Nmap

Nmap is a network scanner used for host discovery, port scanning, service/version detection, OS fingerprinting, and vulnerability scripting via NSE.

Host Discovery

nmap -sn 192.168.1.0/24          # ping sweep, no port scan
nmap -sn -PR 192.168.1.0/24      # ARP ping (local network)
nmap -Pn $IP                      # skip host discovery, treat as up

Port Scanning

nmap $IP                          # top 1000 ports (SYN scan if root)
nmap -p 80,443,8080 $IP           # specific ports
nmap -p 1-65535 $IP               # all ports
nmap -p- $IP                      # shorthand for all ports
nmap -sU $IP                      # UDP scan
nmap -sU -sS $IP                  # UDP + SYN together

Scan types:

• -sS: SYN scan (stealth, requires root)
• -sT: TCP connect scan (no root needed)
• -sU: UDP scan
• -sA: ACK scan (firewall rule mapping)
• -sN/sF/sX: Null, FIN, Xmas (evasion, unreliable on Windows)

Service & Version Detection

nmap -sV $IP
nmap -sV --version-intensity 9 $IP   # more aggressive probing

OS Detection

nmap -O $IP
nmap -O --osscan-guess $IP           # guess if not confident

Aggressive Scan

nmap -A $IP     # -sV -O --script=default --traceroute

Timing Templates

nmap -T0 $IP    # paranoid (IDS evasion, very slow)
nmap -T1 $IP    # sneaky
nmap -T3 $IP    # normal (default)
nmap -T4 $IP    # aggressive (faster, good for CTFs)
nmap -T5 $IP    # insane (may miss results)

NSE Scripts

nmap --script default $IP
nmap --script vuln $IP
nmap --script "ftp-*" $IP
nmap --script safe $IP
nmap --script $script --script-args user=$user,pass=$password $IP

Common script categories: auth, brute, default, discovery, dos, exploit, intrusive, safe, version, vuln.

Scripts are located in /usr/share/nmap/scripts/.

Output Formats

nmap -oN output.txt $IP      # normal
nmap -oX output.xml $IP      # XML
nmap -oG output.gnmap $IP    # grepable
nmap -oA output $IP          # all three at once

Common Profiles

Quick full scan:

nmap -p- -T4 --min-rate 5000 -sV -sC -oA full $IP

CTF/lab initial recon:

nmap -sV -sC -p- --open $IP

UDP top ports:

nmap -sU --top-ports 100 $IP