StationX

h1.site-description { display: none; }

Cyber Security Blog

Nmap Cheat Sheet

Nathan House

by

Target Specification

SwitchExampleDescription
nmap 192.168.1.1Scan a single IP
nmap 192.168.1.1 192.168.2.1Scan specific IPs
 nmap 192.168.1.1-254 Scan a range
 nmap scanme.nmap.org Scan a domain
 nmap 192.168.1.0/24 Scan using CIDR notation
-iLnmap -iL targets.txt Scan targets from a file
-iRnmap -iR 100Scan 100 random hosts
–exclude nmap –exclude 192.168.1.1 Exclude listed hosts

 Scan Techniques

SwitchExampleDescription
-sSnmap 192.168.1.1 -sSTCP SYN port scan (Default)
-sT nmap 192.168.1.1 -sT TCP connect port scan (Default without root privilege)
-sUnmap 192.168.1.1 -sUUDP port scan
-sAnmap 192.168.1.1 -sATCP ACK port scan
-sWnmap 192.168.1.1 -sWTCP Window port scan
-sM nmap 192.168.1.1 -sMTCP Maimon port scan

 Host Discovery

SwitchExampleDescription
-sLnmap 192.168.1.1-3 -sLNo Scan. List targets only
-sn nmap 192.168.1.1/24 -sn Disable port scanning. Host discovery only.
-Pn nmap 192.168.1.1-5 -Pn Disable host discovery. Port scan only.
-PS nmap 192.168.1.1-5 -PS22-25,80 TCP SYN discovery on port x.
Port 80 by default
-PA nmap 192.168.1.1-5 -PA22-25,80 TCP ACK discovery on port x.
Port 80 by default
-PU nmap 192.168.1.1-5 -PU53UDP discovery on port x.
Port 40125 by default
-PRnmap 192.168.1.1-1/24 -PR ARP discovery on local network
-nnmap 192.168.1.1 -n Never do DNS resolution

 Port Specification

SwitchExampleDescription
-pnmap 192.168.1.1 -p 21Port scan for port x
-p nmap 192.168.1.1 -p 21-100 Port range
-p nmap 192.168.1.1 -p U:53,T:21-25,80 Port scan multiple TCP and UDP ports
-p- nmap 192.168.1.1 -p- Port scan all ports
-p nmap 192.168.1.1 -p http,https Port scan from service name
-F nmap 192.168.1.1 -F Fast port scan (100 ports)
–top-ports nmap 192.168.1.1 –top-ports 2000 Port scan the top x ports
-p-65535 nmap 192.168.1.1 -p-65535 Leaving off initial port in range makes the scan start at port 1
-p0- nmap 192.168.1.1 -p0- Leaving off end port in range
makes the scan go through to port 65535

 Service and Version Detection

SwitchExampleDescription
-sVnmap 192.168.1.1 -sV Attempts to determine the version of the service running on port
-sV –version-intensity nmap 192.168.1.1 -sV –version-intensity 8 Intensity level 0 to 9. Higher number increases possibility of correctness
-sV –version-light nmap 192.168.1.1 -sV –version-light Enable light mode. Lower possibility of correctness. Faster
-sV –version-all nmap 192.168.1.1 -sV –version-all Enable intensity level 9. Higher possibility of correctness. Slower
-A nmap 192.168.1.1 -A Enables OS detection, version detection, script scanning, and traceroute

 OS Detection

SwitchExampleDescription
-O nmap 192.168.1.1 -O Remote OS detection using TCP/IP stack fingerprinting
-O –osscan-limitnmap 192.168.1.1 -O –osscan-limit If at least one open and one closed TCP port are not found it will not try OS detection against host
-O –osscan-guess nmap 192.168.1.1 -O –osscan-guess Makes Nmap guess more aggressively
-O –max-os-tries nmap 192.168.1.1 -O –max-os-tries 1 Set the maximum number x of OS detection tries against a target
-A nmap 192.168.1.1 -A Enables OS detection, version detection, script scanning, and traceroute

 Timing and Performance

SwitchExampleDescription
-T0

nmap 192.168.1.1 -T0 Paranoid (0) Intrusion Detection System evasion
-T1nmap 192.168.1.1 -T1Sneaky (1) Intrusion Detection System evasion
-T2 nmap 192.168.1.1 -T2 Polite (2) slows down the scan to use less bandwidth and use less target machine resources
-T3 nmap 192.168.1.1 -T3 Normal (3) which is default speed
-T4 nmap 192.168.1.1 -T4 Aggressive (4) speeds scans; assumes you are on a reasonably fast and reliable network
-T5 nmap 192.168.1.1 -T5 Insane (5) speeds scan; assumes you are on an extraordinarily fast network
SwitchExample inputDescription
–host-timeout <time> 1s; 4m; 2h Give up on target after this long
–min-rtt-timeout/max-rtt-timeout/initial-rtt-timeout <time> 1s; 4m; 2hSpecifies probe round trip time
–min-hostgroup/max-hostgroup <size<size> 50; 1024Parallel host scan group sizes
–min-parallelism/max-parallelism <numprobes> 10; 1 Probe parallelization
–scan-delay/–max-scan-delay <time> 20ms; 2s; 4m; 5h Adjust delay between probes
–max-retries <tries> 3Specify the maximum number of port scan probe retransmissions
–min-rate <number> 100Send packets no slower than <numberr> per second
–max-rate <number> 100Send packets no faster than <number> per second

 NSE Scripts

SwitchExampleDescription
-sC nmap 192.168.1.1 -sC Scan with default NSE scripts. Considered useful for discovery and safe
–script default nmap 192.168.1.1 –script defaultScan with default NSE scripts. Considered useful for discovery and safe
–script nmap 192.168.1.1 –script=banner Scan with a single script. Example banner
–script nmap 192.168.1.1 –script=http*Scan with a wildcard. Example http
–script nmap 192.168.1.1 –script=http,bannerScan with two scripts. Example http and banner
–script nmap 192.168.1.1 –script “not intrusive”Scan default, but remove intrusive scripts
–script-args nmap –script snmp-sysdescr –script-args snmpcommunity=admin 192.168.1.1NSE script with arguments

Useful NSE Script Examples

CommandDescription
nmap -Pn –script=http-sitemap-generator scanme.nmap.orghttp site map generator
nmap -n -Pn -p 80 –open -sV -vvv –script banner,http-title -iR 1000 Fast search for random web servers
nmap -Pn –script=dns-brute domain.com Brute forces DNS hostnames guessing subdomains
nmap -n -Pn -vv -O -sV –script smb-enum*,smb-ls,smb-mbenum,smb-os-discovery,smb-s*,smb-vuln*,smbv2* -vv 192.168.1.1 Safe SMB scripts to run
nmap –script whois* domain.com Whois query
nmap -p80 –script http-unsafe-output-escaping scanme.nmap.org Detect cross site scripting vulnerabilities
nmap -p80 –script http-sql-injection scanme.nmap.org Check for SQL injections

 Firewall / IDS Evasion and Spoofing

SwitchExampleDescription
-fnmap 192.168.1.1 -fRequested scan (including ping scans) use tiny fragmented IP packets. Harder for packet filters
–mtu nmap 192.168.1.1 –mtu 32Set your own offset size
-D nmap -D 192.168.1.101,192.168.1.102,192.168.1.103,192.168.1.23 192.168.1.1 Send scans from spoofed IPs
-D nmap -D decoy-ip1,decoy-ip2,your-own-ip,decoy-ip3,decoy-ip4 remote-host-ipAbove example explained
-S nmap -S www.microsoft.com www.facebook.comScan Facebook from Microsoft (-e eth0 -Pn may be required)
-g nmap -g 53 192.168.1.1Use given source port number
–proxies nmap –proxies http://192.168.1.1:8080, http://192.168.1.2:8080 192.168.1.1Relay connections through HTTP/SOCKS4 proxies
–data-length nmap –data-length 200 192.168.1.1Appends random data to sent packets

Example IDS Evasion command

nmap -f -t 0 -n -Pn –data-length 200 -D
192.168.1.101,192.168.1.102,192.168.1.103,192.168.1.23 192.168.1.1

 Output

SwitchExampleDescription
-oNnmap 192.168.1.1 -oN normal.fileNormal output to the file normal.file
-oX nmap 192.168.1.1 -oX xml.fileXML output to the file xml.file
-oGnmap 192.168.1.1 -oG grep.fileGrepable output to the file grep.file
-oA nmap 192.168.1.1 -oA resultsOutput in the three major formats at once
-oG –nmap 192.168.1.1 -oG –Grepable output to screen. -oN -, -oX – also usable
–append-output nmap 192.168.1.1 -oN file.file –append-outputAppend a scan to a previous scan file
-vnmap 192.168.1.1 -vIncrease the verbosity level (use -vv or more for greater effect)
-d nmap 192.168.1.1 -dIncrease debugging level (use -dd or more for greater effect)
–reasonnmap 192.168.1.1 –reasonDisplay the reason a port is in a particular state, same output as -vv
–opennmap 192.168.1.1 –openOnly show open (or possibly open) ports
–packet-trace nmap 192.168.1.1 -T4 –packet-traceShow all packets sent and received
–iflist nmap –iflistShows the host interfaces and routes
–resume nmap –resume results.fileResume a scan

Helpful Nmap Output examples

CommandDescription
nmap -p80 -sV -oG – –open 192.168.1.1/24 | grep openScan for web servers and grep to show which IPs are running web servers
nmap -iR 10 -n -oX out.xml | grep “Nmap” | cut -d ” ” -f5 > live-hosts.txt Generate a list of the IPs of live hosts
nmap -iR 10 -n -oX out2.xml | grep “Nmap” | cut -d ” ” -f5 >> live-hosts.txt Append IP to the list of live hosts
ndiff scanl.xml scan2.xml Compare output from nmap using the ndif
xsltproc nmap.xml -o nmap.html Convert nmap xml files to html files
grep ” open ” results.nmap | sed -r ‘s/ +/ /g’ | sort | uniq -c | sort -rn | less Reverse sorted list of how often ports turn up

 Miscellaneous Options

Switch Example Description
-6nmap -6 2607:f0d0:1002:51::4Enable IPv6 scanning
-hnmap -hnmap help screen

 Other Useful Nmap Commands

Command Description
nmap -iR 10 -PS22-25,80,113,1050,35000 -v -snDiscovery only on ports x, no port scan
nmap 192.168.1.1-1/24 -PR -sn -vvArp discovery only on local network, no port scan
nmap -iR 10 -sn -tracerouteTraceroute to random targets, no port scan
nmap 192.168.1.1-50 -sL –dns-server 192.168.1.1Query the Internal DNS for hosts, list targets only

Nathan House is the founder and CEO of Station X a cyber security training and consultancy company. He has over 25 years experience in cyber security where he has advised some of largest companies in the world, assuring security on multi-million and multi-billion pound projects. Nathan is the author of the popular "The Complete Cyber Security Course" which has been taken by over half a million students in 195 countries. Winner of the AI "Cyber Security Educator of the Year 2020" award. Over the years he has spoken at a number of security conferences, developed free security tools, and discovered serious security vulnerabilities in leading applications. PGP Fingerprint : CBA3FBF729FB00CB21D64FB00E7955AE6E37FEF1

  • That will be a helpful tipsheet. Thank you so much. I can learn more about it. looking forward to the hacking course from you.

    Reply

  • Thank you very much in deed, very useful, I will buy your course on nmap, I want to insist about a Firewall course there aren’t around, I guess it is a good investment for you, I bought already all your courses and they are the best! Please keep going!

    Reply

  • Thank you for this cheatsheet.
    I think there is a mistake concerning the -sS switch. It is not the default one.
    Normally, -sT is the default one and -sS needs root privileges.

    Reply

  • Sir this is very helpfull and very important for firewall point of view,
    But what about port knock if a system or server is using port knock to active its any port for a client. Any method by nmap that can bypass port knock.

    Thank you

    Reply

    • The basic port knocking method uses a fixed sequence of ports. This method is not protected cryptographically so there are the following attacks possible:

      brute-force — If you use the full range of possible ports 1—65535 then even very short knocking sequences give impressive number of combinations to test. For example for 3 knocks with randomly generated sequence it is 65535³ ≈ 2.8×10¹⁴. Another aspect to consider is that the port which will open after the knocking could be unknown so the attacker would have to repeatedly scan the ports during the port knocking attempts. — The number of combinations to try can be lowered if some information about the ports being used is known (for example a subset of ports) or if there is a successful random number generator attack.
      Measure against such attacks except securing the mentioned possible vulnerabilities could be disabling of the access from the attacker source IP address after certain number of unsuccessful attempts during certain time period. Unfortunately this makes the system vulnerable to DoS attacks by attacker locking your access by using your IP address as a spoofed source address.
      sniffing — The port knocking sequence is not protected cryptographically so an attacker can sniff the successful port knocking sequence. The port knocking sequence could also leak from logs of the destination system itself of from a network monitoring system.
      Measure against this attack is use of one-time knocking sequences (analogy of one-time passwords). The one-time sequence could be a hash computed from a secret and some of the following: source IP address, time, event counter etc.
      man in the middle — Captured one-time knocking sequences cannot be reused but a port-knocking access can be exploited by a man-in-the-middle attack. The attacker in the path of your communication (possibly redirected) can relay your successful communication, see and modify anything.
      The port-knocking itself is performed by one-way communication as such it cannot be protected against MITM. Also the communication following the port knocking must be secured against MITM to retain the security. To ensure this we can use standard encrypted protocols like SSL or SSH.

      Reply

  • Great stuff!

    Can you please help me understand the main difference between
    nmap 192.168.1.1 -O and nmap 192.168.1.1 -A

    Reply

    • nmap 192.168.1.1 -O = Remote OS detection using TCP/IP stack fingerprinting

      nmap 192.168.1.1 -A = Enables OS detection PLUS – version detection, script scanning, and traceroute

      So -O is only OS detection, -A is OS detection PLUS – version detection, script scanning, and traceroute

      Reply

  • Thanks Man , That’s Help me a lot .
    i wanna ask , what is the main different between -sn AND -Pn ;
    what is the network discovery do exactly and port scan !!

    Reply

    • -sL does no scan and just lists targets only to be scanned.
      The list scan is a degenerate form of host discovery that simply lists each host of the network(s) specified, without sending any packets to the target hosts. By default, Nmap still does reverse-DNS resolution on the hosts to learn their names. It is often surprising how much useful information simple hostnames give out. For example, fw.chi is the name of one company’s Chicago firewall. Nmap also reports the total number of IP addresses at the end. The list scan is a good sanity check to ensure that you have proper IP addresses for your targets. If the hosts sport domain names you do not recognize, it is worth investigating further to prevent scanning the wrong company’s network. Since the idea is to simply print a list of target hosts, options for higher level functionality such as port scanning, OS detection, or ping scanning cannot be combined with this. If you wish to disable ping scanning while still performing such higher level functionality, read up on the -Pn (skip ping) option.

      -PO (IP Protocol Ping)
      One of the newer host discovery options is the IP protocol ping, which sends IP packets with the specified protocol number set in their IP header. The protocol list takes the same format as do port lists in the previously discussed TCP, UDP and SCTP host discovery options. If no protocols are specified, the default is to send multiple IP packets for ICMP (protocol 1), IGMP (protocol 2), and IP-in-IP (protocol 4). The default protocols can be configured at compile-time by changingDEFAULT_PROTO_PROBE_PORT_SPEC in nmap.h. Note that for the ICMP, IGMP, TCP (protocol 6), UDP (protocol 17) and SCTP (protocol 132), the packets are sent with the proper protocol headers while other protocols are sent with no additional data beyond the IP header (unless any of –data, –data-string, or –data-length options are specified). This host discovery method looks for either responses using the same protocol as a probe, or ICMP protocol unreachable messages which signify that the given protocol isn’t supported on the destination host. Either type of response signifies that the target host is alive.

      Reply

        • Do you know what IP protocols are? like 1 ICMP Internet Control Message Protocol RFC 792, 2 IGMP Internet Group Management Protocol RFC 1112.

          It sends IP packets with the specified protocol number set in the IP header. It’s an alternative discovery method.

          Reply

  • This is so awesome! I’m taking your course now and my only regret is I didn’t do this sooner! This could’ve saved me soooo much headache and time! But it’s ok! Best way to learn is through error lol. Now that I know all the things NOT to do, you are showing the way. Thank you Mr. House.

    Reply

  • Great article and quite good presentation
    I built and online version of nmap here so such commands
    like described here i like them.

    Reply

    • nmap doesn’t change quickly in terms of how you use the tool. The last major release Nmap 7.00 was November 9, 2015. We are still on 7 now. The course was created well after this.

      Reply

  • Sir, plez show bobs en vagene.. thank kindly sir I owe you, you r best god bless sir

    Reply

  • Wow – this is awesome. I was in the throes of creating my own, and well, yours looks much better than mine. Much appreciated!

    Reply

  • Thank you very much Sir, for this NMAP Cheat sheet, I am from India, and enrolled in your the Complete Cyber Security Volume 1,2,3,4, loved your content and way of explaining #StaySafeOnline

    Reply

    • It’s not really a vulnerability scanner, although it can do that with a script. It is for discovering hosts and open ports.

      Reply

  • Awesome stuff, I am getting ready to graduate from MHCC with a Cybersecurity/Networking degree, realizing I still have a lot to learn.

    Reply

  • Hi! I am trying to find on my network IP addresses that have MySQL open using Nmap. Is any help available? Thanks in advance

    Reply

    • Scan from outside your network and look for the MySQL ports. Port 3306 is the default port for the classic MySQL protocol ( port ), which is used by the mysql client, MySQL Connectors, and utilities such as mysqldump and mysqlpump.

      Reply

  • Hi Nathan, maybe add movie name Sneakers and replace David with Marty. Like Marty’s friend said “too many secrets”. Cheers
    Six

    Reply

  • Hey Nathan,

    I appreciate the cheat sheet with really good explanations of each Nmap parameter. So I’ve included this article as a reference in my CSS Pen testing report, Thanks again!

    Reply

  • Yes! It’s true.. YOU are THE NMAP KING!
    I’ve learned things here that my mother wouldn’t even teach me. Thanks so much.
    Cheers!
    USA (Now a Trump free zone! 🙂

    Reply

  • I think the nmap full course and scanning techniques there are the best available. Never mind the midland accent its great but the explanations are best best.

    Systematics and cogent.

    Reply
    • >