Nmap is a powerful network-discovery and security-auditing tool. Scan only systems and networks you own or are explicitly authorized to assess.
🚀 Basic Pattern
nmap [options] target
🛰️ Host Discovery
| Option | Use |
|---|---|
-sn |
Host discovery without a port scan |
-PR |
ARP discovery |
-PU |
UDP discovery probes |
-PE |
ICMP echo discovery |
-PP |
ICMP timestamp discovery |
-PM |
ICMP address-mask discovery |
-PS |
TCP SYN discovery |
-PA |
TCP ACK discovery |
-PO |
IP protocol discovery |
-Pn |
Skip host discovery and treat targets as online |
🔍 Scan Types
| Option | Use |
|---|---|
-sT |
TCP connect scan |
-sS |
TCP SYN or half-open scan |
-sU |
UDP scan |
-sN |
TCP null scan |
-sX |
TCP Xmas scan |
-sM |
TCP Maimon scan |
-sA |
TCP ACK scan |
-sI <zombie> |
Idle/IPID scan |
-sY |
SCTP INIT scan |
-sZ |
SCTP COOKIE-ECHO scan |
🧠 Detection & Output
| Option | Use |
|---|---|
-sV |
Service and version detection |
-O |
Operating-system detection |
-sC |
Run default NSE scripts |
-A |
Enable OS detection, version detection, scripts, and traceroute |
--traceroute |
Trace the path to the target |
-v |
Increase output verbosity |
-T0 … -T5 |
Select a timing template from paranoid to insane |
🥷 Packet & Source Options
| Option | Use |
|---|---|
-f |
Fragment IP packets |
-g <port>, --source-port <port> |
Use a specified source port |
--mtu <value> |
Set a custom MTU; the value must be a multiple of 8 |
-D <decoys> |
Use decoy source addresses |
RND:<count> |
Generate the specified number of random decoys |
--spoof-mac 0 |
Use a random MAC address |
📜 Useful NSE Scripts
| Command | Purpose |
|---|---|
--script=smb-os-discovery |
Discover SMB OS, computer, domain/workgroup, and time information |
--script=nbstat |
Perform NetBIOS enumeration |
--script=snmp-sysdescr |
Retrieve the SNMP system description |
--script=snmp-processes |
Enumerate processes exposed through SNMP |
--script=snmp-win32-software |
Enumerate installed software exposed through Windows SNMP |
--script=snmp-interfaces |
Enumerate network interfaces through SNMP |
--script=ldap-brute --script-args 'ldap.base="cn=users,dc=domain,dc=com"' |
Test LDAP credentials within an approved scope |
--script=broadcast-dns-service-discovery |
Discover DNS-based services on the local network |
--script=dns-brute |
Attempt DNS subdomain discovery |
--script=dns-srv-enum --script-args 'dns-srv-enum.domain=domain.example' |
Enumerate common DNS SRV records |
--script=smtp-enum-users |
Test SMTP user-enumeration methods |
--script=smtp-open-relay |
Test whether an SMTP server permits open relaying |
--script=smtp-commands |
List SMTP commands advertised by the server |
Options that alter source information, fragment packets, brute-force credentials, or use decoys can trigger defenses and create operational risk. Use them only when the rules of engagement explicitly permit them.