Nmap Cheat Sheet
Covers essential Nmap scan types, timing options, script engine usage, and output formats for network discovery and enumeration.
2 PagesBeginnerFeb 18, 2026
Basic Scan Types
Core Nmap scan techniques for host and port discovery.
bash
nmap 192.168.1.1 # Basic scan, top 1000 portsnmap -sn 192.168.1.0/24 # Ping sweep, no port scannmap -sS target.com # TCP SYN scan (stealth, needs root)nmap -sT target.com # TCP connect scan (no root needed)nmap -sU target.com # UDP scannmap -p 22,80,443 target.com # Scan specific portsnmap -p- target.com # Scan all 65535 ports
Detection & Scripting
Service/version detection and the Nmap Scripting Engine (NSE).
bash
nmap -sV target.com # Detect service versionsnmap -O target.com # OS detection (needs root)nmap -A target.com # Aggressive: OS, version, scripts, traceroutenmap -sC target.com # Run default NSE scriptsnmap --script vuln target.com # Run vulnerability-category scriptsnmap --script=http-title target.com # Run a specific script
Timing & Performance Flags
Options to control scan speed and stealth.
- -T0 to -T5- Timing templates from paranoid (0) to insane (5); -T4 is common for fast, reliable scans
- --min-rate <n>- Send packets no slower than n per second
- -Pn- Skip host discovery, treat all hosts as online
- -n- Skip DNS resolution to speed up scans
- -v / -vv- Increase output verbosity
Output Options
Ways to save and format scan results.
- -oN file.txt- Normal output format
- -oX file.xml- XML output, useful for parsing/tools like Metasploit
- -oG file.gnmap- Grepable output format
- -oA basename- Output in all three formats at once with a shared basename
Firewall & IDS Evasion Techniques
Flags for slipping past packet filters and signature-based detection during authorized testing.
bash
nmap -f target.com # Fragment packets to evade simple packet filtersnmap -f -f target.com # Double fragmentation (8-byte fragments)nmap --mtu 24 target.com # Custom fragment size (multiple of 8)nmap -D RND:10 target.com # Generate 10 random decoy source IPsnmap -D decoy1,decoy2,ME,decoy3 target.com # Explicit decoys with real IP interspersednmap -S 10.0.0.99 -e eth0 target.com # Spoof source address (needs matching route)nmap --data-length 25 target.com # Append random data to obscure packet signaturenmap --source-port 53 target.com # Use a trusted port number as the source port
Idle (Zombie) Scan
A fully blind scan that spoofs a zombie host's IP so responses never reveal the true scanner.
bash
# 1. Find a suitable zombie: idle host with predictable IPID sequencenmap -O -v target-zombie.com | grep 'IP ID Sequence'# 2. Run the idle scan through the zombienmap -sI zombie-host.com:80 target.com# 3. Confirm results against a direct scan in a lab to validate accuracynmap -sS target.com -oN direct.txt
NSE Script Categories
The Nmap Scripting Engine groups scripts by intent — target categories, not individual scripts, for broader coverage.
- auth- Tests for authentication bypass or weak/default credentials
- vuln- Checks for specific known vulnerabilities (may be intrusive)
- brute- Performs brute-force password guessing against services
- discovery- Gathers extra info about hosts/networks (SNMP, NetBIOS, etc.)
- safe- Scripts unlikely to crash services or trigger alarms
- intrusive- May crash services, consume resources, or be seen as an attack
- malware- Checks whether the target is infected with known malware/backdoors
Passing Script Arguments & Writing Custom NSE
Tuning built-in scripts with --script-args and scaffolding a minimal custom NSE script.
bash
# Pass credentials/wordlists into an NSE scriptnmap --script http-brute --script-args userdb=users.txt,passdb=pass.txt -p80 target.com# Combine multiple script categories with exclusionsnmap --script "default and safe and not broadcast" target.com# List available scripts matching a keywordls /usr/share/nmap/scripts/ | grep smb# Update the script database after adding custom scriptsnmap --script-updatedb
Minimal Custom NSE Script Skeleton
Structure of a Lua NSE script for a custom service check, placed in /usr/share/nmap/scripts/.
lua
description = [[Checks a custom TCP banner for a known internal service marker.]]author = "pentest-team"license = "Same as Nmap"categories = {"discovery", "safe"}local shortport = require "shortport"local comm = require "comm"portrule = shortport.port_or_service(9999, "custom-svc")action = function(host, port) local status, response = comm.exchange(host, port, "STATUS\r\n") if not status then return nil end if response:match("INTERNAL%-BUILD") then return "Internal build marker detected in banner" endend
Parsing & Automating Nmap Output
Turning raw scan results into machine-actionable data for larger toolchains.
- xmlstarlet / xsltproc- Convert -oX XML output into HTML reports or extract specific fields via XPath
- grep on -oG- Quickly pull 'Ports:' or 'Host:' lines for shell pipelines (legacy but fast)
- python-nmap / libnmap- Parse XML output programmatically to feed into custom automation
- --open- Show only hosts/ports with an open state, reducing noise in large scans
- -iL / --excludefile- Read targets from a file and exclude specific hosts/ranges from a large sweep
Pro Tip
Combine -sV with --version-intensity 0 on production networks to keep version probing lightweight and avoid tripping IDS alerts or destabilizing fragile services.
Was this cheat sheet helpful?
Explore Topics
#Nmap#NmapCheatSheet#Cybersecurity#Beginner#BasicScanTypes#DetectionScripting#TimingPerformanceFlags#OutputOptions#Networking#CheatSheet#SkillVeris
