Complete Nmap Scanning Commands CheatSheet by Hackopedia Utkarsh Thakur

Complete Nmap Scanning Commands CheatSheet by Hackopedia Utkarsh Thakur, ETHICAL HACKING , HACKOPEDIA

1. Complete Nmap Scanning Commands CheatSheet by
Hackopedia Utkarsh Thakur
1. Basic Scans:
●​nmap <target> - Basic scan (default is a SYN scan).
●​nmap -sT <target> - TCP connect scan (slower but useful for unprivileged
users).
●​nmap -sS <target> - SYN scan (default, stealthy and fast).
●​nmap -sU <target> - UDP scan.
●​nmap -p <port> <target> - Scan specific port.
●​nmap -p- <target> - Scan all 65535 ports.
2. Service and Version Detection:
●​nmap -sV <target> - Detect service version.
●​nmap -A <target> - Aggressive scan (OS detection, version, script scanning, and
traceroute).
●​nmap -O <target> - OS detection.
●​nmap --version-intensity 5 <target> - More accurate version detection.
3. Port Scanning Techniques:
●​nmap -p1-1000 <target> - Scan first 1000 ports.
●​nmap -p80,443,22 <target> - Scan specific ports.
●​nmap -F <target> - Fast scan (only scans commonly used ports).
●​nmap -sN <target> - Null scan (no flags, stealthy).
●​nmap -sF <target> - FIN scan (stealthy, used to bypass some firewalls).
●​nmap -sX <target> - Xmas scan (stealthy but less effective).
4. Firewall and IDS Evasion:
●​nmap -f <target> - Fragment packets to bypass firewalls.
●​nmap --mtu 16 <target> - Custom packet sizes.
●​nmap --scan-delay 5s <target> - Slower scanning to evade detection.
●​nmap --badsum <target> - Send packets with bad checksums to evade firewalls.
●​nmap -D RND:10 <target> - Use 10 random decoys to obscure the real scan.
●​nmap -S <spoofed IP> <target> - Spoof source IP.

2. 5. Script Scanning (NSE):
●​nmap --script=http-enum <target> - Enumerate HTTP services.
●​nmap --script=vuln <target> - Scan for known vulnerabilities.
●​nmap --script=default <target> - Run default scripts.
●​nmap --script=banner <target> - Grab service banners.
●​nmap --script=smb-os-discovery <target> - Identify SMB services and OS
version.
6. Network and Host Discovery:
●​nmap -sn <network> - Ping scan (find live hosts).
●​nmap -Pn <target> - Disable ping (useful if ICMP is blocked).
●​nmap -PS22,80,443 <target> - TCP SYN Ping.
●​nmap -PU53,123 <target> - UDP Ping.
●​nmap --traceroute <target> - Traceroute with Nmap.
●​nmap -R <target> - Reverse DNS resolution.
7. Performance and Speed Optimization:
●​nmap -T0 <target> - Paranoid scan (very slow, avoids detection).
●​nmap -T3 <target> - Normal scan (default speed).
●​nmap -T4 <target> - Aggressive scan (fast but detectable).
●​nmap -T5 <target> - Insane scan (fastest but easily detectable).
●​nmap --max-retries 1 <target> - Reduce retry count.
●​nmap --min-rate 1000 <target> - Set minimum scan rate.
8. IPv6 Scanning:
●​nmap -6 <IPv6 address> - Scan an IPv6 target.
●​nmap -sP -6 <network> - Discover IPv6 hosts.
●​nmap -p80 -6 <IPv6 address> - Scan specific ports on IPv6.
9. Aggressive and Comprehensive Scans:
●​nmap -A <target> - Full scan with OS, service detection, scripts, and traceroute.
●​nmap -p- -A <target> - Aggressive scan on all ports.
●​nmap -sS -sV -O -A -p- <target> - Full stealth scan with all details.
●​nmap -sC <target> - Run default scripts.
10. Output and Logging:
●​nmap -oN output.txt <target> - Save output in normal text format.
●​nmap -oX output.xml <target> - Save output in XML format.

3. ●​nmap -oG output.gnmap <target> - Save output in greppable format.
●​nmap -v <target> - Verbose mode (detailed output).
●​nmap -d <target> - Debug mode.
11. Scanning Multiple Targets:
●​nmap <target1> <target2> - Scan multiple hosts.
●​nmap 192.168.1.1-100 - Scan a range of IPs.
●​nmap -iL targets.txt - Scan targets from a file.
●​nmap -iR 100 - Scan 100 random hosts.
12. Advanced Scanning and Exploitation:
●​nmap --script=exploit <target> - Run exploit scripts.
●​nmap --script=http-vuln* <target> - Scan for HTTP vulnerabilities.
●​nmap --script=smb-vuln* <target> - Scan for SMB vulnerabilities.
●​nmap --script=ftp-anon <target> - Check for anonymous FTP access.
13. Brute-Force and Password Attacks:
●​nmap --script=ssh-brute <target> - SSH brute force attack.
●​nmap --script=ftp-brute <target> - FTP brute force.
●​nmap --script=http-brute <target> - HTTP brute force.
●​nmap --script=smb-brute <target> - SMB brute force.

This document provides all essential Nmap scanning
commands, from basic to advanced techniques. It can be
used as a quick reference guide for penetration testers,
ethical hackers, and network administrators.
For best performance, always scan responsibly and ensure legal compliance when testing
networks.

Prepared by HACKOPEDIA Utkarsh Thakur