Nmap (Network Mapper) remains the industry standard for network discovery and security auditing. Whether you are performing a penetration test, mapping your attack surface, or troubleshooting network issues, Nmap provides the foundational reconnaissance data that drives every subsequent phase of a security assessment. This first entry in our series covers the twenty most practical Nmap commands, complete with explanations of when and why to use each one.
1. Basic Host Discovery (Ping Sweep)
nmap -sn 192.168.1.0/24
The -sn flag performs a ping scan without port scanning, identifying live hosts on a network. This is your first step when mapping an unknown network segment. It tells you which IP addresses are active without generating the noise of a full port scan .
2. TCP SYN Scan (Stealth Scan)
nmap -sS 192.168.1.1
The SYN scan is Nmap's default and most popular technique. It sends a SYN packet, receives a SYN-ACK response, then immediately sends an RST to tear down the connection. This is faster and less likely to be logged by application-layer systems than a full connection .
3. TCP Connect Scan
nmap -sT 192.168.1.1
When you lack raw socket privileges (not running as root) or need maximum reliability, the connect scan completes the full TCP three-way handshake. It is more likely to be detected and logged by the target, but works universally .
4. UDP Scan
nmap -sU --top-ports 20 192.168.1.1
UDP services are often overlooked but frequently vulnerable. This scan checks the most common UDP ports (DNS, SNMP, DHCP, TFTP). UDP scanning is inherently slower and less reliable than TCP because UDP is connectionless .
5. Scan Specific Ports
nmap -p 22,80,443,8080 192.168.1.1
Target specific ports when you know exactly what services you are looking for. This dramatically reduces scan time and network noise compared to scanning all 65,535 ports .
6. Scan All Ports
nmap -p- 192.168.1.1
The -p- flag scans all 65,535 ports. Critical services are often hidden on non-standard ports (8081, 31337, 4443). Never assume that a service only runs on its default port .
7. Service Version Detection
nmap -sV 192.168.1.1
Version detection probes open ports to determine the application name and version. This is essential for vulnerability identification. Knowing that port 22 runs OpenSSH 7.4 versus OpenSSH 9.0 changes your entire assessment strategy .
8. Aggressive Scan
nmap -A 192.168.1.1
The -A flag enables OS detection, version detection, script scanning, and traceroute in a single command. It provides a comprehensive picture of the target but generates significant traffic. Use it when you need maximum information in one pass .
9. Operating System Detection
nmap -O 192.168.1.1
OS fingerprinting analyzes TCP/IP stack behavior to identify the target's operating system. This helps you narrow down potential exploits and understand the target environment .
10. Default Scripts
nmap -sC -sV 192.168.1.1
The -sC flag runs Nmap's default script set, which includes safe discovery scripts for service enumeration, SSL certificate details, and common misconfigurations. Combined with version detection, this is the standard "thorough but safe" scan .
11. Vulnerability Scripts
nmap --script vuln 192.168.1.1
The vuln script category checks for known vulnerabilities including MS17-010 (EternalBlue), SSL Heartbleed, and various injection flaws. These scripts are non-intrusive but can identify critical exposures .
12. HTTP Enumeration
nmap -p 80,443 --script http-enum 192.168.1.1
This script enumerates common web directories, applications, and files. It can reveal admin panels, backup files, and other web content that should not be publicly accessible .
13. SMB Vulnerability Check
nmap -p 445 --script smb-vuln-ms17-010 192.168.1.1
Given the prevalence of SMB-based attacks, this specific script checks for the EternalBlue vulnerability. It is one of the most commonly used NSE scripts in internal network assessments .
14. Timing Templates
nmap -T4 192.168.1.1
Timing templates control scan speed. T0 (Paranoid) and T1 (Sneaky) are for IDS evasion. T4 (Aggressive) is the standard for lab and internal environments. T5 (Insane) maximizes speed at the cost of accuracy .
15. Minimum Rate Scanning
nmap --min-rate 5000 -p- 192.168.1.1
The --min-rate option tells Nmap to send at least the specified number of packets per second. This is the fastest way to complete a full port scan without relying solely on timing templates .
16. Scan from Target List
nmap -iL targets.txt
When you have a file containing multiple IP addresses or hostnames, the -iL option reads targets from that file. This is essential for large-scale assessments .
17. No DNS Resolution
nmap -n 192.168.1.1
Skipping reverse DNS lookups speeds up scans significantly, especially when scanning large ranges. It also prevents your scan from generating DNS queries that might be logged .
18. Output to All Formats
nmap -oA scan_results 192.168.1.1
The -oA flag saves results in three formats: normal (human-readable), XML, and grepable. The XML output can be imported into Metasploit, Dradis, and other frameworks. Always save your scan data .
19. Decoy Scan
nmap -D RND:10 192.168.1.1
Decoy scanning sends packets from spoofed source addresses alongside your real address, making it appear that multiple hosts are scanning the target. This complicates IDS attribution, though modern systems can sometimes detect decoy patterns .
20. Firewall Mapping with ACK Scan
nmap -sA 192.168.1.1
The ACK scan does not determine open versus closed ports. Instead, it maps firewall rules by identifying which ports are filtered versus unfiltered. This is valuable reconnaissance before choosing an evasion strategy .
Explore More Tools
For a comprehensive collection of hacking tools, cheat sheets, and resources, visit my GitHub repository:
https://github.com/yogsec/Hacking-Tools/
Stay connected for more security content and updates:
Top comments (0)