Nmap Cheat Sheet

You may download the PDF version of this cheat sheet here.

Target Specification

SWITCHEXAMPLEDESCRIPTION
nmap 192.168.1.1Scan a single IP
nmap 192.168.1.1 192.168.2.1Scan specific IPs
nmap 192.168.1.1-254Scan a range
nmap scanme.nmap.orgScan a domain
nmap 192.168.1.0/24Scan using CIDR notation
-iLnmap -iL targets.txtScan targets from a file
-iRnmap -iR 100Scan 100 random hosts
–excludenmap –exclude 192.168.1.1Exclude listed hosts

Scan Techniques

SWITCHEXAMPLEDESCRIPTION
-sSnmap 192.168.1.1 -sSTCP SYN port scan (Default)
-sTnmap 192.168.1.1 -sTTCP connect port scan (Default without root privilege)
-sUnmap 192.168.1.1 -sUUDP port scan
-sAnmap 192.168.1.1 -sATCP ACK port scan
-sWnmap 192.168.1.1 -sWTCP Window port scan
-sMnmap 192.168.1.1 -sMTCP Maimon port scan

Host Discovery

SWITCHEXAMPLEDESCRIPTION
-sLnmap 192.168.1.1-3 -sLNo Scan. List targets only
-snnmap 192.168.1.1/24 -snDisable port scanning. Host discovery only.
-Pnnmap 192.168.1.1-5 -PnDisable host discovery. Port scan only.
-PSnmap 192.168.1.1-5 -PS22-25,80TCP SYN discovery on port x.
Port 80 by default
-PAnmap 192.168.1.1-5 -PA22-25,80TCP ACK discovery on port x.
Port 80 by default
-PUnmap 192.168.1.1-5 -PU53UDP discovery on port x.
Port 40125 by default
-PRnmap 192.168.1.1-1/24 -PRARP discovery on local network
-nnmap 192.168.1.1 -nNever do DNS resolution

Port Specification

SWITCHEXAMPLEDESCRIPTION
-pnmap 192.168.1.1 -p 21Port scan for port x
-pnmap 192.168.1.1 -p 21-100Port range
-pnmap 192.168.1.1 -p U:53,T:21-25,80Port scan multiple TCP and UDP ports
-pnmap 192.168.1.1 -p-Port scan all ports
-pnmap 192.168.1.1 -p http,httpsPort scan from service name
-Fnmap 192.168.1.1 -FFast port scan (100 ports)
–top-portsnmap 192.168.1.1 –top-ports 2000Port scan the top x ports
-p-65535nmap 192.168.1.1 -p-65535Leaving off initial port in range makes the scan start at port 1
-p0-nmap 192.168.1.1 -p0-Leaving off end port in range
makes the scan go through to port 65535

Service and Version Detection

SWITCHEXAMPLEDESCRIPTION
-sVnmap 192.168.1.1 -sVAttempts to determine the version of the service running on port
-sV –version-intensitynmap 192.168.1.1 -sV –version-intensity 8Intensity level 0 to 9. Higher number increases possibility of correctness
-sV –version-lightnmap 192.168.1.1 -sV –version-lightEnable light mode. Lower possibility of correctness. Faster
-sV –version-allnmap 192.168.1.1 -sV –version-allEnable intensity level 9. Higher possibility of correctness. Slower
-Anmap 192.168.1.1 -AEnables OS detection, version detection, script scanning, and traceroute

OS Detection

SWITCHEXAMPLEDESCRIPTION
-Onmap 192.168.1.1 -ORemote OS detection using TCP/IP stack fingerprinting
-O –osscan-limitnmap 192.168.1.1 -O –osscan-limitIf at least one open and one closed TCP port are not found it will not try OS detection against host
-O –osscan-guessnmap 192.168.1.1 -O –osscan-guessMakes Nmap guess more aggressively
-O –max-os-triesnmap 192.168.1.1 -O –max-os-tries 1Set the maximum number x of OS detection tries against a target
-Anmap 192.168.1.1 -AEnables OS detection, version detection, script scanning, and traceroute

Timing and Performance

SWITCHEXAMPLEDESCRIPTION
-T0nmap 192.168.1.1 -T0Paranoid (0) Intrusion Detection System evasion
-T1nmap 192.168.1.1 -T1Sneaky (1) Intrusion Detection System evasion
-T2nmap 192.168.1.1 -T2Polite (2) slows down the scan to use less bandwidth and use less target machine resources
-T3nmap 192.168.1.1 -T3Normal (3) which is default speed
-T4nmap 192.168.1.1 -T4Aggressive (4) speeds scans; assumes you are on a reasonably fast and reliable network
-T5nmap 192.168.1.1 -T5Insane (5) speeds scan; assumes you are on an extraordinarily fast network

Timing and Performance Switches

SWITCHEXAMPLE INPUTDESCRIPTION
–host-timeout <time>1s; 4m; 2hGive up on target after this long
–min-rtt-timeout/max-rtt-timeout/initial-rtt-timeout <time>1s; 4m; 2hSpecifies probe round trip time
–min-hostgroup/max-hostgroup <size<size>50; 1024Parallel host scan group sizes
–min-parallelism/max-parallelism <numprobes>10; 1Probe parallelization
–max-retries <tries>3Specify the maximum number of port scan probe retransmissions
–min-rate <number>100Send packets no slower than <number> per second
–max-rate <number>100Send packets no faster than <number> per second

NSE Scripts

SWITCHEXAMPLEDESCRIPTION
-sCnmap 192.168.1.1 -sCScan with default NSE scripts. Considered useful for discovery and safe
–script defaultnmap 192.168.1.1 –script defaultScan with default NSE scripts. Considered useful for discovery and safe
–scriptnmap 192.168.1.1 –script=bannerScan with a single script. Example banner
–scriptnmap 192.168.1.1 –script=http*Scan with a wildcard. Example http
–scriptnmap 192.168.1.1 –script=http,bannerScan with two scripts. Example http and banner
–scriptnmap 192.168.1.1 –script “not intrusive”Scan default, but remove intrusive scripts
–script-argsnmap –script snmp-sysdescr –script-args snmpcommunity=admin 192.168.1.1NSE script with arguments

Useful NSE Script Examples

COMMANDDESCRIPTION
nmap -Pn –script=http-sitemap-generator scanme.nmap.orghttp site map generator
nmap -n -Pn -p 80 –open -sV -vvv –script banner,http-title -iR 1000Fast search for random web servers
nmap -Pn –script=dns-brute domain.comBrute forces DNS hostnames guessing subdomains
nmap -n -Pn -vv -O -sV –script smb-enum*,smb-ls,smb-mbenum,smb-os-discovery,smb-s*,smb-vuln*,smbv2* -vv 192.168.1.1Safe SMB scripts to run
nmap –script whois* domain.comWhois query
nmap -p80 –script http-unsafe-output-escaping scanme.nmap.orgDetect cross site scripting vulnerabilities
nmap -p80 –script http-sql-injection scanme.nmap.orgCheck for SQL injections

Firewall / IDS Evasion and Spoofing

SWITCHEXAMPLEDESCRIPTION
-fnmap 192.168.1.1 -fRequested scan (including ping scans) use tiny fragmented IP packets. Harder for packet filters
–mtunmap 192.168.1.1 –mtu 32Set your own offset size
-Dnmap -D 192.168.1.101,192.168.1.102,192.168.1.103,192.168.1.23 192.168.1.1Send scans from spoofed IPs
-Dnmap -D decoy-ip1,decoy-ip2,your-own-ip,decoy-ip3,decoy-ip4 remote-host-ipAbove example explained
-Snmap -S www.microsoft.com www.facebook.comScan Facebook from Microsoft (-e eth0 -Pn may be required)
-gnmap -g 53 192.168.1.1Use given source port number
–proxiesnmap –proxies http://192.168.1.1:8080, http://192.168.1.2:8080 192.168.1.1Relay connections through HTTP/SOCKS4 proxies
–data-lengthnmap –data-length 200 192.168.1.1Appends random data to sent packets

Example IDS Evasion command

nmap -f -t 0 -n -Pn –data-length 200 -D
192.168.1.101,192.168.1.102,192.168.1.103,192.168.1.23 192.168.1.1

Output

SWITCHEXAMPLEDESCRIPTION
-oNnmap 192.168.1.1 -oN normal.fileNormal output to the file normal.file
-oXnmap 192.168.1.1 -oX xml.fileXML output to the file xml.file
-oGnmap 192.168.1.1 -oG grep.fileGrepable output to the file grep.file
-oAnmap 192.168.1.1 -oA resultsOutput in the three major formats at once
-oG –nmap 192.168.1.1 -oG –Grepable output to screen. -oN -, -oX – also usable
–append-outputnmap 192.168.1.1 -oN file.file –append-outputAppend a scan to a previous scan file
-vnmap 192.168.1.1 -vIncrease the verbosity level (use -vv or more for greater effect)
-dnmap 192.168.1.1 -dIncrease debugging level (use -dd or more for greater effect)
–reasonnmap 192.168.1.1 –reasonDisplay the reason a port is in a particular state, same output as -vv
–opennmap 192.168.1.1 –openOnly show open (or possibly open) ports
–packet-tracenmap 192.168.1.1 -T4 –packet-traceShow all packets sent and received
–iflistnmap –iflistShows the host interfaces and routes
–resumenmap –resume results.fileResume a scan

Helpful Nmap Output examples

COMMANDDESCRIPTION
nmap -p80 -sV -oG – –open 192.168.1.1/24 | grep openScan for web servers and grep to show which IPs are running web servers
nmap -iR 10 -n -oX out.xml | grep “Nmap” | cut -d ” ” -f5 > live-hosts.txtGenerate a list of the IPs of live hosts
nmap -iR 10 -n -oX out2.xml | grep “Nmap” | cut -d ” ” -f5 >> live-hosts.txtAppend IP to the list of live hosts
ndiff scanl.xml scan2.xmlCompare output from nmap using the ndif
xsltproc nmap.xml -o nmap.htmlConvert nmap xml files to html files
grep ” open ” results.nmap | sed -r ‘s/ +/ /g’ | sort | uniq -c | sort -rn | lessReverse sorted list of how often ports turn up

Miscellaneous Options

SWITCHEXAMPLEDESCRIPTION
-6nmap -6 2607:f0d0:1002:51::4Enable IPv6 scanning
-hnmap -hnmap help screen

Other Useful Nmap Commands

COMMANDDESCRIPTION
nmap -iR 10 -PS22-25,80,113,1050,35000 -v -snDiscovery only on ports x, no port scan
nmap 192.168.1.1-1/24 -PR -sn -vvArp discovery only on local network, no port scan
nmap -iR 10 -sn -tracerouteTraceroute to random targets, no port scan
nmap 192.168.1.1-50 -sL –dns-server 192.168.1.1Query the Internal DNS for hosts, list targets only
  • Milton says:

    Thanks a lot for the information. it is very useful.

  • Jimmy Toriola says:

    That will be a helpful tipsheet. Thank you so much. I can learn more about it. looking forward to the hacking course from you.

  • Eddie says:

    Looking forward to it. I use nmap most days but only use a limited number of switches.

  • Oliver Suzuki says:

    Keep the good hands-on stuff coming

  • Fran says:

    Thank you very much in deed, very useful, I will buy your course on nmap, I want to insist about a Firewall course there aren’t around, I guess it is a good investment for you, I bought already all your courses and they are the best! Please keep going!

  • Celestino J says:

    Great news.
    In expectation of this course.
    As usual ,
    Thanks for what you doing.

  • Marious says:

    I think this is very Useful,Thank you soo much.Am enjoying the training and practice.

  • Arthur says:

    Love it. Thank you Nathan!

  • Horacio Castellini says:

    Muchas gracias ,,, me fue de utilidad,,,

  • krishna says:

    How to test .net Web services using ZenMap

  • Abdulrahman Mogram says:

    Thank you for sharing this information!

  • reike says:

    Thank you for this cheatsheet.
    I think there is a mistake concerning the -sS switch. It is not the default one.
    Normally, -sT is the default one and -sS needs root privileges.

  • sudo says:

    Hi

    This is very helpful. Thanks a lot!

  • Suraj says:

    Sir this is very helpfull and very important for firewall point of view,
    But what about port knock if a system or server is using port knock to active its any port for a client. Any method by nmap that can bypass port knock.

    Thank you

    • Nathan House says:

      The basic port knocking method uses a fixed sequence of ports. This method is not protected cryptographically so there are the following attacks possible:

      brute-force — If you use the full range of possible ports 1—65535 then even very short knocking sequences give impressive number of combinations to test. For example for 3 knocks with randomly generated sequence it is 65535³ ≈ 2.8×10¹⁴. Another aspect to consider is that the port which will open after the knocking could be unknown so the attacker would have to repeatedly scan the ports during the port knocking attempts. — The number of combinations to try can be lowered if some information about the ports being used is known (for example a subset of ports) or if there is a successful random number generator attack.
      Measure against such attacks except securing the mentioned possible vulnerabilities could be disabling of the access from the attacker source IP address after certain number of unsuccessful attempts during certain time period. Unfortunately this makes the system vulnerable to DoS attacks by attacker locking your access by using your IP address as a spoofed source address.
      sniffing — The port knocking sequence is not protected cryptographically so an attacker can sniff the successful port knocking sequence. The port knocking sequence could also leak from logs of the destination system itself of from a network monitoring system.
      Measure against this attack is use of one-time knocking sequences (analogy of one-time passwords). The one-time sequence could be a hash computed from a secret and some of the following: source IP address, time, event counter etc.
      man in the middle — Captured one-time knocking sequences cannot be reused but a port-knocking access can be exploited by a man-in-the-middle attack. The attacker in the path of your communication (possibly redirected) can relay your successful communication, see and modify anything.
      The port-knocking itself is performed by one-way communication as such it cannot be protected against MITM. Also the communication following the port knocking must be secured against MITM to retain the security. To ensure this we can use standard encrypted protocols like SSL or SSH.

  • Manik says:

    Great stuff!

    Can you please help me understand the main difference between
    nmap 192.168.1.1 -O and nmap 192.168.1.1 -A

    • Nathan House says:

      nmap 192.168.1.1 -O = Remote OS detection using TCP/IP stack fingerprinting

      nmap 192.168.1.1 -A = Enables OS detection PLUS – version detection, script scanning, and traceroute

      So -O is only OS detection, -A is OS detection PLUS – version detection, script scanning, and traceroute

  • DEM says:

    Thanks Man , That’s Help me a lot .
    i wanna ask , what is the main different between -sn AND -Pn ;
    what is the network discovery do exactly and port scan !!

  • tad says:

    hi sir ,
    i just wanna know , is there any benefit for this -sL option ? and when do i use -P0 ?

    • Nathan House says:

      -sL does no scan and just lists targets only to be scanned.
      The list scan is a degenerate form of host discovery that simply lists each host of the network(s) specified, without sending any packets to the target hosts. By default, Nmap still does reverse-DNS resolution on the hosts to learn their names. It is often surprising how much useful information simple hostnames give out. For example, fw.chi is the name of one company’s Chicago firewall. Nmap also reports the total number of IP addresses at the end. The list scan is a good sanity check to ensure that you have proper IP addresses for your targets. If the hosts sport domain names you do not recognize, it is worth investigating further to prevent scanning the wrong company’s network. Since the idea is to simply print a list of target hosts, options for higher level functionality such as port scanning, OS detection, or ping scanning cannot be combined with this. If you wish to disable ping scanning while still performing such higher level functionality, read up on the -Pn (skip ping) option.

      -PO (IP Protocol Ping)
      One of the newer host discovery options is the IP protocol ping, which sends IP packets with the specified protocol number set in their IP header. The protocol list takes the same format as do port lists in the previously discussed TCP, UDP and SCTP host discovery options. If no protocols are specified, the default is to send multiple IP packets for ICMP (protocol 1), IGMP (protocol 2), and IP-in-IP (protocol 4). The default protocols can be configured at compile-time by changingDEFAULT_PROTO_PROBE_PORT_SPEC in nmap.h. Note that for the ICMP, IGMP, TCP (protocol 6), UDP (protocol 17) and SCTP (protocol 132), the packets are sent with the proper protocol headers while other protocols are sent with no additional data beyond the IP header (unless any of –data, –data-string, or –data-length options are specified). This host discovery method looks for either responses using the same protocol as a probe, or ICMP protocol unreachable messages which signify that the given protocol isn’t supported on the destination host. Either type of response signifies that the target host is alive.

      • tad says:

        Yea i read this , but i dont get it , in short words give me what is -P0 used for ??

        • Nathan House says:

          Do you know what IP protocols are? like 1 ICMP Internet Control Message Protocol RFC 792, 2 IGMP Internet Group Management Protocol RFC 1112.

          It sends IP packets with the specified protocol number set in the IP header. It’s an alternative discovery method.

  • Count says:

    Great! I was just wondering “gosh, if there could be a pdf version and – woah, there is”

  • Gul Mohhammad Jin says:

    sirr i need your help
    i thing u help mee

  • Wangol Joel says:

    Very good article

  • ALDAHMANI says:

    Thank you Nathan.

  • wangolo joel says:

    Very great article I tried to build, an online command simulator

  • CH says:

    This is so awesome! I’m taking your course now and my only regret is I didn’t do this sooner! This could’ve saved me soooo much headache and time! But it’s ok! Best way to learn is through error lol. Now that I know all the things NOT to do, you are showing the way. Thank you Mr. House.

  • Network Napper says:

    Great article and quite good presentation
    I built and online version of nmap here so such commands
    like described here i like them.

  • enoch says:

    man u may live long , may God bless u ok

  • Akash Chopra says:

    Appreciate it Arthur.

  • -TL says:

    When was the last time you updated your course Nathan?

    • Nathan House says:

      nmap doesn’t change quickly in terms of how you use the tool. The last major release Nmap 7.00 was November 9, 2015. We are still on 7 now. The course was created well after this.

  • Burdeep pratasama says:

    Sir, plez show bobs en vagene.. thank kindly sir I owe you, you r best god bless sir

  • Tim L says:

    Wow – this is awesome. I was in the throes of creating my own, and well, yours looks much better than mine. Much appreciated!

  • kashif chohan says:

    thank you sir nathan!

  • Shobhit Sharma says:

    Thank you very much Sir, for this NMAP Cheat sheet, I am from India, and enrolled in your the Complete Cyber Security Volume 1,2,3,4, loved your content and way of explaining #StaySafeOnline

  • Student says:

    What does nmap do other than scan for vunerailitites?

    • Nathan House says:

      It’s not really a vulnerability scanner, although it can do that with a script. It is for discovering hosts and open ports.

  • Jhanvi says:

    thank you for the detailed nmap cheat sheet.

  • Kamer says:

    N.e.e.d.s

  • Chandar R Pass says:

    Awesome stuff, I am getting ready to graduate from MHCC with a Cybersecurity/Networking degree, realizing I still have a lot to learn.

  • Joao says:

    Hi! I am trying to find on my network IP addresses that have MySQL open using Nmap. Is any help available? Thanks in advance

    • Nathan House says:

      Scan from outside your network and look for the MySQL ports. Port 3306 is the default port for the classic MySQL protocol ( port ), which is used by the mysql client, MySQL Connectors, and utilities such as mysqldump and mysqlpump.

  • Six says:

    Hi Nathan, maybe add movie name Sneakers and replace David with Marty. Like Marty’s friend said “too many secrets”. Cheers
    Six

  • Nana says:

    So it means we don’t need to get the course of Nmap on Udemy from you, all of it is here ?

  • shilpagya says:

    BEST sir….
    Love from INDIA

  • Anthony says:

    Hey Nathan,

    I appreciate the cheat sheet with really good explanations of each Nmap parameter. So I’ve included this article as a reference in my CSS Pen testing report, Thanks again!

  • Sandeep yadav says:

    nice

  • Sandeep yadav says:

    nice blog bro

  • tingxuan Zhu says:

    Thank you so much!!!

  • Valued Team Member says:

    Yes! It’s true.. YOU are THE NMAP KING!
    I’ve learned things here that my mother wouldn’t even teach me. Thanks so much.
    Cheers!
    USA (Now a Trump free zone! 🙂

  • Gopal Raj Kumar says:

    I think the nmap full course and scanning techniques there are the best available. Never mind the midland accent its great but the explanations are best best.

    Systematics and cogent.

  • Steven Oosterbosch says:

    Thank you for this course! And the brilliant accent!
    All the best, Steven

  • matthew howe says:

    nmap test answers please

  • alihassam says:

    Very Usefull.

  • Mandip says:

    This is awesome! Thanks

  • Mohamed khan says:

    My God, this is so cool & Important

  • VISHAL says:

    CAN NMAP HACK BETING SITES

  • Khalid hasan says:

    Grate job. Thanks a lot

  • Paulo says:

    Ola! Apesar que sou bem cru no assunto, Coisas impotante pego para aprender um pouco.
    Valeu abraço.

  • Khaled Saudi Arabia says:

    this man is genius in nmap and cyber security like mike meyers
    i have to see his courses .

  • Where can I watch movies in my iPad 2? Good free websites?

    Nmap Cheat Sheet

  • Nelson says:

    Thanks for this..!!

  • Len says:

    Thanks Nathan. What a great resource!

  • Arthur says:

    Great courses Thanks again Nathan
    AM

  • Nana Sarfo Kantanka Eric Henry says:

    Nice I want to learn

  • Nana Sarfo Kantanka Eric Henry says:

    Higher

  • J says:

    THANK YOU!!! I used to use Legion but for some reason the frontend is proving unreliable, so I need to put on my big boy pants and use Nmap the proper way.

  • Raja says:

    Thanks

  • Mike says:

    Thank you! It’s content like this that helps make the membership cost worth it. Don’t get me wrong, the sheer content on the website makes it worth the cost but this stuff is just icing on the cake!

  • >