
Common and Useful nmap Commands
π Basic Scanning
- Ping Scan (host discovery only, no port scan)
nmap -sn 192.168.1.0/24 - Basic Port Scan
nmap 192.168.1.10- What it does: Scans the 1,000 most common ports on a target host.
- Use case: First step to see whatβs open.
β‘ Specific Port & Range Scans
- Scan a Single Port
nmap -p 22 192.168.1.10
- What it does: Checks only port 22 (SSH in this example).
- Use case: Verify if a specific service is accessible.
- Scan a Range of Ports
nmap -p 20-100 192.168.1.10
- What it does: Scans ports 20 through 100.
- Use case: More granular checks if you suspect services in a range.
- Scan All Ports (1β65535)
nmap -p- 192.168.1.10
- What it does: Checks every port on the target.
- Use case: Full enumeration of open services.
π Stealth & Aggressive Scans
- TCP SYN Scan (stealth mode, default for root)
nmap -sS 192.168.1.10
- What it does: Sends SYN packets and waits for SYN/ACK, without completing the handshake.
- Use case: Faster and stealthier scan for open ports.
- Aggressive Scan
nmap -A 192.168.1.10
- What it does: Performs OS detection, version detection, script scanning, and traceroute.
- Use case: Collects maximum info in one go.
π§ Service & OS Detection
- Service Version Detection
nmap -sV 192.168.1.10
- What it does: Attempts to identify the version of running services.
- Use case: Useful for vulnerability analysis.
- OS Detection
nmap -O 192.168.1.10
- What it does: Tries to determine the targetβs operating system.
- Use case: Profiling and tailoring exploits/testing.
π Output Options
- Save Results to a File
nmap -oN results.txt 192.168.1.10
- What it does: Saves results in normal text format.
- Variants:
-oXfor XML,-oGfor grepable. - Use case: Keep logs or parse output later.
βοΈ Useful Extras
- Fast Scan (only top 100 ports)
nmap -F 192.168.1.10
- What it does: Scans fewer ports for quicker results.
- Use case: Time-sensitive sweeps.
- Script Scan (Nmap Scripting Engine, NSE)
nmap --script=vuln 192.168.1.10
- What it does: Runs vulnerability-related NSE scripts.
- Use case: Automated checks for common CVEs.
- Traceroute with Nmap
nmap --traceroute 192.168.1.10
- What it does: Shows the path packets take to the target.
- Use case: Network topology and routing analysis.
β Pro Tip: You can chain options together. Example:
nmap -sS -sV -O -p- -A 192.168.1.10
β Stealth scan, service detection, OS detection, all ports, and aggressive scan in one command (noisy but thorough).
