> For the complete documentation index, see [llms.txt](https://thamizhiniyancs.gitbook.io/cheatsheets/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://thamizhiniyancs.gitbook.io/cheatsheets/scanning-networks/nmap/nmap-commands.md). # Nmap Commands
CommandDescription
nmap -p- --min-rate=10000 <Target IP>Perform all port scan fast ( Ideal for CTFs not for real world targets )
nmap -p 1-65535 -T4 -A -v <Target IP>Perform intense scan on all TCP ports
nmap -p ports <Target IP>Run Nmap to identify IoT devices using insecure HTTP ports for transmitting data
nmap -T4 -A -v -Pn <Target IP>Perform Intense scan with no ping
nmap -T4 -A -v -PE -PS -PA Ports URLFootprint Web Infrastructure: Service Discovery
nmap -sn <Target IP>Perform ping scan
nmap -sn <Target IP/Subnet>Disable port scanning, host discovery only
nmap -sn -PR <Target IP>ARP Ping Scan
nmap -sn -PU <Target IP>UDP Ping Scan
nmap -sn -PE <Target IP>ICMP ECHO Ping Scan
nmap -sn -PE <IP range>ICMP ECHO Ping Sweep
nnmap –sn –PP <Target IP>ICMP Timestamp Ping Scan
nmap –sn –PM <Target IP>ICMP Address Mask Ping Scan
nmap –sn –PS <Target IP>TCP SYN Ping Scan
nmap –sn –PA <Target IP>TCP ACK Ping Scan
nmap –sn –PO <Target IP>IP Protocol Ping Scan
nmap -St -v <Target IP>TCP Connect/ Full Open Scan
namp -sS -v <Target IP>Stealth Scan (Half-open Scan)
nmap -sX -v <Target IP>Xmas Scan
nmap -sM -v <Target IP>TCP Maimon Scan
nmap -sA -v <Target IP>TCP Connect/ Full Open Scan
nmap –badsum <Target IP>Sending Bad Checksums
nmap --script smb-os-discovery.nse <Target IP>OS Discovery using Nmap Script Engine
nmap -sV -T4 -O -F –version-light <Target IP>Perform quick scan plus
nmap -sV -T4 -O -F –version-light scanme.nmap.orgPerform quick scan plus
nmap -sV –O –p <Target IP> nmap -sV --script http-enum <Target IP>NSE scripts to enumerate information about the target website/ web servers
nmap target IP address -p 80 --script http-frontpage-loginChecks whether target machines are vulnerable to anonymous Frontpage login
nmap --script http-passwd --script-args http-passwd.rootChecks if a web server is vulnerable to directory traversal by attempting to retrieve /etc/passwd or \boot.ini
nmap -sV --script http-enum <Target domain>Analyze Web Applications: Identify exposed Files and Directories of the target webserver
nmap -iL list-of-ips.txtScan targets from a text file
nmap --script=sniffer-detect [Target IP Address/Range of IP addresses]Command to detect NIC in promiscuous mode
nmap <Target IP> --data OxdeadbeefCreate Custom Packets by Appending Custom Binary Data
nmap <Target IP> --data-string “ph34r my |33t skills”Create Custom Packets by Appending Custom String
nmap <Target IP> --data-string 5Create Custom Packets by Appending Random Data
nmap –sU –p 500 <Target IP>Perform a check on the status of ISAKMP over port 500
nmap -sR <Target IP/network>Identify the RPC service running on the network
nmap --script hostmap <host>Discover virtual domains with hostmap
nmap --script http-trace -p80 localhostDetect a vulnerable server that uses the TRACE method
nmap --script http-google-email <host>Harvest email accounts with http-google-email
nmap -p80 --script http-userdir -enum localhostEnumerate users with http-userdir-enum
nmap -p80 --script http-trace <host>Detect HTTP TRACE
nmap -p80 --script http-waf-detect --script-args=”http-wafdetect. uri=/testphp. vulnweb.com/artists.php,http-wafdetect.detectBodyChanges” www.modsecurity.orgCheck if web server is protected by WAF/IPS
nmap --script http-enum -p80 <host>Enumerate common web applications
nmap -p80 --script http-robots.txt <host>Obtain robots.txt
nmap -p80 --script http-test.txt <host>Obtain test.txt
nmap --script=asn-query,whois,ip-geolocation-maxmind <Target IP>IP address Information
nmap --script=http-title <Target IP/ Subnet>Gather page titles from HTTP services
nmap --script=http-headers <Target IP/ Subnet>Get HTTP headers of web services
nmap --script=http-enum <Target IP/ Subnet>Find web apps from known paths
nmap -n -Pn -sSU -pT:0-65535,U:0-65535 -v -A -oX <Name><Target IP>Perform complete scan of the IoT device that checks for both TCP and UDP services and ports
nmap -sS -T4 -A -f -v <Target IP>Packet Fragmentation/ SYN/FIN scan using Nmap
nmap -g 80 <Target IP>Source Port Manipulation/ Use given source port number
nmap –sU –A –PN –n –pU:19,53,123,161 –script=ntp-monlist,dns-recursion,nmp-sysdescr <Target IP/ network>Scan for UDP DDOS reflectors
nmap -6 -n -Pn -sSU -pT:0-65535,U:0-65535 -v -A -oX <Name><Target IP>Identify the IPv6 capabilities of a device
nmap -T4 -A -v <Target IP>Perform intense scan
nmap -T4 -A <Target IP/Subnet>Identify vulnerable services on service port by attackers by using RPC Enumeration
nmap -p 23 <Target Domain>Telnet Enumeration
nmap -p 23 --script telnet-ntlm-info <Target IP>Enumerate information from remote Microsoft Telnet services with NTLM authentication enabled
nmap -p 23 –script telnet-brute.nse –script-argsPerform brute-force attack against telnet server
nmap -p 445 -A <Target IP>Enumerate SMB service running on the target IP address/ SMB Enumeration
nmap -p 21 <Target Domain>FTP Enumeration
nmap -p 69 <Target Domain>Enumerate TFTP service running on the target domain
nmap -p 179 <Target IP>BGP Enumeration
nmap -sS -sU -T4 -A -v <Target IP>Perform intense scan and scanning for UDP
nmap -sV -v -p 139,445 <Target IP/Subnet>Detect all exposed Netbios servers on the subnet
nmap -sV -v --script nbstat.nse <Target IP>map’s nbstat NSE script allow attackers to retrieve target’s NetBIOS names and MAC addresses
nmap -sU --script nbstat.nse -p 137 <Target IP address>Find target Netbios name
nmap --script-args=unsafe=1 --script smb-check-vulns.nse -p 445 <Target IP address>Check if Netbios servers are vulnerable to MS08-067
nmap -sV --version-intensity 0 <Target IP>Lighter banner grabbing detection
nmap -sV --version-intensity 5 <Target IP>More aggressive Service Detection
nmap -sV <Target IP>Attempts to determine the version of service running/ Standard service detection/ Service Version Discovery in Zenmap
nmap --script-help=ssl-heartbleedGet help for a script
nmap --script dns-zonetransfer.nse --script-args dns-zonetransfer.domain=<domain> -p53 <hosts>Attempts to pull a zone file (AXFR) from a DNS server
nmap --script http-robots.txt <hosts>Harvests robots.txt files from discovered web servers
nmap --script smb-brute.nse -p445 <hosts>Attempts to determine valid username and password combinations via automated guessing
nmap --script smb-psexec.nse –script-args=smbuser=<username>,smbpass=<password>[,config=<config>] -p445 <hosts>Attempts to run a series of programs on the target machine, using credentials provided as scriptargs
nmap -sV -p 443 --script=ssl-heartbleed <Target IP/Subnet>Detect Heartbleed SSL Vulnerability
nmap <Target IP>-50 -sL --dns-server <Target IP>Query the Internal DNS for hosts, list targets only
nmap -iR 10 -sn -tracerouteTraceroute to random targets, no port scan
nmap <Target IP>-1/24 -PR -sn -vvArp discovery only on local network, no port scan
nmap -iR 10 -PS22-25,80,113,1050,35000 -v -snDiscovery only on ports x, no port scan
nmap -sP <Target IP/Subnet>Ping scans the network, listing machines that respond to ping
nmap -v -sS -A -T4 <Target IP>Prints verbose output, runs stealth syn scan, T4 timing, OS and version detection, traceroute and scripts against target services
nmap -v -sV -O -sS -T5 <Target IP>Prints verbose output, runs stealth syn scan, T5 timing, OS and version detection
nmap -iL ip-addresses.txtScans a list of IP addresses
nmap — script-args=unsafe=1 —script smb-check-vulns.nse -p 445 <Target IP>Check if Netbios servers are vulnerable to MS08–067
nmap –Pn –p- -sI zombie targetAttack
nmap –b ftp rely hostFTP Bounce Scan :@:. is the name or IP address of a vulnerable FTP server
nmap -T0 <Target IP>Paranoid (0) Intrusion Detection System evasion
nmap -T1 <Target IP>Sneaky (1) Intrusion Detection System evasion
nmap -T2 <Target IP>Polite (2) slows down the scan to use less bandwidth and use less target machine resources
nmap -T3 <Target IP>Normal (3) default speed
nmap -T4 <Target IP>Aggressive (4) speeds scan; assumes you are on a reasonably fast and reliable network
nmap -T5 <Target IP>Insane (5) speeds scan; assumes you are on extraordinarily fast network
nmap --script=ftp <Target IP>Scan with a single script
nmap --script=http* <Target IP>Scan with a wildcard script
nmap --script=banner,http <Target IP>Scan with two scripts
nmap --script "not intrusive" <Target IP>Scan default, but remove intrusive scripts
nmap -Pn --script=http-sitemap-generator xyz.comHTTP site map generator
nmap -n -Pn -p 80 --open -sV -vvv --script banner,http-title -iR 1000Fast search for random web servers
nmap -Pn --script=dns-brute xyz.comBrute forces DNS hostnames guessing subdomain
nmap -n -Pn -vv -O -sV --script smb-enum*,smb-ls,smb-mbenum,smb-os-discovery,smb-s*,smb-vuln*,smbv2* -vv <Target IP>Safe SMB scripts to run
nmap --script whois*<Target Domain>Whois query
nmap -p80 --script http-unsafe-output-escaping <Target Website>Detect cross site scripting vulnerabilities
nmap -p80 --script http-sql-injection <Target>Check for SQL injections
nmap --data-length x <Target IP>Appends random data to sent packets
nmap -oN file.file --append-output <Target IP>Append a scan to a previous scan file
nmap --iflistShows the host interface and routes
nmap -6 2607:f0d2:5664:51::5Enable IPV6 scanning
nmap -T0 -b username:password@ftpserver.tld :21 victim.tldUses the username “username”, the password “password”, the FTP server “ftpserver.tld” and port 21 on said server to scan victim.tld.
nmap -sU -sT -p U:[ports],T:[ports] <Target IP>Scan ports by protocol
nmap -sV –version-trace <Target IP>Troubleshooting version scans
nmap –script [script.nse] <Target IP>Execute individual scripts
nmap –script [expression] <Target IP>Execute multiple scripts
nmap –script [category] <Target IP>Execute scripts by category
nmap –script [category1,category2, etc]Execute multiple scripts categories
nmap –script [script] –script-trace <Target IP>Troubleshoot scripts
$ docker -H <docker host> run --network=host --rm marsmensch/nmap -ox <IP Range>Use Nmap to scan the host’s internal network to identify running services
ndiff [scan1.xml] [scan2.xml]Comparison using Ndiff
ndiff -v [scan1.xml] [scan2.xml]Ndiff verbose mode
ndiff –xml [scan1.xm]XML output mode