Nmap

nmap -sP 10.0.0.0/24

Ping sweep to find live hosts on a subnet

nmap -iL targets.txt

Scan a list of targets from a text file

nmap [target] -sT

Scan TCP ports only

nmap [target] -sU -T5

Scan UDP ports (slower, use -T5 to speed up)

nmap [target] -sS

Stealth SYN scan (default technique, less likely to be logged)

nmap [target] -p 22-150

Scan a specific port range

nmap [target] -p- -T5

Scan all 65535 ports

nmap [target] --top-ports 100

Scan only the most common ports for a quick overview

nmap [target] -sV

Probe open ports for service/version info

nmap [target] -O

Enable OS detection

nmap [target] -sT -O -sV -T4

Combined OS + version detection

nmap [target] -A -T4

Aggressive scan: OS, version, scripts, traceroute

nmap [target] -sC -T5

Run default NSE scripts on open ports

nmap [target] --script http-enum.nse

Run a specific NSE script against the target

nmap [target] --script http-enum.nse -oN test.txt

Save scan output in normal format to a file

nmap [target] -sV -T5 -oA scan-results

Save output in all major formats at once

nmap [target] -p 3632 -sV

Investigate an unknown/suspicious port's version

nmap -p 3632 [target] --script distcc-cve2004-2687 --script-args="distcc-cve2004-2687.cmd='id'"

Run a vulnerability-specific NSE script with command execution

nmap [target] -T0

Paranoid timing — extremely slow requests, lowest chance of detection, used to evade strict IDS

nmap [target] -T1

Sneaky timing — still very slow, slightly faster than paranoid

nmap [target] -T2

Polite timing — slows down to use less bandwidth and target resources

nmap [target] -T3

Normal timing — the default speed when no timing option is specified

nmap [target] -T4

Aggressive timing — faster scans; not recommended against real targets due to increased detection risk

nmap [target] -T5

Insane timing — fastest and most aggressive, sacrifices accuracy for speed; not recommended against real targets due to very high detection risk