Introduction

In the vast expanse of the digital world, where every packet tells a story, Nmap is the hacker’s reconnaissance tool of choice. Whether mapping networks, identifying vulnerabilities, or conducting stealth scans, Nmap is a must-have for ethical hackers and security pros alike.

This cheat sheet covers the most effective Nmap commands for network discovery, vulnerability assessment, and stealth operations.

---

Basic Scanning

Discover Live Hosts (Ping Scan)

nmap -sn 192.168.1.0/24

Scans an entire subnet and lists active devices without probing ports.

Quick Port Scan (Top 1000 Ports)

nmap 192.168.1.1

Performs a fast scan of the most common 1000 TCP ports.

Full Port Scan (All 65,535 Ports)

nmap -p- 192.168.1.1

Scans all possible TCP ports.

Scan Specific Ports

nmap -p 22,80,443 192.168.1.1

Targets specific ports like SSH, HTTP, and HTTPS.

Detect Services & Versions

nmap -sV 192.168.1.1

Identifies running services and their versions.

Detect Operating System

nmap -O 192.168.1.1

Attempts OS detection using TCP/IP fingerprinting.

---

Advanced Scanning Techniques

Stealth Scan (SYN Scan)

nmap -sS 192.168.1.1

A quieter scan that sends SYN packets and monitors responses without completing connections.

UDP Scan

nmap -sU -p 53,161 192.168.1.1

Scans UDP ports like DNS (53) and SNMP (161), often overlooked attack surfaces.

Aggressive Scan (Comprehensive Information Gathering)

nmap -A 192.168.1.1

Combines OS detection, version detection, script scanning, and traceroute.

Scan an Entire Subnet

nmap 192.168.1.0/24

Scans all devices on a given subnet.

Scan Multiple Targets

nmap 192.168.1.1 192.168.1.2 192.168.1.3

Scans multiple specific IP addresses.

---

Vulnerability Scanning & Firewall Evasion

Scan for Known Vulnerabilities

nmap --script=vuln 192.168.1.1

Runs vulnerability detection scripts against the target.

Evade Firewalls with Fragmented Packets

nmap -f 192.168.1.1

Breaks up packets to bypass basic firewall filtering.

Use Decoys to Mask Your Scan

nmap -D RND:10 192.168.1.1

Generates fake scan sources to obfuscate your real IP.

Detect Firewalls & IDS Presence

nmap -sA 192.168.1.1

Sends TCP ACK packets to determine if a firewall is blocking requests.

---

Automating Scans with Nmap Scripting Engine (NSE)

Run a Specific Security Script

nmap --script=ssl-heartbleed 192.168.1.1

Checks for Heartbleed vulnerability on SSL-enabled servers.

Run Default Security Scripts

nmap --script=default 192.168.1.1

Executes Nmap’s built-in default scripts for common security checks.

Brute Force Passwords (Example: FTP)

nmap --script=ftp-brute -p 21 192.168.1.1

Attempts brute-force authentication against an FTP server.

---

Conclusion

Nmap is an essential tool for ethical hackers, red teamers, and security researchers. From basic host discovery to advanced evasion techniques, mastering Nmap is a game-changer in reconnaissance and penetration testing.

Nmap is an essential tool for ethical hackers, red teamers, and security researchers. From basic host discovery to advanced evasion techniques, mastering Nmap is a game-changer in reconnaissance and penetration testing.

If you want to take your Nmap skills further, I cover everything from advanced scanning techniques to firewall evasion in my Nmap Masterclass. Whether you’re a beginner or looking to refine your recon game, this course will get you there.