Nmap Cheat Sheet

Nmap is a very handy tool. As you can't always memorize all the options, here's your pocket reference.

Execute nmap without any parameters and you will get the full help menu, if you need more details (or you can use $nmap -h). The following lists are not all the options that Nmap offers; they're just the most common ones.

Nmap Usage: nmap [Scan Type(s)] [Options] [Destination IP / Range]

For example:

nmap -sS -v 192.168.0.10

Target specification

The target specification is the destination host or group of hosts. Here's what you can use in this field:

• Host name: your_target_domain.com
• IPv4 address: 192.168.1.1
• IPv6 address: 56c2:4be:2554:f94:f72d:c65:7182:4f20 (use -6 to enable IPv6)
• IP address range: 192.168.1.1-255
• CIDR block: 192.168.1.0/24
• Load targets (IP addresses) from a file: -iL [FileName] (for example, iL /root/ips.txt)

Host discovery

• List targets to scan (passive scan): -sL
• Ping scan (no scan): -sn
• No probe (no ping): -Pn
• Disable DNS resolution: -n or –R
• Execute a traceroute: --traceroute
• Specify a custom DNS server: --dns-servers [10.0.0.5,10.0.0.10]

Scan types and service versions

• Syn scan: -sS
• TCP connect scan: -sT
• Service version scan: -sV
• Version identification intensity: --version-intensity [level from 0 to 9] (0 is light and 9 will try all the possibilities)
• Operating system scan: -O
• Guess the operating system more aggressively: --osscan-guess
• Script scan: -sC
• UDP scan: -sU
• All= OS (-O) + version (-sV) + script (-sC) + traceroute (--traceroute) : -A

Port specification and scan order

• Single port: For example, -p 21
• The range of ports (from 1 to 1,000): For example, -p 1-1000
• A list of ports: For example, -p 21, 25, 80
• Popular ports: --top-ports [number] (for example, --top-ports 100 or --top-ports 1000)
• Scan fewer ports than the scanner default port numbers (fast mode): -F

Script scan

• Scan with the default: --script=default (same as -sC)
• Scan with a script (you can use commas to separate multiple scripts): --script=[script name] (for example, --script=http-enum)
• Specify arguments for the scripts: For example, --script-args creds.snmp=admin

Timing and performance

• Set timing speed (5 is the fastest): -T[0-5]
• Parallel host group sizes: --min-hostgroup/max-hostgroup <size>
• Number of parallel probes: --min-parallelism/max-parallelism <numprobes>
• Number of port scan probe retransmissions: --max-retries <tries>
• Give up on target after a certain time span: --host-timeout <time>

Firewall/IDS evasion and spoofing

• Spoof source IP address: For example, -S 10.0.0.10
• Use a source port: For example, --source-port=80
• Spoof a macOS address: --spoof-mac [mac address]

Output

• Normal output: -oN <file>
• XML output: -oX <file>
• Grep output: -oG <file>
• Increase verbosity level: -v (use -vv or more for greater effect)
• Increase debugging level: -d (use -dd or more for greater effect)
• Display the reason a port is in a particular state: --reason
• Only show open ports: --open
• Show all packets sent and received: --packet-trace
• XSL stylesheet to transform XML output to HTML: --stylesheet <path/URL> (for example, –stylesheet nmap.xsl)