nmap Cheat Sheet: Commands you should know

Basic nmap scan

Performs a basic scan of the specified target.

Command

nmap <target>

Example

nmap 192.168.1.1

Scan of a specific port

Scans a specific port on the specified destination.

Command

nmap -p <port> <target>

Example

nmap -p 80 192.168.1.1

Scan of port range

Scans all ports in the specified range.

Command

nmap -p <start port>-<end port> <target>

Example

nmap -p 80-100 192.168.1.1

Scan of all 65535 Ports

Scans all available ports (0-65535) on the target.

Command

nmap -p- <target>

Example

nmap -p- 192.168.1.1

TCP SYN Scan

Performs a quick and inconspicuous scan, also known as a “half-open” scan.

Command

nmap -sS <target>

Example

nmap -sS 192.168.1.1

TCP Connect Scan

Performs a complete TCP handshake. Useful if the user does not have privileged rights.

Command

nmap -sT <target>

Example

nmap -sT 192.168.1.1

UDP Scan

Scans the UDP ports of the target.

Command

nmap -sU <target>

Example

nmap -sU 192.168.1.1

ACK Scan

Detects whether a firewall is active and how it is configured.

Command

nmap -sA <target>

Example

nmap -sA 192.168.1.1

Window Scan

Recognizes firewall rules and identifies open ports through window size analysis.

Command

nmap -sW <target>

Example

nmap -sW 192.168.1.1

FIN Scan

Sends FIN packets to the target host. Effective for bypassing simple firewalls.

Command

nmap -sF <target>

Example

nmap -sF 192.168.1.1

OS Detection

Detects the operating system of the target host.

Command

nmap -O <target>

Example

nmap -O 192.168.1.1

Version detection

Detects the versions of the services running on the target host.

Command

nmap -sV <target>

Example

nmap -sV 192.168.1.1

Aggressive Scan

Performs a comprehensive scan including operating system detection, version detection, script scanning and traceroute.

Command

nmap -A <target>

Example

nmap -A 192.168.1.1

Traceroute

Determines the path from your computer to the target host.

Command

nmap --traceroute <target>

Example

nmap --traceroute 192.168.1.1

Ping Scan

Checks which hosts are active in the network without scanning ports.

Command

nmap -sn <network>

Example

nmap -sn 192.168.1.0/24

List Scan

Lists all hosts in a network without scanning them.

Command

nmap -sL <network>

Example

nmap -sL 192.168.1.0/24

Scan multiple targets

Scans multiple targets in a single command.

Command

nmap <target 1> <target 2> ...

Example

nmap 192.168.1.1 192.168.1.2 192.168.1.3

Scan list of targets

Scans all destinations listed in a file.

Command

nmap -iL <path to file>

Example

nmap -iL targets.txt

Fragmented packet scan

Sends fragmented packets to bypass firewalls.

Command

nmap -f <target>

Example

nmap -f 192.168.1.1

IP address transformation

Uses decoys to disguise the actual IP of the scanner.

Command

nmap -D <stealth IP> <target>

Example

nmap -D RND:10 192.168.1.1

Spoofing of source IP

Specifies a fake source IP to disguise the scan.

Command

nmap -S <fake IP> <target>

Example

nmap -S 192.168.1.100 192.168.1.1

Normal Output

Saves the scan results in normal format in a file.

Command

nmap -oN <filename> <target>

Example

nmap -oN scan_results.txt 192.168.1.1

XML Output

Saves the scan results in XML format.

Command

nmap -oX <filename> <target>

Example

nmap -oX scan_results.xml 192.168.1.1

Grep-able Output

Saves the scan results in a grep-friendly format.

Command

nmap -oG <filename> <target>

Example

nmap -oG scan_results.gnmap 192.168.1.1

All Output Formats

Saves the scan results in all available formats (normal, XML, grabbable).

Command

nmap -oA <filename> <target>

Example

nmap -oA scan_results 192.168.1.1

Script Scanning

Executes the standard Nmap scripts (NSE).

Command

nmap -sC <target>

Example

nmap -sC 192.168.1.1

Execute specific scripts

Executes a specific Nmap script.

Command

nmap --script <script name> <target>

Example

nmap --script http-title 192.168.1.1

Execute script categories

Executes all scripts of a certain category (e.g. –script vuln for vulnerability scripts). Categories: auth, broadcast, brute, default, discovery, dos, exploit, external, fuzzer, intrusive, malware, safe, version, vuln

Command

nmap --script <category> <target>

Example

nmap --script vuln 192.168.1.1

Timing Template

Sets the speed of the scan, with -T0 being the slowest and -T5 the fastest.

Command

nmap -T<0-5> <target>

Example

nmap -T4 192.168.1.1

Maximum simultaneous scans

Specifies the maximum number of simultaneous scans to control the network load.

Command

nmap --max-parallelism <amount> <target>

Example

nmap --max-parallelism 10

Maximum parallel scans

Determines the minimum number of hosts that are scanned simultaneously.

Command

nmap --min-hostgroup <amount> <target>

Example

nmap --min-hostgroup 50

IPv6 Scan

Performs a scan on an IPv6 destination.

Command

nmap -6 <target>

Example

nmap -6 2001:db8::ff00:42:8329

Silent Execution

Performs the scan without output on the screen.

Command

nmap -v0 <target>

Example

nmap -v0 192.168.1.1

Repeat Scans

Adds a delay between scans to bypass IDS/IPS.

Command

nmap --scan-delay <time> <target>

Example

nmap --scan-delay 5s 192.168.1.1