Target Specification #

Scan Techniques #

Host Discovery #

Port Specification #

Service and Version Detection #

Timing and Performance #

NSE Scripts #

Firewall / IDS Evasion and Spoofing #

Example IDS Evasion command:

nmap -f -t 0 -n -Pn --data-length 200 -D 192.168.1.101,192.168.1.102,192.168.1.103,192.168.1.23 192.168.1.1

Output #

Helpful Nmap Output examples #

Scan for web servers and grep to show which IPs are running web servers:

nmap -p80 -sV -oG - --open 192.168.1.1/24 | grep open 

Generate a list of the IPs of live hosts:

nmap -iR 10 -n -oX out.xml | grep "Nmap" | cut -d " " -f5 > live-hosts.txt 

Append IP to the list of live hosts:

nmap -iR 10 -n -oX out2.xml | grep "Nmap" | cut -d " " -f5 >> live-hosts.txt 

Convert nmap xml files to html files:

nmap.xml -o nmap.html  

Compare output from nmap using the ndiff xsltproc

ndiff scanl.xml scan2.xml 

Reverse sorted list of how often ports turn up:

grep " open " results.nmap | sed -r 's/ +/ /g' | sort | uniq -c | sort -rn | less 

Miscellaneous Options #

Other Useful Nmap Commands #

More specific commands: #

Scan a host for all TCP and UDP ports:

nmap -sS -sU -p- <ip_address>

Scan a network for vulnerable machines with open SMB ports:

nmap -p 139,445 --script smb-vuln* <ip_range>

Scan a range of hosts for open web application ports:

nmap -p 80,8080,443,8443 -sV --script=http-title <ip_range>

Scan for open DNS resolvers on a network:

nmap -p 53 --script=dns-recursion <ip_range>

Scan a network for SSL/TLS certificate information:

nmap --script ssl-cert -p 443 <ip_range>

Scan a range of hosts for open FTP ports:

nmap -p 21 --script=ftp-anon,ftp-proftpd-backdoor,ftp-vsftpd-backdoor <ip_range>

Scan a network for open SNMP ports:

nmap -p 161 --script=snmp* <ip_range>

Scan a range of hosts for open SMTP ports:

 nmap -p 25 --script=smtp-enum-users,smtp-open-relay <ip_range>

Scan a host for open SSH ports and extract version information:

    nmap -p 22 -sV --script=ssh2-enum-algos <ip_address>

Scan a network for open Oracle database ports:

    nmap -p 1521 --script=oracle-sid-brute,oracle-sid <ip_range>

Scan a range of hosts for open RDP (Remote Desktop Protocol) ports:

    nmap -p 3389 --script=rdp-enum-encryption,rdp-vuln-ms12-020 <ip_range>

Scan a network for open Telnet ports:

    nmap -p 23 --script=telnet-brute <ip_range>

Scan a host for open SNMP ports and extract system information:

    nmap -p 161 --script=snmp-info,snmp-interfaces <ip_address>

Scan a range of hosts for open DNS ports:

 nmap -p 53 --script=dns-zone-transfer,dns-nsid <ip_range>

Scan a host for open MySQL database ports and extract version information:

    nmap -p 3306 -sV --script=mysql-* <ip_address>

Scan a network for open SIP (Session Initiation Protocol) ports:

    nmap -p 5060 --script=sip-brute <ip_range>

Scan a range of hosts for open VNC (Virtual Network Computing) ports:

    nmap -p 5900 --script=vnc-info,vnc-brute <ip_range>