| Basic scans | |
| Scan a Single Target | nmap [target] |
| Scan Multiple Targets | nmap [target1] [target2] |
| Scan a Range of Hosts | nmap [start ip address- end ip address] |
| Scan an Entire Subnet | nmap [ip address/cdir] |
| Scan Random Hosts | nmap -iR [number] |
| Excluding Targets from a Scan | nmap [targets] – exclude [targets] |
| Excluding Targets Using a List | nmap [targets] – excludefile [list.txt] |
| Perform an Aggressive Scan | nmap -A [target] |
| Scan an IPv6 Target | nmap -6 [target ipv6] |
| Discovery Scans | |
| Perform a Ping Only Scan | nmap -sP [target] |
| Don’t Ping | nmap -PN [target] |
| TCP SYN Ping | nmap -PS [target] |
| TCP ACK Ping | nmap -PA [target] |
| UDP Ping | nmap -PU [target] |
| SCTP INIT Ping | nmap -PY [target] |
| ICMP Echo Ping | nmap -PE [target] |
| ICMP Timestamp Ping | nmap -PP [target] |
| CMP Address Mask Ping | nmap -PM [target] |
| IP Protocol Ping | nmap -PO [target] |
| ARP Ping | nmap -PR [target] |
| Traceroute | nmap –traceroute [target] |
| Force Reverse DNS Resolution | nmap -R [target] |
| Disable Reverse DNS Resolution | nmap -n [target] |
| Alternative DNS Lookup | nmap –system-dns [target] |
| Manually Specify DNS Server(s) | nmap –dns-servers [servers] [target] |
| Create a Host List | nmap -sL [targets] |
| Advanced Scans | |
| TCP SYN Scan | nmap -sS [target] |
| TCP Connect Scan | nmap -sT [target] |
| UDP Scan | nmap -sU [target] |
| TCP NULL Scan | nmap -sN [target] |
| TCP FIN Scan | nmap -sF [target] |
| Xmas Scan | nmap -sX [target] |
| TCP ACK Scan | nmap -sA [target] |
| Custom TCP Scan | nmap –scanflags [flags] [target] |
| IP Protocol Scan | nmap -sO [target] |
| Send Raw Ethernet Packets | nmap –send-eth [target] |
| Send IP Packets | nmap –send-ip [target] |
| Port Scanning options | |
| Perform a Fast Scan | nmap -F [target] |
| Scan Specific Ports | nmap -p [port(s)] [target] |
| Scan Ports by Name | nmap -p [port name(s)] [target] |
| Scan Ports by Protocol | nmap -sU -sT -p U: [ports],T:[ports] [target] |
| Scan All Ports | nmap -p ‘*’ [target] |
| Scan Top Ports | nmap –top-ports [number] [target] |
| Perform a Sequential Port Scan | nmap -r [target] |
| Firewall evasion | |
| augment Packets | nmap -f [target] |
| pacify a Specific MTU | nmap –mtu [MTU] [target] |
| Use a Decoy | nmap -D RND:[number] [target] |
| le Zombie Scan | nmap -sI [zombie] [target] |
| Manually Specify a Source Port | nmap –source-port [port] [target] |
| Append Random Data | nmap –data-length [size] [target] |
| Randomize Target Scan Order | nmap –randomize-hosts [target] |
| Spoof MAC Address | nmap –spoof-mac [MAC|0|vendor] [target] |
| Send Bad Checksums | nmap –badsum [target] |
| NMAP Scipting | |
| Execute Individual Scripts | nmap –script [script.nse] [target] |
| Execute Multiple Scripts | nmap –script [expression] [target] |
| Script Categories | all, auth, default, discovery, external, intrusive, malware, safe, vuln |
| Execute Scripts by Category | nmap –script [category] [target] |
| Execute Multiple Script Categories | nmap –script [category1,category2,etc] |
| Troubleshoot Scripts | nmap –script [script] –script trace [target] |
| Update the Script Database | nmap –script-updatedb |
Scan thru Metasploit and import scan results in DB
Scan a target/network/subnet:
nmap -Pn -sS -A -oX Scan-Results x.x.x.x/24
Import in Metasploit:
db_import Scan-Results
View the hosts imported from the Scan-Results, type:
hosts
View the services from the imported Scan-Results, type:
db_services
