Nmap Cheat Sheet

Nmap (“Network Mapper”) is an open source tool for network exploration and security auditing. Nmap uses raw IP packets in novel ways to determine:

• what hosts are available on the network

• what services (application name and version) those hosts are offering

• what operating systems (and OS versions) they are running

• what type of packet filters/firewalls are in use, and dozens of other characteristics.

Installation:

• In Kali Linux, NMAP is one of the default tools provided by the OS.

• For the other operating systems , click here https://nmap.org/download.html to download and install the latest version of NMAP.

Syntax:

nmap [ <Scan Type> …] [ <Options> ] { <target specification> }

#Ex:-

nmap –sS –A –T4 192.168.43.250

-sS TCP SYN scan,-A Enable OS and version detection , script scanning, and traceroute

-T4 Faster execution 192.168.43.250 Target IP

Target specification

• Nmap targets can be Hostnames, IP Addresses, Subnets, or the entire Network

• Nmap supports CIDR-style addressing.

Example :- shows the scanning of a single host by its IP address.

Example :- Mapping entire network using CIDR notation

nmap -F 192.168.0.0/24

-F Fast scan

192.168.0.0/24 Scans all the hosts in the IP range 192.168.0.1 to 192.168.0.255

Target specification

• When a hostname is given as a target, it is resolved via the Domain Name System

scan a host nmap www.exmapl.com

scan targets from a text file — nmap -iL list-of-ips.txt

• Can also specify a comma-separated list of numbers or ranges for each octet. For example, 192.168.0–255.1–254 or 192.168.0,1,2,34,56.1–254

• IPv6 addresses can be specified by their fully qualified IPv6 address or hostname or with CIDR notation for subnets

• The following options are also available to control target selection:

-iL <inputfilename> (Input from list)

-iR <num hosts> (Choose random targets)

— exclude <host1>[,<host2>[,…]] (Exclude hosts/networks)

— excludefile <exclude_file> (Exclude list from file)

Host Discovery

• Scanning every port of every single IP address is slow and usually an unnecessary process

• Host discovery (also called ping scan) goes well beyond the simple ICMP echo request

• Nmap offers a wide variety of options for customizing the host discovery

• If no host discovery options are given, nmap sends the following :

1. ICMP echo request,

2. A TCP SYN packet to port 443

3. A TCP ACK packet to port 80,and

4. an ICMP timestamp request.

Example :- Performing a List Scan

nmap -sL 192.168.0.0/24

Simply lists each host to be scanned, of the network(s) specified, without sending any packets to the target hosts.

Example :- Performing a No Port scan

nmap -sn 192.168.0.0/24

This is often known as a “ping scan”, but can also request the traceroute and NSE host scripts.

-sn

• ICMP echo request

• TCP SYN packet to port 443

• A TCP ACK packet to port 80

• ICMP timestamp request

Example:- Performing a No Ping scan

nmap -Pn 192.168.0.0/24

Proper host discovery is skipped, but instead Nmap continues to perform requested functions as if each target IP is active.

• TCP SYN Ping

-PS <port list>

Send an empty TCP packet with the SYN flag set. The default destination port is 80.

• TCP ACK Ping

-PA <port list>

Send an empty TCP packet with the ACK flag set. The default destination port is 80.

• UDP Ping

-PU <port list>

Sends a UDP packet to the given ports

• IP Protocol Ping

-PA <protocol list>

Sends IP packets with the specified protocol number set in their IP header.

• ICMP Ping Types

-PE; -PP; -PM

Can be used for echo reply, timestamp reply or address mask reply, respectively.

Port Scanning

Nmap began as an efficient port scanner and that remains its core functionality till date. The simple command nmap <target> scans 1,000 TCP ports on the host <target>.

Example:- Only scan specific ports

nmap -p 80 192.168.0.1

This option specifies which ports you want to scan and overrides the default. Can be a single port or a range of ports

-sn 80

scans only port 80

Example :- Exclude the specified ports from scanning

nmap — exclude-ports 80 192.168.0.1

This option specifies which ports you do want Nmap to exclude from scanning.

— exclude-ports 80

scans all the ports except port 80 Example:- Fast (limited port) scan nmap -F 192.168.0.1

Specifies that you wish to scan fewer ports than the default. Number of ports scanned is reduced to 100.

-F scans the 100 ports already specified.

Example :- Scan top ports

nmap — top-ports 10 192.168.0.1

Scans the <n> highest-ratio ports found in nmap-services file.

— top-ports 10

scans and displays the top 10 ports- both closed and open.

Example:- Scan using TCP connect

nmap -sT 192.168.1.1

Example :- Scan using TCP SYN scan (default)

nmap -sS 192.168.1.1

Example :- Scan UDP ports

nmap -sU -p 123,161,162 192.168.1.1

Service and Version detection

Example:- service detection

nmap -sV 192.168.0.1

Detects the version of each and every service running on the scanned host(s).

OS detection

Example :- Enable OS detection

nmap -O 192.168.0.1

Nmap sends a series of TCP and UDP packets to the remote host and examines every bit in the responses to determine the OS.

Example:- Detect OS and service

nmap -A 192.168.0.1

more aggressive service detection

nmap -sV –version-intensity 5 192.168.0.1

lighter banner grabbing detection

nmam -sV –-version-intensity 0 192.168.0.1

Firewall/IDS Evasion and Spoofing

• Scan using Fragment Packets

nmap -f <target>

Causes the requested scan to use tiny fragmented IP packets to split up the TCP header over several packets to make it harder for packet filters, intrusion detection systems, and other annoyances to detect.

• Cloak a scan with decoys

-D <decoy1>[,<decoy2>]

Causes a decoy scan to be performed, which makes it appear to the remote host that the host(s) you specify as decoys are scanning the target network too.

• Spoof source port number

— source-port <port number>

Nmap will send packets from the specified port where possible. Most scanning operations that use raw sockets, including SYN and UDP scans, support the option completely

Timing

Example :- Setting a timing

nmap -T4 192.168.0.1

Nmap offers six timing templates. You can specify them with the -T option and their number (0–5) or their name. The template names are paranoid (0), sneaky (1), polite (2), normal (3), aggressive (4), and insane (5).

Output

Example :- Output to a file

nmap — oN nmap_output.txt 192.168.0.1

Requests that normal output be directed to the given filename. Normal output saved to the text file — namp_output.txt

Example :- XML Output to a file

nmap — oX nmap_output.xml 192.168.0.1

Requests that XML output be directed to the given filename.XML output saved to the text file — namp_output.txt

Verbosity

Example :- Increase Verbosity level

nmap -v 192.168.0.1

Increases the verbosity level, causing Nmap to print more information about the scan in progress.

Intense scan

Example :- Perform an intense scan

nmap -A -v -T4 192.168.0.1

The -A option enables additional advanced and aggressive options — OS detection (-O), version scanning (-sV), script scanning (-sC) and traceroute ( — traceroute)

Digging deeper with NSE scripts scan using default safe scripts nmap -sV 192.168.0.1

get help for a script

nmap –script-help=ssl-heartbleed

scan using a specific NSF script

nmap -sV -p 443 script=ssl-heartbleed.nse 192.168.0.1an

scan with a set of scripts

nmap -sV –script=smb* 192.168.0.1

— script-help=$scriptname will display help for the individual scripts.

A scan to search for DDOS reflection UDP services

Scan for UDP DDOS reflectors

nmap –sU –A –PN –n –pU:19,53,123,161 –script=ntp-monlist,dns- recursion,snmp-sysdescr 192.168.0.0/24

HTTP Service Information

Gather page titles from HTTP services nmap –script=http-title 192.168.0.0./24 get HTTP headers of web services

nmap –script=http-headers 192.168.0.0/24

find web apps from known paths

nmap –script=http-eum 192.168.0.0/24

Detect Heartbleed SSL Vulnerability

Heartbleed testing

nmap -sV -p 443 — script=ssl-heartbleed 192.168.1.0/24

ip address information

find information about ip address

nmap — script=asn-query,whois,ip-geolocation-maxmind 192.168.1.0/24

SIMPLE STEPS TO ANONYMOUSLY SCAN A REMOTE WEBSITE USING NMAP

1. Install nmap

2. install tor

sudo apt-get install tor

3. install proxychains

sudo apt-get install proxychains

4. start scanning anonymously

sudo proxychains nmap -sT www.exmaple.com

-sT full TCP connection scan

TOR — Anonymizing overlay network for TCP

proxychains -redirect connections through proxy servers