Nmap Cheat Sheet

May 1, 2020 Nathan House

You may download the PDF version of this cheat sheet here

Start typing...

Target Specification

SWITCH EXAMPLE DESCRIPTION

nmap 192.168.1.1 Scan a single IP

nmap 192.168.1.1 192.168.2.1 Scan specific IPs

nmap 192.168.1.1-254 Scan a range

nmap scanme.nmap.org Scan a domain

nmap 192.168.1.0/24 Scan using CIDR notation

-iL nmap -iL targets.txt Scan targets from a file

-iR nmap -iR 100 Scan 100 random hosts

–exclude nmap –exclude 192.168.1.1 Exclude listed hosts

Scan Techniques

SWITCH EXAMPLE DESCRIPTION

-sS nmap 192.168.1.1 -sS TCP SYN port scan (Default)

-sT nmap 192.168.1.1 -sT TCP connect port scan (Default without root privilege)

-sU nmap 192.168.1.1 -sU UDP port scan

-sA nmap 192.168.1.1 -sA TCP ACK port scan

-sW nmap 192.168.1.1 -sW TCP Window port scan

 SWITCH EXAMPLE DESCRIPTION

-sM nmap 192.168.1.1 -sM TCP Maimon port scan

Host Discovery

SWITCH EXAMPLE DESCRIPTION

-sL nmap 192.168.1.1-3 -sL No Scan. List targets only

-sn nmap 192.168.1.1/24 -sn Disable port scanning. Host discovery only.

-Pn nmap 192.168.1.1-5 -Pn Disable host discovery. Port scan only.

TCP SYN discovery on port x.

-PS nmap 192.168.1.1-5 -PS22-25,80
Port 80 by default

TCP ACK discovery on port x.

-PA nmap 192.168.1.1-5 -PA22-25,80
Port 80 by default

UDP discovery on port x.

-PU nmap 192.168.1.1-5 -PU53
Port 40125 by default

-PR nmap 192.168.1.1-1/24 -PR ARP discovery on local network

-n nmap 192.168.1.1 -n Never do DNS resolution

Port Specification

SWITCH EXAMPLE DESCRIPTION

-p nmap 192.168.1.1 -p 21 Port scan for port x

-p nmap 192.168.1.1 -p 21-100 Port range

nmap 192.168.1.1 -p U:53,T:21-

-p Port scan multiple TCP and UDP ports
25,80

-p nmap 192.168.1.1 -p- Port scan all ports

-p nmap 192.168.1.1 -p http,https Port scan from service name

-F nmap 192.168.1.1 -F Fast port scan (100 ports)

–top-
nmap 192.168.1.1 –top-ports 2000 Port scan the top x ports
ports

Leaving off initial port in range makes the scan start at

-p-65535 nmap 192.168.1.1 -p-65535
port 1

Leaving off end port in range

-p0- nmap 192.168.1.1 -p0-
makes the scan go through to port 65535

Service and Version Detection

SWITCH EXAMPLE DESCRIPTION

Attempts to determine the version of the service

-sV nmap 192.168.1.1 -sV
running on port
 SWITCH EXAMPLE DESCRIPTION

-sV –version- nmap 192.168.1.1 -sV – Intensity level 0 to 9. Higher number increases
intensity version-intensity 8 possibility of correctness

-sV –version- nmap 192.168.1.1 -sV – Enable light mode. Lower possibility of correctness.
light version-light Faster

nmap 192.168.1.1 -sV – Enable intensity level 9. Higher possibility of

-sV –version-all
version-all correctness. Slower

Enables OS detection, version detection, script

-A nmap 192.168.1.1 -A
scanning, and traceroute

OS Detection

SWITCH EXAMPLE DESCRIPTION

-O nmap 192.168.1.1 -O Remote OS detection using TCP/IP stack fingerprinting

-O –
nmap 192.168.1.1 -O – If at least one open and one closed TCP port are not found it will
osscan-
osscan-limit not try OS detection against host
limit

-O –
nmap 192.168.1.1 -O –
osscan- Makes Nmap guess more aggressively
osscan-guess
guess

-O –max- nmap 192.168.1.1 -O –

Set the maximum number x of OS detection tries against a target
os-tries max-os-tries 1

Enables OS detection, version detection, script scanning, and

-A nmap 192.168.1.1 -A
traceroute

Timing and Performance

SWITCH EXAMPLE DESCRIPTION

-T0 nmap 192.168.1.1 -T0 Paranoid (0) Intrusion Detection System evasion

-T1 nmap 192.168.1.1 -T1 Sneaky (1) Intrusion Detection System evasion

Polite (2) slows down the scan to use less bandwidth and use less
-T2 nmap 192.168.1.1 -T2
target machine resources

-T3 nmap 192.168.1.1 -T3 Normal (3) which is default speed

Aggressive (4) speeds scans; assumes you are on a reasonably fast

-T4 nmap 192.168.1.1 -T4
and reliable network

Insane (5) speeds scan; assumes you are on an extraordinarily fast

-T5 nmap 192.168.1.1 -T5
network

Want to Download All Our

 Premium Cheat Sheets?
No Problem! Just enter your email address, and

we’ll send you the PDF versions of all our top

cheat sheets.
Email Address DOWNLOAD

Timing and Performance Switches

EXAMPLE
SWITCH DESCRIPTION
INPUT

–host-timeout <time> 1s; 4m; 2h Give up on target after this long

–min-rtt-timeout/max-rtt-timeout/initial-rtt-
1s; 4m; 2h Specifies probe round trip time
timeout <time>

–min-hostgroup/max-
50; 1024 Parallel host scan group sizes
hostgroup <size<size>

–min-parallelism/max-
10; 1 Probe parallelization
parallelism <numprobes>

Specify the maximum number of port scan

–max-retries <tries> 3
probe retransmissions

Send packets no slower than <number> per

–min-rate <number> 100
second

Send packets no faster than <number> per

–max-rate <number> 100
second

NSE Scripts

SWITCH EXAMPLE DESCRIPTION

Scan with default NSE scripts. Considered

-sC nmap 192.168.1.1 -sC
useful for discovery and safe

–script Scan with default NSE scripts. Considered

nmap 192.168.1.1 –script default
default useful for discovery and safe

–script nmap 192.168.1.1 –script=banner Scan with a single script. Example banner

–script nmap 192.168.1.1 –script=http* Scan with a wildcard. Example http

Scan with two scripts. Example http and

–script nmap 192.168.1.1 –script=http,banner
banner

–script nmap 192.168.1.1 –script “not intrusive” Scan default, but remove intrusive scripts

–script- nmap –script snmp-sysdescr –script-args

NSE script with arguments
args snmpcommunity=admin 192.168.1.1
Useful NSE Script Examples

COMMAND DESCRIPTION

nmap -Pn –script=http-sitemap-generator scanme.nmap.org http site map generator

Fast search for random web

nmap -n -Pn -p 80 –open -sV -vvv –script banner,http-title -iR 1000
servers

Brute forces DNS hostnames

nmap -Pn –script=dns-brute domain.com
guessing subdomains

nmap -n -Pn -vv -O -sV –script smb-enum*,smb-ls,smb-mbenum,smb-os-

Safe SMB scripts to run
discovery,smb-s*,smb-vuln*,smbv2* -vv 192.168.1.1

nmap –script whois* domain.com Whois query

Detect cross site scripting

nmap -p80 –script http-unsafe-output-escaping scanme.nmap.org
vulnerabilities

nmap -p80 –script http-sql-injection scanme.nmap.org Check for SQL injections

Firewall / IDS Evasion and Spoofing

SWITCH EXAMPLE DESCRIPTION

Requested scan (including ping

-f nmap 192.168.1.1 -f scans) use tiny fragmented IP
packets. Harder for packet filters

–mtu nmap 192.168.1.1 –mtu 32 Set your own offset size

nmap -D
-D 192.168.1.101,192.168.1.102,192.168.1.103,192.168.1.23 Send scans from spoofed IPs
192.168.1.1

nmap -D decoy-ip1,decoy-ip2,your-own-ip,decoy-
-D Above example explained
ip3,decoy-ip4 remote-host-ip

Scan Facebook from Microsoft (-e

-S nmap -S www.microsoft.com www.facebook.com
eth0 -Pn may be required)

-g nmap -g 53 192.168.1.1 Use given source port number

nmap –proxies http://192.168.1.1:8080, Relay connections through

–proxies
http://192.168.1.2:8080 192.168.1.1 HTTP/SOCKS4 proxies

–data- Appends random data to sent

nmap –data-length 200 192.168.1.1
length packets

Example IDS Evasion command

nmap -f -t 0 -n -Pn –data-length 200 -D

192.168.1.101,192.168.1.102,192.168.1.103,192.168.1.23 192.168.1.1

Output

SWITCH EXAMPLE DESCRIPTION

-oN nmap 192.168.1.1 -oN normal.file Normal output to the file normal.file
 SWITCH EXAMPLE DESCRIPTION

-oX nmap 192.168.1.1 -oX xml.file XML output to the file xml.file

-oG nmap 192.168.1.1 -oG grep.file Grepable output to the file grep.file

-oA nmap 192.168.1.1 -oA results Output in the three major formats at once

-oG – nmap 192.168.1.1 -oG – Grepable output to screen. -oN -, -oX – also usable

–append- nmap 192.168.1.1 -oN file.file –

Append a scan to a previous scan file
output append-output

Increase the verbosity level (use -vv or more for

-v nmap 192.168.1.1 -v
greater effect)

Increase debugging level (use -dd or more for greater

-d nmap 192.168.1.1 -d
effect)

Display the reason a port is in a particular state,

–reason nmap 192.168.1.1 –reason
same output as -vv

–open nmap 192.168.1.1 –open Only show open (or possibly open) ports

–packet- nmap 192.168.1.1 -T4 –packet-

Show all packets sent and received
trace trace

–iflist nmap –iflist Shows the host interfaces and routes

–resume nmap –resume results.file Resume a scan

Helpful Nmap Output examples

COMMAND DESCRIPTION

nmap -p80 -sV -oG – –open 192.168.1.1/24 | grep Scan for web servers and grep to show which IPs are
open running web servers

nmap -iR 10 -n -oX out.xml | grep “Nmap” | cut -d ” ”

Generate a list of the IPs of live hosts
-f5 > live-hosts.txt

nmap -iR 10 -n -oX out2.xml | grep “Nmap” | cut -d ”

Append IP to the list of live hosts
” -f5 >> live-hosts.txt

ndiff scanl.xml scan2.xml Compare output from nmap using the ndif

xsltproc nmap.xml -o nmap.html Convert nmap xml files to html files

grep ” open ” results.nmap | sed -r ‘s/ +/ /g’ | sort |

Reverse sorted list of how often ports turn up
uniq -c | sort -rn | less

Miscellaneous Options

SWITCH EXAMPLE DESCRIPTION

-6 nmap -6 2607:f0d0:1002:51::4 Enable IPv6 scanning

-h nmap -h nmap help screen

Other Useful Nmap Commands

 COMMAND DESCRIPTION

nmap -iR 10 -PS22-25,80,113,1050,35000 -v -sn Discovery only on ports x, no port scan

nmap 192.168.1.1-1/24 -PR -sn -vv Arp discovery only on local network, no port scan

nmap -iR 10 -sn -traceroute Traceroute to random targets, no port scan

nmap 192.168.1.1-50 -sL –dns-server 192.168.1.1 Query the Internal DNS for hosts, list targets only

CATEGORIES CHEAT SHEETS

Nathan House
Nathan House is the founder and CEO of Station X a cyber security training and consultancy company. He has
over 25 years experience in cyber security where he has advised some of largest companies in the world,
assuring security on multi-million and multi-billion pound projects. Nathan is the author of the popular "The
Complete Cyber Security Course" which has been taken by over half a million students in 195 countries. Winner
of the AI "Cyber Security Educator of the Year 2020" award. Over the years he has spoken at a number of
security conferences, developed free security tools, and discovered serious security vulnerabilities in leading
applications. PGP Fingerprint : CBA3FBF729FB00CB21D64FB00E7955AE6E37FEF1

Related Articles

Linux Command Line Cheat Sheet Wireshark Cheat Sheet

Read More » Read More »

List of Common Ports Cheat Sheet IPv4 Subnet Cheat Sheet

Read More » Read More »
INFO SECURITY ASSESSMENT

Affiliates Penetration Testing

Legal Notices Vulnerability Scanning
Privacy Policy Build Reviews
Site Map Source Code Review
Social Engineering

CONSULTING

Audit & Compliance

Incident Response
Security Architecture
Risk Assessment
Security Training

COPYRIGHT © 2022 STATIONX LTD. ALL RIGHTS RESERVED.