🧹 Introduction
Nmap (Network Mapper) is a powerful open-source tool used by ethical hackers, network administrators, and security professionals for network discovery and security auditing. Whether you’re scanning for open ports, fingerprinting services, or detecting operating systems, Nmap offers a flexible and scriptable environment to gain critical insights into your network. This cheat sheet is designed to serve as a quick reference for some of the most common and useful Nmap commands.
🔧 Basic Usage
Nmap 7.80 ( https://nmap.org )
Usage: nmap [Scan Type(s)] [Options] {target specification}
# Examples:
nmap 192.168.1.1 # Scan a single IP
nmap 192.168.1.1 192.168.1.2 # Scan multiple IPs🚀 Common Nmap Scans
sudo nmap -sn <target> # Ping Scan sudo nmap -sS <target> # TCP SYN Scan sudo nmap -sT <target> # Connect Scan sudo nmap -sU <target> # UDP Scan sudo nmap -A <target> # Aggressive Scan sudo nmap -T4 -F <target> # Quick Scan
🔖 Port Specification
sudo nmap -p 22,80,443 <target> # Scan Specific Ports sudo nmap -p 1-1000 <target> # Scan Port Ranges sudo nmap -p- <target> # Scan All Ports sudo nmap -F <target> # Fast port scan (100 ports) sudo nmap -top-ports 1000 # Port scan the top x ports
🧠 OS and Service Detection
sudo nmap -O <target> # Operating System Detection sudo nmap -sV <target> # Service Version Detection sudo nmap -A <target> # Enable OS, version script scan sudo nmap -sV -version-all <target> # Intensity level 9 but slower sudo nmap -sV -version-intensity 8 <target> # Intensity level 0 to 9, Higher the better sudo nmap -sV -version-light <target> # Enable light mode. Lower possibility of correctness. Faster
🔍 Host Discovery
sudo nmap -n <target> # No DNS Resolution sudo nmap -sL <target> # List Target Only sudo nmap -PR <target> # ARP Scan (Local Network) sudo nmap -Pn <target> # Disable host discovery, Port scan only sudo nmap -PS <target> # TCP SYN discovery on port x sudo nmap -PA <target> # TCP ACK discovery on port x sudo nmap -PU <target> # UDP discovery on port x
🎯 Target Specification
sudo nmap 192.168.1.1-254 # IP Ranges sudo nmap 192.168.1.0/24 # CIDR Notation sudo nmap -iL target.txt # Input From File sudo nmap 192.168.1.0/24 --exclude 192.168.1.5 # Exclude Hosts
⏱ Timing and Performance
# Timing Templates sudo nmap -T0 <target> # Paranoid (0) Intrusion Detection System evasion sudo nmap -T1 <target> # Sneaky (1) Intrusion Detection System evasion sudo nmap -T2 <target> # Polite (2) slows down the scan to use less bandwidth sudo nmap -T3 <target> # Normal (3) which is default speed sudo nmap -T4 <target> # Aggressive (4) speeds scans; sudo nmap -T5 <target> # Aggressive (4) speeds scans; assumes you are on a reasonably fast and reliable network sudo nmap --max-retries <num> # Max Retries sudo nmap --scan-delay <time> # Scan Delay
🛠 NSE Scripts (Nmap Scripting Engine)
sudo nmap -sC <target> # Default Scripts sudo nmap --script=http-title <target> # Specific Script sudo nmap --script=vuln <target> # By Categories sudo nmap -sV --script=vuln <target> # Combine with Version Detection sudo nmap --script=banner <target> # Grabbing banner sudo nmap --script=http* <target> # Scan with wildcard http sudo nmap --script=http-sql-injection <target> # Check for SQL injections sudo nmap -p3306 --script=mysql-empty-password <target> # Checking Empty password sudo nmap -p80 --script=http-unsafe-output-escaping <target> # Detect cross site scripting vulnerabilities sudo nmap -n -Pn -vv -O -sV --script smb-enum*,smb-ls,smb-mbenum,smb-os-discovery,smb-s*,smb-vuln*,smbv2* <target> # Safe SMB scripts to run sudo nmap -n -Pn -p80 --open -sV -vvv --script=banner,http-title -iR 1000 <target> # Fast search for random web servers
📁 Output Formats and Examples
sudo nmap -oN output.txt <target> # Normal Output sudo nmap -oG output.txt <target> # Grepable Output sudo nmap -oX output.xml <target # XML Output sudo nmap -oA output.txt <target> # All Formats sudo nmap -p80 -sV -oG - --open <CIDR IPs> | grep open # Scan for web servers and grep to show which IPs are running web servers sudo nmap -iR 10 -n -oX out.xml <CIDR IPs> | grep "Nmap" | cut -d " " -f5 > live-hosts.txt # Generate a list of the IPs of live hosts
📌 Useful Examples
sudo nmap -p 80,443 --open <target> # Find Open Web Ports sudo nmap -sn 10.0.0.0/24 # Find Live Hosts in Subnet sudo nmap -Pn -p 80,443 <target> # Firewall Evasion Check sudo nmap -T4 -F <target> -oA initial.txt # Initial Scan sudo nmap -Pn -sV -sC -pxx,xxx,xxx <target> -oA moderate-scan.txt
🚡 Legal & Ethical Reminder
Always scan responsibly. Make sure you have explicit permission to scan any network or host. Unauthorized scanning can be illegal and unethical. Refer to local laws such as the Computer Fraud and Abuse Act (CFAA) in the U.S. or similar laws in your jurisdiction.
🧠 Final Thoughts
Nmap is a cornerstone tool in the world of ethical hacking and network troubleshooting. Mastering its essential scans can dramatically improve your situational awareness and operational efficiency. Use this cheat sheet as a launchpad for your Nmap learning and incorporate it into your daily toolkit. And remember—with great scanning power comes great responsibility.
