Nmap Cheat Sheet

Host Discovery

Find live hosts before scanning ports.

Ping Sweeps

# ARP discovery (local network, most reliable)
nmap -sn -PR 192.168.1.0/24

# ICMP echo ping sweep
nmap -sn 10.10.10.0/24

# TCP SYN ping on port 443
nmap -sn -PS443 10.10.10.0/24

# TCP ACK ping on port 80
nmap -sn -PA80 10.10.10.0/24

# UDP ping on port 53
nmap -sn -PU53 10.10.10.0/24

# No ping (skip discovery, treat all hosts as up)
nmap -Pn 10.10.10.5

# ICMP timestamp + netmask
nmap -sn -PP -PM 10.10.10.0/24

List / DNS Resolution

# List targets only (no scanning)
nmap -sL 10.10.10.0/24

# Reverse DNS resolution
nmap -sL -R 10.10.10.0/24

# Disable DNS resolution (faster)
nmap -n 10.10.10.5

# Use specific DNS server
nmap --dns-servers 10.10.10.2 10.10.10.0/24

Port Scanning Techniques

TCP Scans

# SYN scan (default, stealthy, requires root)
nmap -sS 10.10.10.5

# Connect scan (full TCP handshake, no root needed)
nmap -sT 10.10.10.5

# ACK scan (detect firewall rules, filtered vs unfiltered)
nmap -sA 10.10.10.5

# Window scan (like ACK but checks TCP window)
nmap -sW 10.10.10.5

# FIN scan (stealth, bypass some firewalls)
nmap -sF 10.10.10.5

# Xmas scan (FIN + PSH + URG flags)
nmap -sX 10.10.10.5

# NULL scan (no flags set)
nmap -sN 10.10.10.5

# Maimon scan (FIN/ACK)
nmap -sM 10.10.10.5

UDP Scans

# UDP scan (slow — be patient or target specific ports)
nmap -sU 10.10.10.5

# UDP + TCP SYN combined
nmap -sS -sU 10.10.10.5

# Top 20 UDP ports only
nmap -sU --top-ports 20 10.10.10.5

Port Specification

# Single port
nmap -p 80 10.10.10.5

# Port range
nmap -p 1-1000 10.10.10.5

# Specific ports
nmap -p 22,80,443,8080 10.10.10.5

# All 65535 ports
nmap -p- 10.10.10.5

# Top N ports
nmap --top-ports 100 10.10.10.5

# Exclude ports
nmap -p- --exclude-ports 25,135 10.10.10.5

# Service name
nmap -p http,https,ssh 10.10.10.5

Service & Version Detection

# Service version detection
nmap -sV 10.10.10.5

# Aggressive version detection
nmap -sV --version-intensity 5 10.10.10.5

# Light version detection (faster)
nmap -sV --version-light 10.10.10.5

# Version + default scripts
nmap -sC -sV 10.10.10.5

# Banner grab only
nmap -sV --version-intensity 0 10.10.10.5

OS Detection

# OS detection
nmap -O 10.10.10.5

# Aggressive OS detection
nmap -O --osscan-guess 10.10.10.5

# Limit detection to promising targets
nmap -O --osscan-limit 10.10.10.0/24

# Combined (OS + version + scripts + traceroute)
nmap -A 10.10.10.5

NSE Scripts

Nmap Scripting Engine — the real power of nmap.

Script Categories

# Default scripts
nmap -sC 10.10.10.5
nmap --script=default 10.10.10.5

# Vulnerability detection
nmap --script=vuln 10.10.10.5

# Safe scripts only
nmap --script=safe 10.10.10.5

# Discovery scripts
nmap --script=discovery 10.10.10.5

# Brute force scripts
nmap --script=brute 10.10.10.5

# Multiple categories
nmap --script="vuln,safe" 10.10.10.5

Specific Scripts

# SMB enumeration
nmap --script=smb-enum-shares,smb-enum-users -p 445 10.10.10.5
nmap --script=smb-vuln* -p 445 10.10.10.5
nmap --script=smb-os-discovery -p 445 10.10.10.5

# HTTP enumeration
nmap --script=http-enum -p 80 10.10.10.5
nmap --script=http-title -p 80 10.10.10.5
nmap --script=http-headers -p 80 10.10.10.5
nmap --script=http-methods --script-args http-methods.url-path='/api' -p 80 10.10.10.5
nmap --script=http-shellshock --script-args uri=/cgi-bin/status -p 80 10.10.10.5

# DNS
nmap --script=dns-zone-transfer --script-args dns-zone-transfer.domain=target.htb -p 53 10.10.10.5
nmap --script=dns-brute --script-args dns-brute.domain=target.htb -p 53 10.10.10.5

# FTP
nmap --script=ftp-anon,ftp-bounce,ftp-vuln* -p 21 10.10.10.5

# SMTP
nmap --script=smtp-enum-users,smtp-open-relay -p 25 10.10.10.5

# SNMP
nmap --script=snmp-brute,snmp-info,snmp-interfaces -p 161 -sU 10.10.10.5

# MySQL / MSSQL
nmap --script=mysql-enum,mysql-empty-password -p 3306 10.10.10.5
nmap --script=ms-sql-info,ms-sql-config -p 1433 10.10.10.5

# LDAP
nmap --script=ldap-search,ldap-rootdse -p 389 10.10.10.5

# SSL/TLS
nmap --script=ssl-heartbleed -p 443 10.10.10.5
nmap --script=ssl-enum-ciphers -p 443 10.10.10.5
nmap --script=ssl-cert -p 443 10.10.10.5

# Script with arguments
nmap --script=http-brute --script-args http-brute.path=/admin -p 80 10.10.10.5

Script Management

# List all scripts
ls /usr/share/nmap/scripts/

# Search for scripts
ls /usr/share/nmap/scripts/ | grep smb
nmap --script-help "smb*"

# Update script database
nmap --script-updatedb

Output Formats

# Normal output
nmap -oN scan.txt 10.10.10.5

# XML output (for parsing)
nmap -oX scan.xml 10.10.10.5

# Grepable output
nmap -oG scan.gnmap 10.10.10.5

# All formats at once
nmap -oA scan 10.10.10.5

# Append to file (use >>)
nmap 10.10.10.5 >> scan.txt

# Verbose output to terminal
nmap -v 10.10.10.5
nmap -vv 10.10.10.5

# Debug output
nmap -d 10.10.10.5

# Extract open ports from grepable output
grep 'open' scan.gnmap | awk -F'/' '{print $1}' | awk '{print $NF}' | sort -u

Timing & Performance

# Timing templates (T0=paranoid, T5=insane)
nmap -T0 10.10.10.5    # IDS evasion (very slow)
nmap -T1 10.10.10.5    # Sneaky
nmap -T2 10.10.10.5    # Polite
nmap -T3 10.10.10.5    # Normal (default)
nmap -T4 10.10.10.5    # Aggressive (recommended for CTF)
nmap -T5 10.10.10.5    # Insane (may miss ports)

# Custom rate controls
nmap --min-rate 5000 10.10.10.5
nmap --max-rate 100 10.10.10.5
nmap --max-retries 2 10.10.10.5
nmap --host-timeout 30m 10.10.10.5
nmap --scan-delay 1s 10.10.10.5

# Parallelism
nmap --min-parallelism 50 10.10.10.5
nmap --max-parallelism 10 10.10.10.5

# Min hostgroup (scan hosts in parallel)
nmap --min-hostgroup 64 10.10.10.0/24

Firewall / IDS Evasion

# Fragment packets
nmap -f 10.10.10.5
nmap --mtu 24 10.10.10.5

# Decoy scan
nmap -D RND:10 10.10.10.5
nmap -D 10.10.10.1,10.10.10.2,ME 10.10.10.5

# Spoof source port
nmap --source-port 53 10.10.10.5
nmap -g 53 10.10.10.5

# Spoof source IP (won't get results back)
nmap -S 10.10.10.1 -e eth0 10.10.10.5

# Randomize target order
nmap --randomize-hosts 10.10.10.0/24

# Append random data
nmap --data-length 25 10.10.10.5

# Spoof MAC address
nmap --spoof-mac 0 10.10.10.5
nmap --spoof-mac Dell 10.10.10.5
nmap --spoof-mac 00:11:22:33:44:55 10.10.10.5

# Idle/zombie scan
nmap -sI zombie_host:port 10.10.10.5

Useful Combinations

CTF / HTB Quick Start

# Step 1: Fast full-port scan
nmap -p- --min-rate 5000 -T4 10.10.10.5 -oN allports.txt

# Step 2: Detailed scan on discovered ports
nmap -p 22,80,443 -sC -sV -oN detailed.txt 10.10.10.5

# One-liner: all ports + detail
nmap -p- -sC -sV -T4 --min-rate 5000 -oA full 10.10.10.5

Full Enumeration

# Comprehensive scan
nmap -sC -sV -O -p- -T4 --min-rate 5000 -oA full 10.10.10.5

# Vulnerability scan
nmap --script=vuln -p 22,80,443,445 -oN vulns.txt 10.10.10.5

# UDP quick scan
nmap -sU --top-ports 50 -T4 -oN udp.txt 10.10.10.5

Network Sweep

# Quick ping sweep + save live hosts
nmap -sn 10.10.10.0/24 -oG - | grep "Up" | awk '{print $2}' > live_hosts.txt

# Scan live hosts
nmap -iL live_hosts.txt -sC -sV -oA network_scan

Targeted Service Scans

# Web server deep scan
nmap -p 80,443,8080,8443 -sC -sV --script=http-enum,http-vuln*,http-headers 10.10.10.5

# SMB full enum
nmap -p 139,445 --script=smb-enum*,smb-vuln*,smb-os-discovery 10.10.10.5

# Active Directory recon
nmap -p 53,88,135,139,389,445,636,3268,3269,5985 -sC -sV 10.10.10.5

Extract Ports Script (Bash)

# Parse nmap output and extract open ports as comma-separated list
extractPorts() {
  ports=$(grep -oP '\d{1,5}/open' $1 | awk -F/ '{print $1}' | tr '\n' ',' | sed 's/,$//')
  echo "[*] Open ports: $ports"
  echo $ports | xclip -selection clipboard 2>/dev/null
}

# Usage
nmap -p- --min-rate 5000 -oG allports 10.10.10.5
extractPorts allports