Basic port scan of a target

nmap -sS -T4 scanme.nmap.org

Full service and OS detection

nmap -sS -sV -O -T4 scanme.nmap.org

Scan specific ports with default NSE scripts

nmap -sS -sC -p 22,80,443 scanme.nmap.org

UDP scan of top 100 ports

nmap -sU --top-ports 100 scanme.nmap.org

Nmap's `krb5-enum-users` script attempts to bruteforce and enumerate valid Active Directory accounts through Kerberos Pre-Authentication

nmap -p 88 --script=krb5-enum-users --script-args krb5-enum-users.realm='test.local',userdb=usernames.txt 10.10.10.1

Darkiros RECON: Nmap - hosts alive

nmap -sn [ip_range]

Darkiros RECON: Nmap - classic scan

nmap -sC -sV [ip]

Darkiros RECON: Nmap - read targets from file

nmap -iL [file]

Darkiros RECON: Nmap - scan all port full

nmap -Pn -sC -sV -p [port] [ip] -oN scan.txt --reason --script=vuln

Darkiros RECON: Nmap - UDP scan

nmap -sU [ip]

Darkiros RECON: Nmap - SMB signin disabled

nmap -Pn -sS -T4 --open --script smb-security-mode -p 445 [ip]

Darkiros RECON: Nmap - kerberos user enumeration

nmap -p 88 --script krb5-enum-users --script-args krb5-enum-users.realm=[domain] [dc-ip]

Darkiros RECON: Nmap - showmount

nmap -sV --script=nfs-showmount [ip]

Darkiros RECON: VNC - nmap enum

nmap -sV -p [port|5900] --script=realvnc-auth-bypass,vnc-info,vnc-title [ip]

Darkiros RECON: mssql - enum

nmap --script ms-sql-info,ms-sql-empty-password,ms-sql-xp-cmdshell,ms-sql-config,ms-sql-ntlm-info,ms-sql-tables,ms-sql-hasdbaccess,ms-sql-dac,ms-sql-dump-hashes --script-args mssql.instance-port=1433,mssql.username=sa,mssql.password=,mssql.instance-name=MSSQLSERVER -sV -p [port|1433] [IP]

Darkiros RECON: nmap - pop3 infos

nmap --script "pop3-capabilities or pop3-ntlm-info" -sV -port [port] [ip]

Darkiros RECON: nmap - mysql enumeration

nmap -sV -p 3306 --script mysql-audit,mysql-databases,mysql-dump-hashes,mysql-empty-password,mysql-enum,mysql-info,mysql-query,mysql-users,mysql-variables,mysql-vuln-cve2012-2122 [ip]

Darkiros ATTACK/CONNECT: nmap - FTP enum anonym

nmap --script ftp-anon -p 21 [ip]

Darkiros ATTACK/CONNECT: nmap - x11 check anonymous connection

nmap --script x11-access -p 6000-6063 -sV [ip]

Darkiros RECON: nmap - snmp scan

nmap -sU -p 161 -sC --open [ip]

Darkiros ATTACK/BRUTEFORCE: nmap - snmp brute force

nmap -sU -p 161 --script snmp-brute --script-args snmpbrute.communitiesdb=[wordlist] [ip]

NetRunners Active Directory/enumeration

nmap -p- --open -sS --min-rate 5000 -n -Pn {{IP}} -vvv

NetRunners KERBEROS/enumeration

nmap -p- --open -sS --min-rate 5000 -n -Pn {{IP}} -vvv

NetRunners web/enumeration

nmap -p- --open -sS --min-rate 5000 -n -Pn {{IP}} -vvv

Single target scan:

nmap [target]

Scan from a list of targets:

nmap -iL [list.txt]

Scan port for all available A records (useful when multiple A records are returned by the DNS server)

nmap --script resolveall \

cheat.sheets: nmap

--script-args newtargets,resolveall.hosts=[target] -p [port]

iPv6:

nmap -6 [target]

OS detection:

nmap -O --osscan_guess [target]

Save output to text file:

nmap -oN [output.txt] [target]

Save output to xml file:

nmap -oX [output.xml] [target]

Scan a specific port:

nmap -p [port] [target]

Do an aggressive scan:

nmap -A [target]

Speedup your scan: -n => disable ReverseDNS --min-rate=X => min X packets / sec

nmap -T5 --min-parallelism=50 -n --min-rate=300 [target]

Traceroute:

nmap -traceroute [target]

Example: Ping scan all machines on a class C network

nmap -sP 192.168.0.0/24

Use some script:

nmap --script default,safe

Loads the script in the default category, the banner script, and all .nse files in the directory /home/user/customscripts.

nmap --script default,banner,/home/user/customscripts

Loads all scripts whose name starts with http-, such as http-auth and http-open-proxy.

nmap --script 'http-*'

Loads every script except for those in the intrusive category.

nmap --script "not intrusive"

Loads those scripts that are in both the default and safe categories.

nmap --script "default and safe"

Loads scripts in the default, safe, or intrusive categories, except for those whose names start with http-.

nmap --script "(default or safe or intrusive) and not http-*"

Scan for the heartbleed -pT:443 => Scan only port 443 with TCP (T:)

nmap -T5 --min-parallelism=50 -n --script "ssl-heartbleed" -pT:443 127.0.0.1

Show all information (debug mode)

nmap -d ...

Discover DHCP information on an interface

nmap --script broadcast-dhcp-discover -e eth0