Nmap Security Cheat Sheet

Network Discovery. Port Scanning. Security Assessment.

Master network reconnaissance with Nmap (Network Mapper). Your complete reference guide to port scanning, service detection, OS fingerprinting, and vulnerability assessment. From basic discovery to advanced stealth techniques.

#🔍 What is Nmap?

Nmap is a powerful network discovery and security auditing tool used to discover hosts, services, and vulnerabilities across networks. It's essential for network administrators, security professionals, and ethical hackers.

650+

NSE Scripts

15+

Scan Types

Expert

Level Tool

#⚠️ Legal and Ethical Warning

• Permission Required: Only scan networks you own or have explicit permission to test
• Responsible Use: Use Nmap ethically for security assessment and education
• Rate Limiting: Aggressive scans can impact network performance
• Legal Compliance: Unauthorized scanning may violate laws in your jurisdiction
• Documentation: Always document your scanning activities for legitimate purposes

#🎯 Basic Discovery & Host Detection

Essential commands for network discovery and host enumeration

Basic
                        
                            nmap 192.168.1.1
                            Copy
                        
                        Basic scan of a single host
                    

                    
                        Basic
                        
                            nmap 192.168.1.0/24
                            Copy
                        
                        Scan entire subnet (CIDR notation)
                    

                    
                        Basic
                        
                            nmap 192.168.1.1-50
                            Copy
                        
                        Scan IP range (1 through 50)
                    

                    
                        Basic
                        
                            nmap -sn 192.168.1.0/24
                            Copy
                        
                        Ping sweep - discover live hosts only (no port scan)
                    

                    
                        Basic
                        
                            nmap -Pn 192.168.1.1
                            Copy
                        
                        Skip host discovery - assume host is online

#🔍 Port Scanning Techniques

Different scanning methods for various scenarios

Scanning
                        
                            nmap -sS 192.168.1.1
                            Copy
                        
                        TCP SYN scan (stealth scan) - default scan type
                    

                    
                        Scanning
                        
                            nmap -sT 192.168.1.1
                            Copy
                        
                        TCP connect scan (full connection)
                    

                    
                        Scanning
                        
                            nmap -sU 192.168.1.1
                            Copy
                        
                        UDP scan (slower but important for UDP services)
                    

                    
                        Stealth
                        
                            nmap -sF 192.168.1.1
                            Copy
                        
                        FIN scan - send FIN packets
                    

                    
                        Stealth
                        
                            nmap -sN 192.168.1.1
                            Copy
                        
                        NULL scan - send packets with no flags
                    

                    
                        Stealth
                        
                            nmap -sX 192.168.1.1
                            Copy
                        
                        XMAS scan - send FIN, PSH, and URG flags

#🎯 Port Specification & Timing

Control which ports to scan and scan timing

Basic
                        
                            nmap -p 22,80,443 192.168.1.1
                            Copy
                        
                        Scan specific ports
                    

                    
                        Basic
                        
                            nmap -p 1-1000 192.168.1.1
                            Copy
                        
                        Scan port range 1-1000
                    

                    
                        Basic
                        
                            nmap -p- 192.168.1.1
                            Copy
                        
                        Scan all 65535 ports
                    

                    
                        Advanced
                        
                            nmap -T4 192.168.1.1
                            Copy
                        
                        Aggressive timing (T0=Paranoid, T5=Insane)
                    

                    
                        Basic
                        
                            nmap --top-ports 100 192.168.1.1
                            Copy
                        
                        Scan top 100 most common ports
                    

                    
                        Basic
                        
                            nmap -F 192.168.1.1
                            Copy
                        
                        Fast scan - top 100 ports only

#🔧 Service & Version Detection

Identify services and their versions

Advanced
                        
                            nmap -sV 192.168.1.1
                            Copy
                        
                        Service version detection
                    

                    
                        Advanced
                        
                            nmap -O 192.168.1.1
                            Copy
                        
                        OS detection
                    

                    
                        Advanced
                        
                            nmap -A 192.168.1.1
                            Copy
                        
                        Aggressive scan (OS, version, script, traceroute)
                    

                    
                        Advanced
                        
                            nmap --version-intensity 9 192.168.1.1
                            Copy
                        
                        Maximum version detection intensity (0-9)
                    

                    
                        Advanced
                        
                            nmap --osscan-guess 192.168.1.1
                            Copy
                        
                        Guess OS more aggressively

#📜 NSE Scripts & Vulnerability Detection

Leverage Nmap Scripting Engine for advanced testing

Scripts
                        
                            nmap -sC 192.168.1.1
                            Copy
                        
                        Run default NSE scripts
                    

                    
                        Scripts
                        
                            nmap --script vuln 192.168.1.1
                            Copy
                        
                        Run vulnerability detection scripts
                    

                    
                        Scripts
                        
                            nmap --script safe 192.168.1.1
                            Copy
                        
                        Run safe scripts only
                    

                    
                        Scripts
                        
                            nmap --script http-enum 192.168.1.1
                            Copy
                        
                        HTTP directory enumeration
                    

                    
                        Scripts
                        
                            nmap --script smb-vuln* 192.168.1.1
                            Copy
                        
                        All SMB vulnerability scripts
                    

                    
                        Scripts
                        
                            nmap --script ssl-cert,ssl-enum-ciphers 192.168.1.1
                            Copy
                        
                        SSL certificate and cipher information

💡 Popular NSE Script Categories:
• auth - Authentication bypassing
• brute - Brute force attacks
• discovery - Network discovery
• dos - Denial of Service
• exploit - Vulnerability exploitation
• intrusive - May impact target
• malware - Malware detection
• safe - Safe to run
• vuln - Vulnerability detection

#🥷 Stealth & Evasion Techniques

Avoid detection and bypass firewalls

Stealth
                        
                            nmap -D RND:10 192.168.1.1
                            Copy
                        
                        Decoy scan with 10 random IP addresses
                    

                    
                        Stealth
                        
                            nmap -S 10.0.0.5 192.168.1.1
                            Copy
                        
                        Spoof source IP address
                    

                    
                        Stealth
                        
                            nmap --source-port 53 192.168.1.1
                            Copy
                        
                        Use specific source port (DNS port 53)
                    

                    
                        Stealth
                        
                            nmap --data-length 25 192.168.1.1
                            Copy
                        
                        Append random data to packets
                    

                    
                        Stealth
                        
                            nmap --scan-delay 5s 192.168.1.1
                            Copy
                        
                        Add delay between packets
                    

                    
                        Stealth
                        
                            nmap -f 192.168.1.1
                            Copy
                        
                        Fragment packets to avoid detection

#📄 Output & Reporting

Save and format scan results

Output
                        
                            nmap -oN scan.txt 192.168.1.1
                            Copy
                        
                        Save normal output to file
                    

                    
                        Output
                        
                            nmap -oX scan.xml 192.168.1.1
                            Copy
                        
                        Save XML output to file
                    

                    
                        Output
                        
                            nmap -oG scan.gnmap 192.168.1.1
                            Copy
                        
                        Save grepable output
                    

                    
                        Output
                        
                            nmap -oA scan 192.168.1.1
                            Copy
                        
                        Save all output formats
                    

                    
                        Output
                        
                            nmap -v 192.168.1.1
                            Copy
                        
                        Verbose output (use -vv for more verbose)
                    

                    
                        Output
                        
                            nmap --reason 192.168.1.1
                            Copy
                        
                        Display reason for port state

#🚀 Quick Reference & Common Combinations

Ready-to-use command combinations for common scenarios

#🎯 Quick Network Discovery

nmap -sn -T4 192.168.1.0/24
                            Copy

Fast ping sweep of entire subnet

#⚡ Fast Port Scan

nmap -T4 -F 192.168.1.1
                            Copy

Quick scan of top 100 ports

#🔍 Comprehensive Scan

nmap -A -T4 -oA scan 192.168.1.1
                            Copy

Aggressive scan with all output formats

#🛡️ Stealth Scan

nmap -sS -T2 -f -D RND:10 192.168.1.1
                            Copy

Stealthy SYN scan with decoys and fragmentation

#🔒 Web App Testing

nmap -p 80,443 --script http-enum,http-vuln* 192.168.1.1
                            Copy

Web application vulnerability scan

#📊 UDP Service Discovery

nmap -sU -T4 --top-ports 1000 192.168.1.1
                            Copy

UDP scan of top 1000 ports

💡 Pro Tips:
• Use -Pn if hosts don't respond to ping
• Combine -sS -sU for TCP and UDP scanning
• Use --script-help=script-name for script documentation
• Run nmap --script-updatedb to update script database
• Use --min-rate and --max-rate to control scan speed

#🔢 Common Ports Reference

Essential ports and their services

21 FTP

22 SSH

23 Telnet

25 SMTP

53 DNS

80 HTTP

110 POP3

143 IMAP

443 HTTPS

993 IMAPS

995 POP3S

3389 RDP

5432 PostgreSQL

3306 MySQL

1433 MSSQL

445 SMB

© 2025 theLAB Wiki | Nmap Security Cheat Sheet | Built for ethical security professionals