Nmap Cheat Sheet

Quick: A concise, practical reference for common Nmap workflows — target selection, scan types, discovery, NSE usage, output handling, evasion tricks, and useful one-liners. Designed like a consultant's quick-reference: organized by category so you can scan and apply fast.

Table of contents

1. Overview & Usage Tips
2. Target Specification
3. Scan Techniques
4. Host Discovery
5. Port Specification
6. Service & Version Detection
7. OS Detection
8. Timing & Performance
9. Timing Tunables
10. NSE (Nmap Scripting Engine)
11. Useful NSE Examples
12. Firewall / IDS Evasion & Spoofing
13. Output Formats & Options
14. Helpful Output Examples & Pipelines
15. Miscellaneous Flags & Other Commands
16. Practical Tips & Etiquette

Overview & Usage Tips

• Run Nmap as root (or with sudo) for the most feature-complete scans (e.g., SYN -sS, raw packets, OS detection).
• Start with discovery (-sn) and light scans (-T3 -F -sV) to find live hosts before aggressive options.
• Log results (-oA) so you can re-analyze and resume scans later.
• Respect scope & permissions — scanning networks you don't own can be illegal.

Target Specification

Define which IPs/ranges/subnets Nmap should scan.

Nmap Scan Techniques

Pick based on stealth, permissions, and speed.

Host Discovery

Find out which hosts are up before scanning ports or when skipping port scans.

Port Specification

Target specific ports, ranges, or mixed TCP/UDP sets.

Service & Version Detection

Try to identify the service and its version running on discovered ports.

OS Detection

Fingerprint the target TCP/IP stack to guess the OS.

Timing & Performance

Built-in timing templates trade off speed vs stealth.

Timing Tunables (Fine Control)

Adjust timeouts, parallelism, rates and retries.

• --host-timeout <time> — give up on a host after this time (e.g., --host-timeout 2m).
• --min-rtt-timeout, --max-rtt-timeout, --initial-rtt-timeout <time> — control probe RTT timeouts.
• --min-hostgroup, --max-hostgroup <size> — group size for parallel host scanning.
• --min-parallelism, --max-parallelism <num> — probe parallelization controls.
• --max-retries <tries> — maximum retransmissions.
• --min-rate <n> / --max-rate <n> — packet send rate bounds.

Examples:

nmap --host-timeout 4m --max-retries 2 192.168.1.1
nmap --min-rate 100 --max-rate 1000 -p- 192.168.1.0/24

NSE (Nmap Scripting Engine)

Use scripts to automate checks, fingerprinting, vulnerability discovery and enumeration.

Useful NSE Examples

A few practical one-liners to keep handy.

# Generate sitemap from web server (HTTP):
nmap -Pn --script=http-sitemap-generator scanme.nmap.org

# Fast random search for web servers:
nmap -n -Pn -p 80 --open -sV -vvv --script banner,http-title -iR 1000

# Brute-force DNS hostnames (subdomain guessing):
nmap -Pn --script=dns-brute domain.com

# Safe SMB enumeration (useful on internal networks):
nmap -n -Pn -vv -O -sV --script smb-enum*,smb-ls,smb-mbenum,smb-os-discovery,smb-vuln* 192.168.1.1

# Whois queries via scripts:
nmap --script whois* domain.com

# Detect XSS-style unsafe output escaping on HTTP port 80:
nmap -p80 --script http-unsafe-output-escaping scanme.nmap.org

# Check for SQL injection (scripted):
nmap -p80 --script http-sql-injection scanme.nmap.org

Firewall / IDS Evasion & Spoofing

Techniques to make traffic less obvious. Use responsibly.

Example IDS evasion command

nmap -f -T0 -n -Pn --data-length 200 -D 192.168.1.101,192.168.1.102,192.168.1.103,192.168.1.23 192.168.1.1

Output Formats & Options

Save scans so you can analyze later or process programmatically.

Helpful Output Examples & Pipelines

Combine Nmap with standard UNIX tools to extract actionable info.

# Find web servers (HTTP):
nmap -p80 -sV -oG - --open 192.168.1.0/24 | grep open

# Generate list of live hosts from random scan (XML -> grep -> cut):
nmap -iR 10 -n -oX out.xml | grep "Nmap" | cut -d " " -f5 > live-hosts.txt

# Append hosts from second scan:
nmap -iR 10 -n -oX out2.xml | grep "Nmap" | cut -d " " -f5 >> live-hosts.txt

# Compare two scans:
ndiff scan1.xml scan2.xml

# Convert XML to HTML:
xsltproc nmap.xml -o nmap.html

# Frequency of open ports (clean and aggregate):
grep " open " results.nmap | sed -r 's/ +/ /g' | sort | uniq -c | sort -rn | less

Miscellaneous Flags

Other Useful Commands (Mixed Examples)

# Discovery only on specific TCP ports, no port scan:
nmap -iR 10 -PS22-25,80,113,1050,35000 -v -sn

# ARP-only discovery on local net, verbose, no port scan:
nmap 192.168.1.0/24 -PR -sn -vv

# Traceroute to random targets (no ports):
nmap -iR 10 -sn --traceroute

# List targets only but use internal DNS server:
nmap 192.168.1.1-50 -sL --dns-server 192.168.1.1

# Show packet details during scan:
nmap 192.168.1.1 --packet-trace

Practical Tips & Etiquette

• Always have written permission to scan networks you do not own.
• Start small: discovery -> targeted port scan -> version detection -> scripts.
• Use --script carefully; some scripts are intrusive.
• Keep a log of what you scanned and when (timestamps help with audits).
• For large networks, break scans into chunks and use --min-rate/--max-rate to control load.

Appendix — Quick Command Generator (Examples)

• nmap -sS -p 1-100 -T4 -oA quick-scan 192.168.1.0/24 — fast SYN scan of top 100 ports, save outputs.
• nmap -Pn -sV --script=vuln -oX vuln-check.xml 10.0.0.5 — skip host discovery, version & vulnerability scripts.