NMAP Command Cheatsheet
HOST DISCOVERY
| Host Discovery | Find live hosts on the network |
|---|---|
| nmap -sn 192.168.1.0/24 | Discover active hosts |
| nmap -sL 192.168.1.0/24 | List targets only |
| nmap -Pn 192.168.1.0/24 | Skip host discovery |
| nmap -PS80 192.168.1.0/24 | TCP SYN discovery |
| nmap -PS22,80,443 192.168.1.0/24 | Multi-port SYN probes |
| nmap -PU53 192.168.1.0/24 | UDP discovery |
| nmap -PE 192.168.1.0/24 | ICMP echo discovery |
| nmap -PR 192.168.1.0/24 | ARP discovery |
PORT SCANNING
| Port Scanning | Scan ports and identify what's open |
|---|---|
| nmap 192.168.1.10 | Default scan |
| nmap -sS 192.168.1.10 | TCP SYN scan |
| nmap -sT 192.168.1.10 | TCP connect scan |
| nmap -sU 192.168.1.10 | UDP scan |
| nmap -p 80 192.168.1.10 | One port |
| nmap -p 22,80,443 192.168.1.10 | Selected ports |
| nmap -p 1-1000 192.168.1.010 | Port range |
| nmap -p- 192.168.1.10 | All TCP ports |
| nmap --top-ports 100 192.168.1.10 | Top 100 ports |
SERVICE DETECTION
| Service Detection | Identify services and versions |
|---|---|
| nmap -sV 192.168.1.10 | Detect services and versions |
| nmap -sV -p 80,443 192.168.1.10 | Selected ports |
| nmap -sV --version-light 192.168.1.10 | Lightweight detection |
| nmap -sV --version-all 192.168.1.10 | Try all probes |
| nmap -sV --version-intensity 5 192.168.1.10 | Set intensity |
| nmap -sV --version-trace 192.168.1.10 | Trace probes |
| nmap --open 192.168.1.10 | Show only open ports |
| nmap -sV -Pn 192.168.1.10 | Version scan w/o host discovery |
OS DETECTION
| Service Detection | Identify services and versions |
|---|---|
| nmap -O 192.168.1.10 | OS detection |
| nmap -O --osscan-guess 192.168.1.10 | Aggressive guess |
| nmap -O --osscan-limit 192.168.1.10 | Limit to suitable targets |
| nmap -O --max-os-tries 1 192.168.1.10 | Limit OS attempts |
| nmap -A 192.168.1.10 | OS + version + scripts + traceroute |
| nmap --traceroute 192.168.1.10 | Trace path |
| nmap -O -sV 192.168.1.10 | OS + service detection |
| nmap -A -p 22,80,443 192.168.1.10 | Comprehensive scan on chosen ports |
NSE & OUTPUT
| NSE & OUTPUT | Leverage Nmap Scripting Engine and save results |
|---|---|
| nmap -sC 192.168.1.10 | Default NSE scripts |
| nmap --script default 192.168.1.10 | Default category |
| nmap --script safe 192.168.1.10 | Safe scripts |
| nmap --script discovery 192.168.1.10 | Discovery scripts |
| nmap --script-help default | Script help |
| nmap -oN scan.txt 192.168.1.10 | Normal output (txt) |
| nmap -oG scan.gnmap 192.168.1.10 | Grepable output |
| nmap -oA scan 192.168.1.10 | Save all major formats |