NMAP CHEAT SHEET

Tips for conducting a Nmap scan.

Advanced Scanning Options

TCP SYN Scan TCP connect scan UDP scan TCP Null scan TCP Fin scan Xmas scan TCP ACK scan Custom TCP scan IP protocol scan Send Raw Ethernet packets Send IP packets nmap -sS [target] nmap -sT [target] nmap -sU [target] nmap -sN [target] nmap -sF [target] nmap -sX [target] nmap -sA [target] nmap scanflags [flags] [target] nmap -sO [target] nmap send-eth [target] nmap send-ip [target] nmap -F [target] nmap -p [ports] [target] nmap -p [port name] [target] nmap -sU -sT -p U:[ports],T:[ports] [target] nmap -p * [target] nmap top-ports [number] [target] nmap -r [target]

Timing Options
Timing Templates Set the packet TTL Minimum of parallel connections Maximum of parallel connection Minimum host group size Maximum host group size Maximum RTT timeout Initial RTT timeout Maximum retries Host timeout Minimum Scan delay Maximum scan delay Minimum packet rate Maximum packet rate Defeat reset rate limits nmap -T [0-5] [target] nmap ttl [time] [target] nmap min-parallelism [number] [target] nmap max-parallelism [number] [target] nmap min-hostgroup [number] [targets] nmap max-hostgroup [number] [targets] nmap initial-rtttimeout [time] [target] nmap max-rtt-timeout [TTL] [target] nmap max-retries [number] [target] nmap host-timeout [time] [target] nmap scan-delay [time] [target] nmap max-scan-delay [time] [target] nmap min-rate [number] [target] nmap max-rate [number] [target] nmap defeat-rstratelimit [target]

Basic Scanning Techniques

Scan a single target Scan multiple targets Scan a list of targets Scan a range of hosts Scan an entire subnet Scan random hosts Excluding targets from a scan Excluding targets using a list Perform an aggressive scan Scan an IPv6 target nmap [target] nmap [target1,target2,etc] nmap -iL [list.txt] nmap [range of IP addresses] nmap [IP address/cdir] nmap -iR [number] nmap [targets] exclude [targets] nmap [targets] excludefile [list.txt] nmap -A [target] nmap -6 [target] nmap -sP [target] nmap -PN [target] nmap -PS [target] nmap -PA [target] nmap -PU [target] nmap -PY [target] nmap -PE [target] nmap -PP [target] nmap -PM [target] nmap -PO [target] nmap -PR [target] nmap traceroute [target] nmap -R [target] nmap -n [target]

Port Scanning Options

Perform a fast scan Scan specific ports Scan ports by name Scan ports by protocol

Discovery Options
Perform a ping scan only Dont ping TCP SYN Ping TCP ACK ping UDP ping SCTP Init Ping ICMP echo ping ICMP Timestamp ping ICMP address mask ping IP protocol ping ARP ping Traceroute Force reverse DNS resolution Disable reverse DNS resolution

Scan all ports Scan top ports Perform a sequential port scan

Version Detection
Operating system detection Attempt to guess an unknown Service version detection Troubleshooting version scans Perform a RPC scan nmap -O [target] nmap -O osscan-guess [target] nmap -sV [target] nmap -sV versiontrace [target] nmap -sR [target]

This cheat sheet was compiled by Steven M. Swafford, and is distributed according to the Creative Commons v3 Attribution License. File version 1.0. More cheat sheets?