Nmap Cheat Sheet

Basic Scanning

• Host discovery nmap -sn <target>
• Port scan (default 1000) nmap <target>
• Scan all 65535 ports nmap -p- <target>
• Scan specific ports nmap -p 22,80,443 <target>
• Scan a port range nmap -p 1-1000 <target>
• Fast scan (common ports only) nmap -F <target>
• Scan top N ports nmap --top-ports 100 <target>

Scan Types

• TCP SYN scan (default, needs root) nmap -sS <target>
• TCP connect scan (no root) nmap -sT <target>
• UDP scan nmap -sU <target>
• Ping sweep only nmap -sn <CIDR>
• TCP ACK scan (firewall rules) nmap -sA <target>
• FIN/NULL/XMAS scans (stealthy) nmap -sF|-sN|-sX <target>

Version & OS Detection

• Service/version detection nmap -sV <target>
• OS detection nmap -O <target>
• Aggressive (OS + version + scripts + traceroute) nmap -A <target>
• Version detection intensity (0–9) nmap -sV --version-intensity 5 <target>

NSE Scripts

• Default scripts nmap -sC <target>
• Run a specific script nmap --script <script-name> <target>
• Run script category nmap --script vuln <target> (vuln, safe, auth, default, discovery, exploit)
• Brute force common services nmap --script brute <target>
• SMB enumeration nmap --script smb-enum-shares,smb2-security-mode -p 445 <target>
• HTTP head/methods nmap --script http-headers,http-methods -p 80 <target>

Output

• Save all formats nmap -oA <basename> <target>
• Normal output nmap -oN <file> <target>
• Grep-able output nmap -oG <file> <target>
• XML output (import into other tools) nmap -oX <file> <target>

Timing & Evasion

• Timing templates (0–5, T4 = fast) nmap -T4 <target>
• Spoof source IP/decoy scan nmap -D RND:10 <target>
• Fragment packets nmap -f <target>
• Randomize host order nmap --randomize-hosts <target>

Firewall / IDS Bypass

• TCP ACK probe to test firewall nmap -sA -p <port> <target>
• Free port discovery via scan nmap --scan-delay 1s <target>
• Source port 53 scan nmap -g 53 <target>

Proxies

• Scan through a proxy nmap --proxy <host>:<port> <target>
• Scan from a specific source IP nmap -S <source-ip> <target>