Nmap ("Network Mapper") is a free and open-source utility for network discovery and security auditing. It's one of the most essential tools in a penetration tester's arsenal.
nmap target.example.comnmap -p 22,80,443 target.example.comnmap -p 1-1000 target.example.comnmap -p- target.example.comsudo nmap -sS target.example.comsudo nmap -sU target.example.comsudo nmap -O target.example.comnmap -sV target.example.comsudo nmap -sS -sV -sC -A -O -p- target.example.comnmap 192.168.1.0/24nmap 192.168.1.1 192.168.1.2 192.168.1.3nmap -iL targets.txtnmap -oN scan_results.txt target.example.comnmap -oX scan_results.xml target.example.comnmap -oA scan_results target.example.com# Paranoid (0) - Very slow, used for IDS evasion
nmap -T0 target.example.com
# Sneaky (1) - Quite slow, used for IDS evasion
nmap -T1 target.example.com
# Polite (2) - Slows down to consume less bandwidth
nmap -T2 target.example.com
# Normal (3) - Default timing template
nmap -T3 target.example.com
# Aggressive (4) - Assumes you're on a reasonably fast and reliable network
nmap -T4 target.example.com
# Insane (5) - Very aggressive; may overwhelm targets or miss open ports
nmap -T5 target.example.comnmap --min-parallelism 100 target.example.comsudo nmap -f target.example.comsudo nmap -D decoy1.example.com,decoy2.example.com,ME target.example.comsudo nmap --spoof-mac 00:11:22:33:44:55 target.example.comNmap Scripting Engine (NSE) provides additional functionality:
nmap --script vuln target.example.comnmap -sC target.example.comnmap --script http-title target.example.comnmap --script "http-*" target.example.comnmap -sV -sC -oA network_enum 192.168.1.0/24nmap -p 80,443 --script "http-*" target.example.comnmap -p 445 --script smb-enum-shares 192.168.1.0/24nmap -p 445 --script smb-vuln-ms17-010 target.example.comsudo nmap -sS -T2 -f -D 192.168.1.101,192.168.1.102,ME target.example.com| Command | Description |
|---|---|
nmap -sS target |
TCP SYN scan |
nmap -sT target |
TCP connect scan |
nmap -sU target |
UDP scan |
nmap -sV target |
Service/version detection |
nmap -sC target |
Default script scan |
nmap -O target |
OS detection |
nmap -A target |
Aggressive scan (OS + version + scripts + traceroute) |
nmap -p 1-65535 target |
Scan all ports |
nmap -p- target |
Scan all ports (shorthand) |
nmap -p http,https target |
Scan named ports |
nmap -F target |
Fast scan (top 100 ports) |
nmap -T0-5 target |
Timing templates (higher is faster) |
nmap -oN results.txt target |
Save output to text file |
nmap -oX results.xml target |
Save output to XML |
nmap -oG results.gnmap target |
Save output in grepable format |
nmap -oA results target |
Save in all formats |