Jul 26, 2024, 06:54 AM
Lets tallk on Nmap: 
These commands offer a range of scanning techniques and options to suit different penetration testing and network discovery scenarios.
Combine flags for scanning and try to discover more about the network before trying to engage. Stealthy and less aggressive scans are far better than quick and dirty ones.
save this as a cheat sheet for later use.
TCP SYN Scan (Stealth Scan):
nmap -sS <target>
Performs a TCP SYN scan, which is faster and stealthier than the default TCP connect scan.
TCP Connect Scan:
nmap -sT <target>
Uses the full TCP handshake to connect to ports, more reliable but less stealthy than SYN scan.
UDP Scan:
nmap -sU <target>
Scans for open UDP ports, useful for services that use UDP instead of TCP.
TCP ACK Scan:
nmap -sA <target>
Determines whether ports are filtered (firewalled) without completing a full connection.
TCP Window Scan:
nmap -sW <target>
Uses TCP window size to determine open ports.
TCP Maimon Scan:
nmap -sM <target>
Uses a crafted ACK packet to determine open ports.
IP Protocol Scan:
nmap -sO <target>
Lists IP protocols supported by the target.
Idle Scan (or Zombie Scan):
nmap -sI <zombie host> <target>
Uses a third-party system to perform scans, making it harder to detect the source of the scan.
Version Detection:
nmap -sV <target>
Attempts to determine versions of services running on open ports.
OS Detection:
nmap -O <target>
Attempts to determine the operating system of the target.
Service Version Scan (More Aggressive):
nmap -sV --version-intensity 9 <target>
Increases the intensity of version detection, attempting to detect more details about services.
Script Scan:
nmap -sC <target>
Runs default scripts to gather more information about the target.
Aggressive Scan:
nmap -A <target>
Enables OS detection, version detection, script scanning, and traceroute.
Fast Scan:
nmap -F <target>
Scans only the most common ports (100 most common ports).
Exclude Hosts or Networks:
nmap --exclude <host1>,<host2> <target>
Excludes specified hosts or networks from the scan.
Scan using a specific network interface:
nmap -e <interface> <target>
Specifies the network interface to use for scanning.
Save Output to XML file:
nmap -oX <filename.xml> <target>
Saves scan results in XML format for further analysis or reporting.
Combining Nmap flags can help you tailor scans to gather specific information while balancing speed and stealth.
Here are some practical examples of combined Nmap flags in use:
These commands offer a range of scanning techniques and options to suit different penetration testing and network discovery scenarios.
Combine flags for scanning and try to discover more about the network before trying to engage. Stealthy and less aggressive scans are far better than quick and dirty ones.
save this as a cheat sheet for later use.
TCP SYN Scan (Stealth Scan):
nmap -sS <target>
Performs a TCP SYN scan, which is faster and stealthier than the default TCP connect scan.
TCP Connect Scan:
nmap -sT <target>
Uses the full TCP handshake to connect to ports, more reliable but less stealthy than SYN scan.
UDP Scan:
nmap -sU <target>
Scans for open UDP ports, useful for services that use UDP instead of TCP.
TCP ACK Scan:
nmap -sA <target>
Determines whether ports are filtered (firewalled) without completing a full connection.
TCP Window Scan:
nmap -sW <target>
Uses TCP window size to determine open ports.
TCP Maimon Scan:
nmap -sM <target>
Uses a crafted ACK packet to determine open ports.
IP Protocol Scan:
nmap -sO <target>
Lists IP protocols supported by the target.
Idle Scan (or Zombie Scan):
nmap -sI <zombie host> <target>
Uses a third-party system to perform scans, making it harder to detect the source of the scan.
Version Detection:
nmap -sV <target>
Attempts to determine versions of services running on open ports.
OS Detection:
nmap -O <target>
Attempts to determine the operating system of the target.
Service Version Scan (More Aggressive):
nmap -sV --version-intensity 9 <target>
Increases the intensity of version detection, attempting to detect more details about services.
Script Scan:
nmap -sC <target>
Runs default scripts to gather more information about the target.
Aggressive Scan:
nmap -A <target>
Enables OS detection, version detection, script scanning, and traceroute.
Fast Scan:
nmap -F <target>
Scans only the most common ports (100 most common ports).
Exclude Hosts or Networks:
nmap --exclude <host1>,<host2> <target>
Excludes specified hosts or networks from the scan.
Scan using a specific network interface:
nmap -e <interface> <target>
Specifies the network interface to use for scanning.
Save Output to XML file:
nmap -oX <filename.xml> <target>
Saves scan results in XML format for further analysis or reporting.
Combining Nmap flags can help you tailor scans to gather specific information while balancing speed and stealth.
Here are some practical examples of combined Nmap flags in use: