Nmap Commands Cheat Sheet

# Nmap Commands Cheat Sheet ⚠️ Only run these against systems you own or have explicit written permission to scan. --- ## Basic Scans ```bash # Scan a single target (default 1000 common ports) nmap 192.168.1.1 # Scan multiple targets nmap 192.168.1.1 192.168.1.2 192.168.1.3 # Scan an entire subnet nmap 192.168.1.0/24 # Scan a range of IPs nmap 192.168.1.1-50 # Scan a hostname nmap example.com ``` --- ## Port Selection ```bash # Scan specific ports nmap -p 22,80,443 192.168.1.1 # Scan a port range nmap -p 1-1000 192.168.1.1 # Scan all 65,535 ports nmap -p- 192.168.1.1 # Scan the 100 most common ports (fast) nmap -F 192.168.1.1 # Scan top N most common ports nmap --top-ports 20 192.168.1.1 ``` --- ## Scan Types ```bash # TCP Connect scan (default, completes full handshake) nmap -sT 192.168.1.1 # SYN scan / "half-open" scan (stealthier, faster) nmap -sS 192.168.1.1 # UDP scan nmap -sU 192.168.1.1 # Combine TCP + UDP scan nmap -sS -sU 192.168.1.1 # Ping scan only (host discovery, no port scan) nmap -sn 192.168.1.0/24 ``` --- ## Detection & Fingerprinting ```bash # Detect service versions nmap -sV 192.168.1.1 # Detect operating system nmap -O 192.168.1.1 # Aggressive scan (OS + version + scripts + traceroute) nmap -A 192.168.1.1 # Run default scripts (NSE) nmap -sC 192.168.1.1 # Combine version detection with default scripts nmap -sV -sC 192.168.1.1 ``` --- ## Timing & Performance ```bash # Set timing template (0 = slowest/stealthiest, 5 = fastest/noisiest) nmap -T4 192.168.1.1 # Increase verbosity nmap -v 192.168.1.1 # Very verbose output nmap -vv 192.168.1.1 ``` --- ## Evasion & Special Cases ```bash # Skip host discovery (treat host as online, scan anyway) nmap -Pn 192.168.1.1 # Spoof source port nmap --source-port 53 192.168.1.1 # Fragment packets (evasion technique) nmap -f 192.168.1.1 # Randomize target scan order nmap --randomize-hosts 192.168.1.0/24 ``` --- ## Output Options ```bash # Save output to a normal text file nmap 192.168.1.1 -oN output.txt # Save output in XML format nmap 192.168.1.1 -oX output.xml # Save output in all formats at once nmap 192.168.1.1 -oA output # Save in grepable format nmap 192.168.1.1 -oG output.gnmap ``` --- ## Handy Combos ```bash # Quick full scan with service + OS detection nmap -sS -sV -O -T4 192.168.1.1 # Full port range + version detection nmap -p- -sV 192.168.1.1 # Complete network sweep nmap -sn 192.168.1.0/24 # Deep single-host assessment nmap -A -p- -T4 192.168.1.1 ``` --- ### Reading the Results - **open** → a service is actively listening - **closed** → port is reachable, nothing is listening - **filtered** → a firewall is blocking Nmap from determining the state