Ultimate Nmap Cheat Sheet

The Network Mapper. Discover hosts, services, and vulnerabilities across networks.

Jump To Section

• Basic Scanning
• Port Specification
• Service Detection
• NSE Scripts
• Output Formats
• Firewall Evasion

1. Basic Scanning Techniques

Fundamental scan types for host discovery and port scanning.

TCP SYN Scan (Stealth)

nmap -sS 192.168.1.0/24

Half-open scan. Requires root privileges. Fast and less likely to be logged.

TCP Connect Scan

nmap -sT 192.168.1.10

Full TCP connection. No root required. More detectable.

UDP Scan

nmap -sU --top-ports 100 192.168.1.10

Scans UDP ports. Slower than TCP. Combine with -sS for comprehensive coverage.

Host Discovery

• -sn : Ping sweep (no port scan)
• -Pn : Skip host discovery
• -PS 80,443 : TCP SYN ping
• -PA 80,443 : TCP ACK ping
• -PU 53 : UDP ping

Scan Techniques

• -sS : TCP SYN (stealth)
• -sT : TCP Connect
• -sU : UDP scan
• -sA : TCP ACK (firewall)
• -sW : TCP Window
• -sM : TCP Maimon

2. Port Specification

Specific Ports

nmap -p 80,443,8080 192.168.1.10

Port Range

nmap -p 1-1000 192.168.1.10

All Ports (Full Scan)

nmap -p- 192.168.1.10

Flag	Description	Example
-p 80	Single port	-p 80
-p 1-1000	Port range	-p 1-1000
-p-	All 65535 ports	-p-
--top-ports 100	Top 100 common ports	--top-ports 100
-F	Fast scan (top 100)	-F
--exclude-ports	Skip specific ports	--exclude-ports 22,445

Pro Tip: Port Ratio
Use --port-ratio 0.5 to scan ports more common than the given ratio. Faster than full scan but more comprehensive than top-ports.

3. Service & OS Detection

Version Detection

nmap -sV --version-intensity 9 192.168.1.10

OS Fingerprinting

nmap -O --osscan-guess 192.168.1.10

Aggressive Scan (Everything)

nmap -A -T4 192.168.1.10

Version Detection

• -sV : Service/version detection
• --version-intensity <0-9> : Probe intensity
• --version-light : Quick (intensity 2)
• --version-all : Aggressive (intensity 9)
• --version-trace : Debug version scan

OS Detection

• -O : Enable OS detection
• --osscan-limit : Only guess if promising
• --osscan-guess : Aggressive guessing
• --max-os-tries 1 : Retry limit
• -A : OS + version + scripts + traceroute

4. NSE Scripts (Nmap Scripting Engine)

Run Vulnerability Scripts

nmap --script vuln 192.168.1.10

Run Specific Script

nmap --script http-enum 192.168.1.10

Run with Arguments

nmap --script http-brute --script-args 'userdb=users.txt,passdb=pass.txt' 192.168.1.10

Category	Description	Example
auth	Authentication bypass	--script auth
brute	Brute force attacks	--script brute
discovery	Service discovery	--script discovery
exploit	Exploitation scripts	--script exploit
vuln	Vulnerability detection	--script vuln

Useful NSE Scripts

Web Enumeration

• http-enum : Directory enumeration
• http-title : Get page titles
• http-headers : HTTP headers analysis
• http-robots.txt : Check robots.txt

SMB/Windows

• smb-enum-shares : List SMB shares
• smb-enum-users : Enumerate users
• smb-vuln-ms17-010 : EternalBlue check
• smb-os-discovery : OS via SMB

SSL/TLS

• ssl-enum-ciphers : Cipher enumeration
• ssl-cert : Certificate info
• ssl-heartbleed : Heartbleed check
• ssl-poodle : POODLE check

DNS

• dns-zone-transfer : Zone transfer test
• dns-brute : Subdomain brute force
• dns-cache-snoop : Cache snooping
• dns-recursion : Recursion test

5. Output Formats

Normal Output

nmap -oN output.txt 192.168.1.10

XML Output (Parseable)

nmap -oX output.xml 192.168.1.10

Grepable Output

nmap -oG output.gnmap 192.168.1.10

All Formats

nmap -oA scan_results 192.168.1.10

Flag	Format	Use Case
-oN <file>	Normal	Human readable
-oX <file>	XML	Tool integration
-oG <file>	Grepable	grep/awk processing
-oA <basename>	All formats	Complete output
--stylesheet	XSL for XML	HTML report

6. Firewall Evasion & IDS Bypass

Fragment Packets

nmap -f 192.168.1.10

Custom MTU

nmap --mtu 8 192.168.1.10

Decoy Scan

nmap -D 10.0.0.1,10.0.0.2,ME 192.168.1.10

Spoof Source Port

nmap --source-port 53 192.168.1.10

Flag	Technique	Description
-f	Fragment packets	Split TCP headers
--mtu <size>	Custom MTU	Must be multiple of 8
-D <decoy1,...>	Decoy scan	Hide real scanner
--source-port <port>	Source port spoof	Bypass ACLs
--data-length <num>	Append data	Hide in payload
--randomize-hosts	Randomize order	Avoid detection
--spoof-mac <mac>	MAC spoofing	Hide on LAN
--badsum	Invalid checksum	Test IDS/IPS

Warning:

Firewall evasion techniques are for authorized testing only. High packet fragmentation (-f) can crash legacy systems. Always test in controlled environments first.

Timing Templates

Paranoid (T0)

• Serial scanning
• 5 min between probes
• Best for IDS evasion
• -T0

Sneaky (T1)

• Serial scanning
• 15 sec between probes
• Good for IDS evasion
• -T1

Polite (T2)

• Slower scanning
• 0.4 sec between probes
• Less bandwidth usage
• -T2

Normal (T3)

• Default speed
• Balanced approach
• Good for most scans
• -T3

Aggressive (T4)

• Fast scanning
• Assumes fast network
• Might miss some ports
• -T4

Insane (T5)

• Fastest scanning
• May overwhelm targets
• High packet loss risk
• -T5

⇧