Nmap Cheatsheet: The Swiss Army Knife (If Swiss Army Knives Scanned 65,535 Ports)

Category: Cheat Sheets

Tags: nmap, scanning, reconnaissance, network-security, penetration-testing

Nmap is the tool that turns "I wonder what's on this network" into either a comprehensive security audit or an afternoon of explaining yourself to the IT department. It's been the go-to network scanner since 1997, which in internet years makes it roughly as old as civilisation itself.

This cheatsheet covers everything from gentle ping sweeps to full-bore enumeration. As with all offensive tools: authorised testing only. Scanning things you don't own or have permission to test is illegal in most jurisdictions and ethically questionable in all of them.

Host Discovery

Before scanning ports, work out what's actually alive on the network.

nmap -sn 10.10.10.0/24                  # Ping sweep -- no port scan
nmap -sn -PS22,80,443 10.10.10.0/24     # TCP SYN discovery on common ports
nmap -sn -PU161,500 10.10.10.0/24       # UDP discovery (SNMP, IKE)
nmap -sn -PE 10.10.10.0/24              # ICMP echo only
nmap -Pn 10.10.10.5                     # Skip discovery, scan anyway
nmap -sL 10.10.10.0/24                  # List targets with DNS resolution only

When to use -Pn: When the target blocks ICMP and you know it's there. Without it, Nmap assumes the host is down and skips it entirely -- which is exactly as unhelpful as it sounds.

Scan Types

The core of Nmap. Each scan type has different stealth, speed, and privilege requirements.

nmap -sS 10.10.10.5                     # SYN scan (default, stealthy)
nmap -sT 10.10.10.5                     # TCP connect (unprivileged)
nmap -sU 10.10.10.5                     # UDP scan (slow but important)
nmap -sV 10.10.10.5                     # Version detection
nmap -A 10.10.10.5                      # Kitchen sink scan
nmap -sS -sU 10.10.10.5                 # TCP SYN + UDP combined

Port Specification

By default, Nmap scans the top 1,000 most common ports. That's usually enough. But "usually" and "security" don't mix well.

nmap -p 80 10.10.10.5                   # Single port
nmap -p 80,443,8080 10.10.10.5          # Specific ports
nmap -p 1-1024 10.10.10.5               # Port range
nmap -p- 10.10.10.5                     # All 65,535 ports (slow but thorough)
nmap --top-ports 100 10.10.10.5         # Top 100 most common
nmap -p U:53,161,T:80,443 10.10.10.5    # Mixed TCP/UDP specification

Pro tip: Always run -p- at least once during an engagement. The interesting services are almost never on standard ports. That rogue admin panel on port 8443? It won't find itself.

Timing Templates

Nmap's timing ranges from "invisible to everything" to "visible from orbit."

nmap -T4 -p- 10.10.10.5                 # Fast full scan
nmap -T2 -sS 10.10.10.5                 # Polite SYN scan (congested networks)

NSE Scripts

The Nmap Scripting Engine turns Nmap from a port scanner into a vulnerability assessment platform. There are 600+ scripts covering everything from FTP anonymous access to Heartbleed detection.

# Vulnerability scanning
nmap --script=vuln 10.10.10.5

# SMB enumeration (shares, users, OS)
nmap --script=smb-enum-shares,smb-enum-users 10.10.10.5

# HTTP enumeration
nmap --script=http-enum 10.10.10.5

# Specific vulnerability checks
nmap --script=ssl-heartbleed 10.10.10.5
nmap --script=smb-vuln-ms17-010 10.10.10.5  # EternalBlue
nmap --script=http-shellshock 10.10.10.5

# DNS brute force
nmap --script=dns-brute 10.10.10.5

# Safe defaults only
nmap --script="default and safe" 10.10.10.5

# Update the script database
nmap --script-updatedb

Script categories: auth, broadcast, brute, default, discovery, dos, exploit, external, fuzzer, intrusive, malware, safe, version, vuln. Combine with boolean operators: --script="vuln and not dos".

Output Formats

Always save your output. "I definitely remember what ports were open" is not a valid audit methodology.

nmap -oN scan.txt 10.10.10.5            # Normal text output
nmap -oX scan.xml 10.10.10.5            # XML (for parsing/import)
nmap -oG scan.grep 10.10.10.5           # Grepable (one host per line)
nmap -oA scan 10.10.10.5                # All three formats at once

Always use -oA. Disk space is cheap. Re-running a scan because you forgot to save the output is not.

Evasion & Performance Tuning

For when you need to slip past firewalls or speed things up. Note: evasion techniques are for authorised assessments where testing defensive capabilities is in scope.

nmap -f 10.10.10.5                      # Fragment packets (8-byte fragments)
nmap -D RND:5 10.10.10.5                # Decoy scan -- mix your traffic with 5 random IPs
nmap -S 10.10.10.99 10.10.10.5          # Spoof source IP (need raw socket access)
nmap --source-port 53 10.10.10.5        # Spoof source port (DNS often whitelisted)
nmap --data-length 25 10.10.10.5        # Append random data to packets
nmap --min-rate 1000 10.10.10.5         # Minimum 1000 packets/sec
nmap --max-retries 1 10.10.10.5         # Reduce retries (faster but may miss)

Battle-Tested Combos

These are the scans that actually get used in practice, not just in documentation.

# The "Initial Assessment" -- quick service detection
nmap -sV --top-ports 20 -oA quick 10.10.10.5

# The "Full Monty" -- everything, everywhere, all at once
nmap -sC -sV -O -p- -oA full 10.10.10.5

# The "Vulnerability Triage" -- targeted vuln scan
nmap -sV --script=vuln -p 80,443,445,3389 -oA vuln 10.10.10.5

# The "Stealth Run" -- fly under the radar
nmap -sS -T2 -f --data-length 24 -p- -oA stealth 10.10.10.5

# The "UDP Essentials" -- top UDP services
nmap -sU --top-ports 50 -sV -oA udp 10.10.10.5

# The "I Just Need to Know What's Alive"
nmap -sn -oA alive 10.10.10.0/24

Quick Reference Card

What's Next

• Metasploit Cheatsheet -- once you've found open ports, Metasploit helps you do something about them
• SMB Enumeration Cheatsheet -- deep dive into the protocol that keeps on giving (to attackers)
• Wireshark Filters Cheatsheet -- for when you need to see what's actually going across the wire