet Packetsnmap –send-eth [target]nmap –send-eth 192.168.0.1
Send IP Packetsnmap –send-ip [target]nmap –send-ip 192.168.0.1

Port Scanning Options

GoalCommandExample
Perform a Fast Scannmap -F [target]nmap -F 192.168.0.1
Scan Specific Portsnmap -p [port(s)] [target]nmap -p 21-25,80,139,8080 192.168.1.1
Scan Ports by Namenmap -p [port name(s)] [target]nmap -p ftp,http* 192.168.0.1
Scan Ports by Protocolnmap -sU -sT -p U: [ports],T:[ports] [target]nmap -sU -sT -p U:53,111,137,T:21- 25,80,139,8080 192.168.0.1
Scan All Portsnmap -p ‘*’ [target]nmap -p ‘*’ 192.168.0.1
Scan Top Portsnmap –top-ports [number] [target]nmap –top-ports 10 192.168.0.1
Perform a Sequential Port Scannmap -r [target]nmap -r 192.168.0.1

Version Detection

GoalCommandExample
Operating System Detectionnmap -O [target]nmap -O 192.168.0.1
Submit TCP/IP Fingerprintswww.nmap.org/submit/
Fingerprints

Attempt to Guess an Unknown OSnmap -O –osscan guess [target]nmap -O –osscan-guess 192.168.0.1
Service Version Detectionnmap -sV [target]nmap -sV 192.168.0.1
Troubleshooting Version Scansnmap -sV –version trace [target]nmap -sV –version-trace 192.168.0.1
Perform a RPC Scannmap -sR [target]nmap -sR 192.168.0.1

Firewall Evasion Techniques

GoalCommandExample
augment Packetsnmap -f [target]nmap -f 192.168.0.1
pacify a Specific MTUnmap –mtu [MTU] [target]nmap –mtu 32 192.168.0.
Use a Decoynmap -D RND:[number] [target]nmap -D RND:10 192.168.0.1
le Zombie Scannmap -sI [zombie] [target]nmap -sI 192.168.0.38
Manually Specify a Source Portnmap –source-port [port] [target]nmap –source-port 10 192.168.0.1
Append Random Datanmap –data-length [size] [target]nmap –data-length 2 192.168.0.1
Randomize Target Scan Ordernmap –randomize-hosts [target]nmap –randomize-ho 192.168.0.1-20
Spoof MAC Addressnmap –spoof-mac [MAC|0|vendor] [target]nmap –spoof-mac Cis 192.168.0.1
Send Bad Checksumsnmap –badsum [target]nmap –badsum 192.168.0.1

Troubleshooting And Debugging

GoalCommandExample
Getting Helpnmap -hnmap -h
Display Nmap Versionnmap -Vnmap -V
Verbose Outputnmap -v [target]nmap -v 192.168.0.1
Debuggingnmap -d [target]nmap -d 192.168.0.1
Display Port State Reasonnmap –reason [target]nmap –reason 192.168.0.1
Only Display Open Portsnmap –open [target]nmap –open 192.168.0.1
Trace Packetsnmap –packet-trace [target]nmap –packet-trace 192.168.0.1
Display Host Networkingnmap –iflistnmap –iflist
Specify a Network Interfacenmap -e [interface] [target]nmap -e eth0 192.168.0.1

NMAP Scripting Engine

GoalCommandExample
Execute Individual Scriptsnmap –script [script.nse] [target]nmap –script banner.nse 192.168.0.1
Execute Multiple Scriptsnmap –script [expression] [target]nmap –script ‘http-*’ 192.168.0.1
Script Categoriesall, auth, default, discovery, external, intrusive, malware, safe, vuln
Execute Scripts by Categorynmap –script [category] [target]nmap –script ‘not intrusive’ 192.168.0.1
Execute Multiple Script Categoriesnmap –script [category1,category2,etc]nmap –script ‘default or safe’ 192.168.0.1
Troubleshoot Scriptsnmap –script [script] –script trace [target]nmap –script banner.nse –script-trace 192.168.0.1
Update the Script Databasenmap –script-updatedbnmap –script-updatedb
raja
Published on 18-Mar-2020 07:44:24
Advertisements