Nmap

Host discovery, port scanning, service detection, NSE scripts & firewall evasion

Nmap Cheat Sheet

The essential Nmap commands for host discovery, port scanning, service/version detection, NSE scripts, and firewall evasion. For authorized testing only — practice on the AYSEC labs and scanme.nmap.org.

Targets

nmap 10.10.10.10
nmap 10.10.10.0/24
nmap 10.10.10.1-50
nmap -iL targets.txt          # read targets from a file
nmap 10.10.10.0/24 --exclude 10.10.10.5

Host discovery

nmap -sn 10.10.10.0/24        # ping sweep, no port scan
nmap -Pn 10.10.10.10          # skip discovery (for firewalled hosts that drop ping)
nmap -PS22,80,443 <target>    # TCP SYN ping to specific ports
nmap -n <target>              # no DNS resolution (faster)

Scan types

Flag	Scan
-sS	SYN / half-open (default as root — fast, stealthy)
-sT	full TCP connect (no root needed)
-sU	UDP
-sV	service / version detection
-sC	run default NSE scripts
-O	OS detection
-A	aggressive: -sV -O -sC --traceroute

Ports

-p 80,443            # specific ports
-p-                  # all 65,535
-p U:53,T:80         # mixed UDP + TCP
-F                   # fast scan (top 100)
--top-ports 1000

The scans you'll actually run

# Scripts + versions on the open ports, save every output format
nmap -sC -sV -oA scan 10.10.10.10

# All ports fast, then version-scan only the ones that are open
nmap -p- --min-rate 5000 -T4 10.10.10.10 -oG quick.gnmap

Timing & performance

-T0 ... -T5          # paranoid → insane (use -T4 normally)
--min-rate 1000      # packets/sec floor
--max-retries 1
--host-timeout 30m

NSE scripts

--script=default
--script=vuln                 # known-vulnerability checks
--script=http-enum
--script=smb-enum-shares,smb-os-discovery
--script "http-*" -p80
nmap --script-help=ssl-enum-ciphers

Scripts live in /usr/share/nmap/scripts/. Categories: auth, brute, default, discovery, exploit, safe, vuln.

Output

-oN out.txt          # normal
-oG out.gnmap        # greppable
-oX out.xml          # XML
-oA scan             # all three at once
-v / -vv             # verbose
--reason             # explain why a port is in its state

Firewall / IDS evasion

-Pn                  # no ping
-f                   # fragment packets
-D RND:10            # random decoys
-S <spoofed-ip>      # spoof source address
--source-port 53     # appear to come from a trusted port
--data-length 25     # pad packets
-T2                  # go slow to stay under thresholds

Handy one-liners

# Find live hosts, then deep-scan only those
nmap -sn 10.10.10.0/24 -oG - | awk '/Up$/{print $2}' > live.txt
nmap -sC -sV -iL live.txt -oA full

# Quick all-ports, then service-scan just the open set
nmap -p- --min-rate 5000 -T4 10.10.10.10 -oG quick.gnmap
ports=$(grep -oP '\d+/open' quick.gnmap | cut -d/ -f1 | paste -sd,)
nmap -sC -sV -p$ports 10.10.10.10

Only scan systems you own or are explicitly authorized to test. Sharpen your recon on the AYSEC labs.