Nmap cheatsheet

nmap 192.168.1.1                  # single IP
nmap 192.168.1.1-254              # IP range
nmap 192.168.1.0/24               # CIDR subnet
nmap 10.0.0.1 10.0.0.2 10.0.0.3  # multiple IPs
nmap -iL targets.txt              # from file
nmap -iR 100                      # 100 random targets
nmap --exclude 192.168.1.5        # exclude host
nmap --excludefile skip.txt       # exclude from file
nmap scanme.nmap.org              # hostname
nmap -6 ::1                       # IPv6 loopback
nmap -6 2001:db8::1               # IPv6 address
nmap -6 fe80::1%eth0              # IPv6 link-local with iface

# UDP scan - slow but critical (DNS/SNMP/DHCP)
nmap -sU -p 53,67,68,69,111,123,137,161,500 <target>

# Combine UDP + TCP in one run
nmap -sU -sS -p U:53,161,T:22,80,443 <target>

# IP protocol scan (find which IP protocols are supported)
nmap -sO <target>

# Idle/zombie scan - uses zombie's IPID to stay invisible
nmap -sI 10.0.0.10:80 <target>

# Custom TCP flags
nmap --scanflags SYNFIN <target>
nmap --scanflags URGACKPSHRSTSYNFIN <target>

# ARP sweep on local subnet (fastest + most reliable)
nmap -sn -PR 192.168.1.0/24

# Remote subnet - SYN to 80,443 + ICMP
nmap -sn -PS80,443 -PE 10.10.10.0/24

# ACK ping bypasses some SYN-filtering firewalls
nmap -sn -PA80,443 10.10.10.0/24

# UDP ping on common ports
nmap -sn -PU53,161 10.10.10.0/24

# Combine multiple probe types for thorough discovery
nmap -sn -PS22,80,443 -PA80 -PE -PP 10.10.10.0/24

# List targets without sending any packets
nmap -sL 192.168.1.0/24

# Skip discovery entirely (assume all hosts up)
nmap -Pn -p 80,443 10.10.10.0/24

# Standard version scan
nmap -sV -p 22,80,443 <target>

# Aggressive version (all probes)
nmap -sV --version-all -p- <target>

# OS detection (needs open + closed port)
nmap -O --osscan-guess <target>

# Full aggressive detection
nmap -A -T4 <target>

# Tuned for fast internal network pentest
nmap -sS -p- --min-rate 5000 --max-retries 2 -T4 <target>

# Large subnet with controlled parallelism
nmap -sn --min-hostgroup 64 --min-parallelism 64 192.168.0.0/16

# Slow IDS-safe scan
nmap -sS -T1 --scan-delay 2s --max-retries 1 <target>

# Rate-limited to avoid triggering thresholds
nmap -sS -p- --max-rate 100 -T2 <target>

# Fragment packets to bypass basic packet filters
nmap -f -sS -p 80,443 <target>

# Double fragment (16-byte chunks)
nmap -ff -sS <target>

# Custom MTU fragmentation
nmap --mtu 16 -sS <target>

# Decoy: hide among 10 random IPs
nmap -D RND:10 -sS <target>

# Decoy: specify exact decoys + mark your position
nmap -D 10.0.0.2,10.0.0.3,ME,10.0.0.5 -sS <target>

# Spoof source IP (requires proper routing; need -e)
nmap -S 192.168.1.100 -e eth0 <target>

# Spoof source port 53 (DNS trust bypass)
nmap --source-port 53 -sS <target>

# Look less like a scan by adding payload noise
nmap --data-length 25 -sS <target>

# Detect FW/IDS presence with bogus checksums
nmap --badsum <target>

# Spoof MAC to a Cisco vendor prefix
nmap --spoof-mac Cisco <target>

# Spoof MAC to random address
nmap --spoof-mac 0 <target>

# Idle scan via zombie (your IP never contacts target)
nmap -sI 10.0.0.10:80 -p 1-1024 <target>

# Combine evasion: fragment + decoys + source port spoof
nmap -f --source-port 53 -D RND:5 -sS -T2 <target>

# Relay through SOCKS4 proxy
nmap --proxies socks4://127.0.0.1:9050 -sT -Pn <target>

# ACK scan to determine if ports are filtered
nmap -sA -p 22,80,443 <target>

# Window scan - can distinguish open/closed on some systems
nmap -sW -p 22,80,443 <target>

# Null/FIN/Xmas to probe stateless (non-stateful) filters
nmap -sN -p 22,80 <target>   # null
nmap -sF -p 22,80 <target>   # FIN
nmap -sX -p 22,80 <target>   # Xmas

# Compare SYN vs ACK results to identify FW rules
nmap -sS -p 1-100 <target> -oG syn.gnmap
nmap -sA -p 1-100 <target> -oG ack.gnmap

# Enable IPv6 mode with -6
nmap -6 ::1
nmap -6 2001:db8::1
nmap -6 fe80::1%eth0          # link-local requires interface

# Full recon over IPv6
nmap -6 -A -T4 2001:db8::1

# SYN scan IPv6 target
nmap -6 -sS -p- <target>

# UDP over IPv6
nmap -6 -sU --top-ports 20 <target>

# Subnet scan (IPv6 /64 too large for full sweep)
nmap -6 -sn 2001:db8::/120   # use small subnets only

# NSE over IPv6
nmap -6 --script=http-title -p 80,443 2001:db8::1

# IPv6 neighbor discovery on local segment
nmap -6 -sn --script=targets-ipv6-multicast-invalid-dst fe80::1%eth0

# Multicast ping sweep
nmap -6 -sn ff02::1%eth0

# EUI-64 address generation from MAC (manual conversion)
# MAC: 00:50:56:ab:cd:ef
# EUI-64: 0250:56ff:feab:cdef -> 2001:db8::250:56ff:feab:cdef

# Check anonymous FTP login
nmap --script=ftp-anon -p 21 <target>

# Check for anonymous/guest SMB access
nmap --script=smb-security-mode -p 445 <target>

# Check for open X11 display
nmap --script=x11-access -p 6000 <target>

# Check for open SNMP (community strings)
nmap --script=snmp-info -p 161 <target>

# HTTP auth methods
nmap --script=http-auth-finder -p 80,443 <target>

# LDAP anonymous bind
nmap --script=ldap-rootdse -p 389 <target>

# SMTP open relay check
nmap --script=smtp-open-relay -p 25,465,587 <target>

# Redis no-auth check
nmap --script=redis-info -p 6379 <target>

# MongoDB no-auth check
nmap --script=mongodb-info -p 27017 <target>

# SSH brute force
nmap -p 22 --script=ssh-brute \
  --script-args="userdb=users.txt,passdb=pass.txt" <target>

# FTP brute force
nmap -p 21 --script=ftp-brute \
  --script-args="userdb=users.txt,passdb=pass.txt" <target>

# SMB brute force
nmap -p 445 --script=smb-brute \
  --script-args="userdb=users.txt,passdb=pass.txt" <target>

# HTTP basic/digest/NTLM brute
nmap -p 80 --script=http-brute \
  --script-args="http-brute.path=/login" <target>

# MySQL brute force
nmap -p 3306 --script=mysql-brute \
  --script-args="userdb=users.txt,passdb=pass.txt" <target>

# MSSQL brute force
nmap -p 1433 --script=ms-sql-brute \
  --script-args="userdb=users.txt,passdb=pass.txt" <target>

# Telnet brute force
nmap -p 23 --script=telnet-brute \
  --script-args="userdb=users.txt,passdb=pass.txt" <target>

# VNC brute force
nmap -p 5900 --script=vnc-brute \
  --script-args="passdb=pass.txt" <target>

# Stop on first valid credential
nmap --script=ssh-brute \
  --script-args="brute.firstonly=true,userdb=u.txt,passdb=p.txt" -p 22 <target>

# Show host keys (fingerprint + algorithm)
nmap --script=ssh-hostkey -p 22 <target>

# Enumerate auth methods
nmap --script=ssh-auth-methods -p 22 <target>

# Check for weak CBC/MD5 ciphers
nmap --script=ssh2-enum-algos -p 22 <target>

# Brute force
nmap --script=ssh-brute --script-args="userdb=u.txt,passdb=p.txt" -p 22 <target>

# Run user-defined commands via authenticated session
nmap --script=ssh-run --script-args="ssh-run.cmd=id,ssh-run.username=root,ssh-run.password=root" -p 22 <target>

# FTP anonymous login
nmap --script=ftp-anon -p 21 <target>

# FTP banner + syst info
nmap --script=ftp-syst -p 21 <target>

# FTP bounce attack capability
nmap --script=ftp-bounce -p 21 <target>

# FTP brute force
nmap --script=ftp-brute --script-args="userdb=u.txt,passdb=p.txt" -p 21 <target>

# DNS zone transfer (AXFR)
nmap --script=dns-zone-transfer --script-args="dns-zone-transfer.domain=target.com" -p 53 <target>

# DNS subdomain brute force
nmap --script=dns-brute --script-args="dns-brute.domain=target.com,dns-brute.threads=8" <target>

# DNS recursion check (open resolver)
nmap --script=dns-recursion -p 53 <target>

# DNS service info
nmap --script=dns-service-discovery <target>

# Certificate info (SAN, expiry, issuer)
nmap --script=ssl-cert -p 443,8443 <target>

# Enumerate supported cipher suites + strength
nmap --script=ssl-enum-ciphers -p 443 <target>

# Heartbleed (OpenSSL memory disclosure)
nmap --script=ssl-heartbleed -p 443 <target>

# POODLE / SSLv3
nmap --script=ssl-poodle -p 443 <target>

# Full TLS audit
nmap --script="ssl-cert,ssl-enum-ciphers,ssl-heartbleed,ssl-poodle" -p 443 <target>

# Banner grab (any port)
nmap --script=banner -p 21,22,25,80,110 <target>

# SNMP system description
nmap --script=snmp-sysdescr -p 161 -sU <target>

# SNMP full walk (community=public)
nmap --script=snmp-walk --script-args="snmpcommunity=public" -p 161 -sU <target>

# NTP monlist (DDoS amplification check)
nmap --script=ntp-monlist -p 123 -sU <target>

# IPMI cipher zero (auth bypass)
nmap --script=ipmi-cipher-zero -p 623 -sU <target>

# VNC info + auth type
nmap --script=vnc-info,vnc-auth-bypass -p 5900 <target>

# RDP encryption info
nmap --script=rdp-enum-encryption -p 3389 <target>

# Step 1: Subnet host discovery
nmap -sn -PS22,80,443 -PA80 -PE 10.10.10.0/24 -oG alive.gnmap

# Step 2: Extract live hosts
grep "Up" alive.gnmap | cut -d' ' -f2 > live_hosts.txt

# Step 3: All-port SYN scan on live hosts
nmap -iL live_hosts.txt -sS -p- --min-rate 3000 -T4 -oG allports.gnmap

# Step 4: Targeted service scan on open ports
ports=$(grep -oP '\d+/open' allports.gnmap | cut -d/ -f1 | sort -un | tr '\n' ',' | sed 's/,$//')
nmap -iL live_hosts.txt -sV -sC -O -p "$ports" -oA deep_recon

# Step 5: Vuln scan on interesting ports
nmap -iL live_hosts.txt --script=vuln -p "$ports" -oA vuln_scan

# Common UDP services
nmap -sU -p 53,67,68,69,111,123,137,138,161,162,389,500,514,520,631,1900,4500 \
  --max-retries 1 -T4 <target>

# SNMP community string brute force
nmap -sU -p 161 --script=snmp-brute <target>

# SNMP full enumeration
nmap -sU -p 161 --script="snmp-*" <target>

# NFS exports
nmap -p 111 --script=nfs-showmount <target>

# DHCP info
nmap -sU -p 67 --script=dhcp-discover <target>

# Import XML into Metasploit
msf> db_import /path/to/scan.xml

# Convert gnmap to IP list for other tools
awk '/Up/{print $2}' hosts.gnmap | tee ips.txt | wc -l

# Feed to gobuster/nikto for web targets
awk '/80\/open/{print "http://"$2}' scan.gnmap | while read url; do nikto -h "$url"; done

# Combine nmap host discovery + masscan for speed
nmap -sn 10.0.0.0/8 -oG - | awk '/Up/{print $2}' > hosts.txt
masscan -iL hosts.txt -p0-65535 --rate=10000 -oG masscan.gnmap

# Resume an interrupted scan
nmap --resume /path/to/scan.nmap

# Scan with no internet-touching (no version db updates)
nmap --datadir /usr/share/nmap -sV <target>

• Nmap
• Nmap NSE Docs
• Nmap Book: Firewall Evasion
• Nmap Timing Templates
• Nmap Options Reference
• SecLists
• HackTricks
• PayloadsAllTheThings

• Metasploit (Exploitation framework)
• NetExec (SMB/WinRM/LDAP)
• ffuf (Web fuzzing)
• Gobuster (Directory brute-force)
• SQLmap (SQL injection)
• Pentest Toolkit (Methodology)
• Red Team Toolkit (Offensive tools)