Commands

Ping scans / Host discovery scans

ARP scan

nmap -PR [targets]

TCP SYN scan

nmap -PS [targets]

ICMP scan

nmap -PE [targets]

UPD scan

nmap -PU [targets]

TCP ACK scan

nmap -PA [targets]

Some scanning techniques

Basic scan

It uses basic TCP SYN (-sS) scan by default.

nmap [target]

nmap cloudflare.com

Scan for only listing hosts

nmap -sn [target]

Ports scan

Specify port ranges

nmap -p x1-x2 [target]

nmap -p 80-25000 8.8.8.8

Specify the particular ports

nmap -p x1,x2,... [target]

nmap -p 80,443 8.8.8.8

Specify entire ports

nmap -p- [target]

Specify the most popular ports

nmap --top-ports x [target]

nmap --top-ports 20 8.8.8.8

Scan for detections

OS detection

nmap -O [target]

Service and daemon versions detections

nmap -sV [target]

All scan

(Performs overall OS detection, service detection, version detection, script scanning and traceroute)

nmap -A [target]

Scans with timing templates

It determines how aggressively or stealthily the scan should be performed.

-T0 (Paranoid)

This template is the slowest and is designed to avoid triggering intrusion detection systems.

-T1 (Sneaky)

This template is slower than the default and is also intended to avoid detection, but not as cautious -T0.

-T2 (Polite)

This timing template is more reliable in certain situations where network conditions are unstable.

-T3 (Normal)

This is the default timing template which is generally considered a good balance between speed and reliability.

-T4 (Aggressive)

This template speeds up the scan significantly compared to -T3, often scanning more aggressively and with fewer delays.

-T5 (Insane)

This is the fastest timing template and is designed for networks where you have permission to scan aggressively and quickly. It can overwhelm some networks and is less stealthy than slower templates.

Example usage:

nmap -T4 [target]

Scanning from file

nmap -iL file.txt

The file.txt consists a list of targets as:

cloudflare.com
google.com
192.168.1.106
microsoft.com

Other scanning techniques

Spoofing the scan

Spoofing can be done to to make the scan appear as if coming from the other source IP address instead of your own IP address.

nmap -S [spoofed_ip] [target_ip]

Command to explicity disable the ping scan in spoofing:

$ nmap -e [net_interface] -Pn -S [spoofed_ip] [target_ip]

In brief, scanning with a spoofed IP address works in three steps:

1. Attacker sends a packet with a spoofed source IP address to the target machine.

2. Target machine replies to the spoofed IP address as the destination.

3. Attacker captures the replies to figure out open ports.

Using decoys for scan

Decoys can be used to make the scan appear as if coming from multiple source IP addresses in addition to your IP address.

nmap -D [fake-ip1],[fake_ip2],...,ME [target_ip]

Example:

nmap -D 10.10.0.1,10.10.0.2,ME 10.10.220.5

nmap -D 10.10.0.1,10.10.0.2,RND,RND,ME 10.10.220.5

We can use RND to generate a random IP address.

The main idea for using decoys is to make the scan appear to be coming from many IP addresses so that the attacker’s IP address would be lost among them.

Scanning with fragmented packets

The Nmap packets for scanning can be fragmented to bypass the detection by Firewall and IDS using -f option.

The -f option fragments the IP packets into multiple of 8 bytes.

The -ff or -f -f option will fragment the Ip packets into multiple of 16 bytes.

Eg. If the size of IP packet is 24 bytes, then using -f will divide the packet into 3 packets of 8 bytes each. Similarly, using -ff will divide that packet into 2 packets of size 16 bytes and 8 bytes, where second packet's size is the remaining size.

Further, if you prefer to increase the size of your packets to make them look innocuous, you can use the option --data-length NUM, where num specifies the number of bytes with random data you want to append to your packets. The random data does not affect the functionality of the scan but modifies the packet’s structure.

--mtu option can also be used in Nmap to manually specify the Maximum Transmission Unit (MTU) for packets, which is the largest unfragmented size of a packet that can be transmitted over a network.

Example:

nmap -sS -p80 -f 10.10.15.152

Idle/Zombie scan

To overcome the limitations of spoofing that works only in specific newtork setups, idle or zombie scan can be used, where zombie is the idle system connected to the network that you can communicate with.

Eg.

nmap -sI [zombie_ip] [target_ip]

The idle (zombie) scan requires the following three steps to discover whether a port is open:

1. Trigger the idle host to respond so that you can record the current IP ID on the idle host.

2. Send a SYN packet to a TCP port on the target. The packet should be spoofed to appear as if it was coming from the idle host (zombie) IP address.

3. Trigger the idle machine again to respond so that you can compare the new IP ID with the one received earlier.

Saving nmap outputs

In normal format

Save your scan in normal format by using -oN FILENAME where N stands for normal.

Example:

nmap -sS -sV -O -oN MACHINE_IP_scan 10.10.194.222

The output file will be in the format MACHINE_IP_scan.nmap

In grepable format

Save your scan in normal format by using -oG FILENAME where N stands for normal.

The normal output is 21 lines, where grepable output is only 4 lines.

Example:

nmap -sS -sV -O -oG MACHINE_IP_scan 10.10.194.222

The output file will be in the format MACHINE_IP_scan.gnmap

In XML fomat

Save your scan in normal format by using -oX FILENAME where N stands for normal.

The XML format would be most convenient to process the output in other programs.

Example:

nmap -sS -sV -O -oX MACHINE_IP_scan 10.10.194.222

The output file will be in the format MACHINE_IP_scan.xml