Nmap
A powerful network scanning tool used to discover hosts, open ports, running services, and operating systems on a target network.
Host Discovery
| Command | Description |
|---|---|
| nmap -sP 10.0.0.0/24 | Ping sweep to find live hosts on a subnet |
| nmap -iL targets.txt | Scan a list of targets from a text file |
Port Scanning
| Command | Description |
|---|---|
| nmap [target] -sT | Scan TCP ports only |
| nmap [target] -sU -T5 | Scan UDP ports (slower, use -T5 to speed up) |
| nmap [target] -sS | Stealth SYN scan (default technique, less likely to be logged) |
| nmap [target] -p 22-150 | Scan a specific port range |
| nmap [target] -p- -T5 | Scan all 65535 ports |
| nmap [target] --top-ports 100 | Scan only the most common ports for a quick overview |
Service & OS Detection
| Command | Description |
|---|---|
| nmap [target] -sV | Probe open ports for service/version info |
| nmap [target] -O | Enable OS detection |
| nmap [target] -sT -O -sV -T4 | Combined OS + version detection |
| nmap [target] -A -T4 | Aggressive scan: OS, version, scripts, traceroute |
Scripting
| Command | Description |
|---|---|
| nmap [target] -sC -T5 | Run default NSE scripts on open ports |
| nmap [target] --script http-enum.nse | Run a specific NSE script against the target |
Output
| Command | Description |
|---|---|
| nmap [target] --script http-enum.nse -oN test.txt | Save scan output in normal format to a file |
| nmap [target] -sV -T5 -oA scan-results | Save output in all major formats at once |
Vulnerability Investigation
| Command | Description |
|---|---|
| nmap [target] -p 3632 -sV | Investigate an unknown/suspicious port's version |
| nmap -p 3632 [target] --script distcc-cve2004-2687 --script-args="distcc-cve2004-2687.cmd='id'" | Run a vulnerability-specific NSE script with command execution |
Timing
| Command | Description |
|---|---|
| nmap [target] -T0 | Paranoid timing — extremely slow requests, lowest chance of detection, used to evade strict IDS |
| nmap [target] -T1 | Sneaky timing — still very slow, slightly faster than paranoid |
| nmap [target] -T2 | Polite timing — slows down to use less bandwidth and target resources |
| nmap [target] -T3 | Normal timing — the default speed when no timing option is specified |
| nmap [target] -T4 | Aggressive timing — faster scans; not recommended against real targets due to increased detection risk |
| nmap [target] -T5 | Insane timing — fastest and most aggressive, sacrifices accuracy for speed; not recommended against real targets due to very high detection risk |