Nmap Master Reference
Install (Kali)
sudo apt update && sudo apt install -y nmap Usually preinstalled on Kali — verify: nmap --version
Full install index → Installation - Kali Setup
My Templates:
nmap -vv -p- --min-rate=1000 -oN nmap/allports.txt box.htb
nmap -vv -sVC -Pn -p3306 -oN nmap.txt 10.129.9.23
nmap -sU -p- --min-rate=1000 -oN udp_allports.txt soccer.htb
📌 1. Nmap Cheat Sheet (Quick Commands)
1. Basic Scanning
nmap 10.10.10.10 # Basic scan (TCP 1000 most common ports)
nmap -p- 10.10.10.10 # All 65535 TCP ports
nmap -p1-65535 10.10.10.10 # Explicit full port range
nmap -p22,80,443 10.10.10.10 # Specific ports only 2. Service & Version Detection
nmap -sV 10.10.10.10 # Detect service versions
nmap -sV --version-intensity 9 10.10.10.10 # Aggressive version detection 3. OS Detection
nmap -O 10.10.10.10 # OS detection nmap -A 10.10.10.10 # OS detection + version + scripts + traceroute 4. Fast & Stealthy Scans
nmap -T4 -F 10.10.10.10 # Fast scan of common ports nmap -sS 10.10.10.10 # Stealth SYN scan nmap -T2 10.10.10.10 # Slow scan to avoid detection 5. UDP Scanning
nmap -sU 10.10.10.10 # UDP scan (top 100 ports) nmap -sU -p53,123,161 10.10.10.10 # Specific UDP ports (DNS, NTP, SNMP) 6. Aggressive / Recon Scans
nmap -A 10.10.10.10 # Aggressive recon nmap -A -p- 10.10.10.10 # Aggressive + all ports 7. NSE Scripting (Nmap Scripting Engine)
nmap --script vuln 10.10.10.10 # Scan for vulnerabilities nmap --script http-enum 10.10.10.10 # Enumerate HTTP directories/files nmap --script smb-enum-shares 10.10.10.10 # Enumerate SMB shares nmap --script ftp-anon 10.10.10.10 # Check anonymous FTP login 8. Output Options
nmap -oN output.txt 10.10.10.10 # Normal output to file nmap -oX output.xml 10.10.10.10 # XML output nmap -oA scan 10.10.10.10 # All formats (scan.nmap, scan.xml, scan.gnmap) 9. Scan Multiple Targets
nmap 10.10.10.10 10.10.10.11 # Multiple IPs nmap 10.10.10.0/24 # Subnet nmap -iL targets.txt # List from file 10. Useful OSCP Combinations
# Step 1: Find all open ports quickly nmap -p- --min-rate=1000 -oN allports.txt 10.10.10.10
# Step 2: Scan only the found open ports with scripts & version detection nmap -sC -sV -p$( cat allports.txt | grep ^[0-9] | cut -d '/' -f 1 | tr '\n' ',' | sed 's/,$//' ) -oN targeted.txt 10.10.10.10 WebSockets — what Nmap does (and does not)
Nmap does not fuzz WebSocket messages. It helps before WS testing:
Nmap role Example Find open web ports -p- then -sV on 80, 443, 8080, 8443, 3000, 5000Service/version Node, nginx, Apache — hints at Socket.IO, Rails, etc. HTTP enum script --script http-enum may list paths; pair with Gobuster ffuf /ws, /socket.ioSSL/TLS on wss:// --script ssl-enum-ciphers on 443 if upgrade fails
nmap -sV -p 80,443,8080,8443,3000 TARGET nmap --script http-enum -p 80,443 TARGET After ports/services are known → Burp Suite Curl ws:// handshake) · SQLMap
📌 2. Full Nmap Option Flags
Target Specification
Flag Description -iL Input from list of targets -iR Choose random targets —exclude Exclude hosts/networks —excludefile Exclude targets from file
Host Discovery (Ping Scan)
Flag Description -sn Ping scan only -Pn Treat all hosts as online -PS[portlist] TCP SYN ping -PA[portlist] TCP ACK ping -PU[portlist] UDP ping -PY[portlist] SCTP INIT ping -PE ICMP echo ping -PP ICMP timestamp ping -PM ICMP netmask ping —disable-arp-ping Disable ARP discovery
Scan Techniques
Flag Description -sS TCP SYN scan -sT TCP connect scan -sU UDP scan -sY SCTP INIT scan -sN TCP Null scan -sF TCP FIN scan -sX TCP Xmas scan -sA TCP ACK scan -sW TCP Window scan -sM TCP Maimon scan —scanflags Custom TCP flags -sI Idle/Zombie scan -sO IP protocol scan -b FTP bounce scan
Port Specification & Order
Flag Description -p Specify ports/ranges -p- All 65535 ports —exclude-ports Skip specific ports -F Fast mode (100 ports) -r Scan sequentially
Service & Version Detection
Flag Description -sV Service/version detection —version-intensity <0-9> Set detection intensity —version-light Lighter scan —version-all Try all probes —version-trace Show version scan details
OS Detection & Traceroute
Flag Description -O OS detection —osscan-limit Limit OS detection —osscan-guess Aggressive OS guess —traceroute Run traceroute
Script Scanning (NSE) (add more to this?)
Flag Description -sC Default scripts —script Specific scripts —script-args Arguments for scripts —script-trace Show script communications —script-updatedb Update script DB —script-help Show help for scripts
Flag Description -T<0-5> Timing template —min-hostgroup Min parallel hosts —max-hostgroup Max parallel hosts —min-parallelism Min probes parallel —max-parallelism Max probes parallel —min-rtt-timeout Min RTT timeout —max-rtt-timeout Max RTT timeout —initial-rtt-timeout Initial RTT timeout —max-retries Max retries —host-timeout Give up after time —scan-delay Delay between probes —max-scan-delay Max delay —min-rate Min packet rate —max-rate Max packet rate
Firewall / IDS Evasion
Flag Description -f Fragment packets —mtu Custom MTU -D Decoy scan -S Spoof source IP -e Specific interface -g Source port —source-port Same as -g —data-length Append random data —ip-options Send with IP options —ttl Set TTL —spoof-mac Spoof MAC —badsum Bad checksum packets
Output
Flag Description -oN Normal output -oX XML output -oS Script kiddie output -oG Grepable output -oA All output formats —append-output Append to files -v Verbose -vv Very verbose —reason Show reason for port state —open Only open ports —packet-trace Show all packets —iflist Show interface info —log-errors Log errors —stats-every Periodic stats
Miscellaneous
Flag Description —help Show help -6 IPv6 scanning -A OS detect + version + scripts + traceroute —datadir Custom data dir —send-eth Raw ethernet frames —send-ip IP packets —privileged Assume full privileges —unprivileged Assume limited privileges