Nmap

1
sudo nmap -sS 10.1.1.1   #TCP SYN scan
2
sudo nmap -sT 10.1.1.1   #TCP Connect scan
3
sudo nmap -sA 10.1.1.1   #TCP ACK scan
4
sudo nmap -sW 10.1.1.1   #TCP Window scan
5
sudo nmap -sM 10.1.1.1   #TCP Maimon scan
6
sudo nmap -sU 10.1.1.1   #UDP scan
7
sudo nmap -sN 10.1.1.1   #TCP Null scan
8
sudo nmap -sF 10.1.1.1   #TCP FIN scan
9
sudo nmap -sX 10.1.1.1   #TCP Xmas scan
10
sudo nmap -sY 10.1.1.1   #SCTP INIT scan
11
sudo nmap -sZ 10.1.1.1   #SCTP COOKIE ECHO scan
12
sudo nmap -sn 10.1.1.1   #Ping scan (no port scan)
13
sudo nmap -sL 10.1.1.1   #List scan
14
sudo nmap -sO 10.1.1.1   #IP Protocol scan

1
sudo nmap -sV 10.1.1.1              #Version detection
2
sudo nmap -A 10.1.1.1               #OS detection, version detection, script scanning, and traceroute
3
sudo nmap -O 10.1.1.1               #OS detection
4
sudo nmap --osscan-guess 10.1.1.1   #Guess OS detection results
5
sudo nmap --osscan-limit 10.1.1.1   #Limit OS detection to promising targets

1
sudo nmap 10.1.1.1                     #Scan a single IP
2
sudo nmap 10.1.1.1 10.1.1.2            #Scan specific IPs
3
sudo nmap -iL inputfile.txt            #Input from list of hosts/networks
4
sudo nmap -iR 100                      #Scan 100 random hosts
5
sudo nmap --exclude 10.1.1.1           #Exclude specified hosts
6
sudo nmap --exclude-file exclude.txt   #Exclude list from file
7
sudo nmap hacker.com                   #Scan a domain
8
sudo nmap 10.1.1.1-254                 #Scan a range
9
sudo nmap 10.1.1.1/24                  #Scan a CIDR range

1
sudo nmap -sC 10.1.1.1                                 #Default script scan
2
sudo nmap --script <script_name> 10.1.1.1              #Run specific script
3
sudo nmap --script-args <n1=v1,[n2=v2,...]> 10.1.1.1   #Provide arguments to scripts
4
sudo nmap --script-trace 10.1.1.1                      #Show all data sent and received
5
sudo nmap --script-updatedb                            #Update the script database

1
sudo nmap -T0 10.1.1.1                            #Paranoid (Serial, very slow, stealthy)
2
sudo nmap -T1 10.1.1.1                            #Sneaky (Slow, stealthy)
3
sudo nmap -T2 10.1.1.1                            #Polite (Slows down to use less bandwidth and target machine resources)
4
sudo nmap -T3 10.1.1.1                            #Normal (Default)
5
sudo nmap -T4 10.1.1.1                            #Aggressive (Speeds up scan; risks detection)
6
sudo nmap -T5 10.1.1.1                            #Insane (Very fast; likely to be detected)
7
sudo nmap --min-hostgroup <size> 10.1.1.1         #Minimum number of hosts per group
8
sudo nmap --max-hostgroup <size> 10.1.1.1         #Maximum number of hosts per group
9
sudo nmap --min-parallelism <num> 10.1.1.1        #Minimum number of parallel operations
10
sudo nmap --max-parallelism <num> 10.1.1.1        #Maximum number of parallel operations
11
sudo nmap --min-rtt-timeout <time> 10.1.1.1       #Minimum RTT timeout
12
sudo nmap --max-rtt-timeout <time> 10.1.1.1       #Maximum RTT timeout
13
sudo nmap --initial-rtt-timeout <time> 10.1.1.1   #Initial RTT timeout
14
sudo nmap --max-retries <num> 10.1.1.1            #Maximum retries
15
sudo nmap --host-timeout <time> 10.1.1.1          #Give up on target after this long
16
sudo nmap --scan-delay <time> 10.1.1.1            #Wait at least this long between probes
17
sudo nmap --max-scan-delay <time> 10.1.1.1        #Wait at most this long between probes
18
sudo nmap --defeat-rst-ratelimit 10.1.1.1         #Slow down to avoid RST rate limit
19
sudo nmap --min-rate <number> 10.1.1.1            #Send packets no slower than <number> per second
20
sudo nmap --max-rate <number> 10.1.1.1            #Send packets no faster than <number> per second

1
sudo nmap -p 80 10.1.1.1                  #Scan specific port
2
sudo nmap -p 1-65535 10.1.1.1             #Scan all ports
3
sudo nmap -p U:53,T:80 10.1.1.1           #Scan UDP port 53 and TCP port 80
4
sudo nmap --top-ports 20 10.1.1.1         #Scan top 20 ports
5
sudo nmap --top-ports 1000 10.1.1.1       #Scan top 1000 ports
6
sudo nmap -F 10.1.1.1                     #Fast scan (default 100 ports)
7
sudo nmap --port-ratio <ratio> 10.1.1.1   #Scan top ports up to the given ratio

1
sudo nmap -oN outputfile.txt 10.1.1.1     #Normal output
2
sudo nmap -oX outputfile.xml 10.1.1.1     #XML output
3
sudo nmap -oS outputfile.s 10.1.1.1       #Script kiddie output
4
sudo nmap -oG outputfile.gnmap 10.1.1.1   #Grepable output
5
sudo nmap -oA outputfile 10.1.1.1         #All formats (N, X, G)
6
sudo nmap --append-output 10.1.1.1        #Append to output files
7
sudo nmap --resume <filename> 10.1.1.1    #Resume aborted scan

1
sudo nmap -v 10.1.1.1              #Increase verbosity level
2
sudo nmap -vv 10.1.1.1             #Even more verbosity
3
sudo nmap -d 10.1.1.1              #Increase debugging level
4
sudo nmap -dd 10.1.1.1             #Even more debugging
5
sudo nmap --reason 10.1.1.1        #Show reason for host and port state
6
sudo nmap --open 10.1.1.1          #Only show open ports
7
sudo nmap --packet-trace 10.1.1.1  #Show all packets sent and received
8
sudo nmap --iflist                 #Show host interfaces and routes
9
sudo nmap --append-output          #Append to output files
10
sudo nmap --resume <filename>      #Resume aborted scan

1
sudo nmap -PS80,443 10.1.1.1  #TCP SYN discovery on port 80 and 443
2
sudo nmap -PA80,443 10.1.1.1  #TCP ACK discovery on port 80 and 443
3
sudo nmap -PU53 10.1.1.1      #UDP discovery on port 53
4
sudo nmap -PY 10.1.1.1        #SCTP INIT ping
5
sudo nmap -PE 10.1.1.1        #ICMP Echo discovery
6
sudo nmap -PP 10.1.1.1        #ICMP Timestamp discovery
7
sudo nmap -PM 10.1.1.1        #ICMP Address Mask discovery
8
sudo nmap -Pn 10.1.1.1        #No ping - skips the discovery stage altogether
9
sudo nmap -n 10.1.1.0/24      #No DNS resolution on the active IP address it finds
10
sudo nmap -R 10.1.1.0/24      #Always do reverse DNS resolution on the target IP

1
sudo nmap -f 10.1.1.1                                                 #Fragment packets
2
sudo nmap -D RND:10 10.1.1.1                                          #Decoy scan with 10 random decoys
3
sudo nmap -S 192.168.0.1 10.1.1.1                                     #Spoof source address
4
sudo nmap -g 53 10.1.1.1                                              #Use given source port number
5
sudo nmap --source-port 53 10.1.1.1                                   #Use given source port number
6
sudo nmap --data-length 50 10.1.1.1                                   #Append random data to sent packets
7
sudo nmap --ip-options <options> 10.1.1.1                             #Send packets with specified ip options
8
sudo nmap --ttl <value> 10.1.1.1                                      #Set IP time-to-live field
9
sudo nmap --spoof-mac <mac address, prefix, or vendor name> 10.1.1.1  #Spoof MAC address

1
sudo nmap --proxies <url1,url2> 10.1.1.1   #Use proxies for scan