Cheatsheets/nmap-cheatsheet.md

NMAP Cheat Sheet 🖥️

Table of Contents 📋

1. Ping Scanning 📡
2. ARP Scanning 📶
3. SYN Scanning 👾
4. UDP Scanning 💾
5. Useful Nmap Switches ⚙️
6. Identifying OS and Applications 🤖
7. Nmap Scripts 📜
8. Batch Script for Nmap 💻

Ping Scanning 📡

nmap -sn 192.168.10.1
nmap -sP 192.168.10.2

ARP Scanning 📶

nmap -sP -PR 192.168.10.1

Note: Press the spacebar to show the current progression of the scan.

SYN Scanning 👾

nmap -sS 192.168.10.1 

UDP Scanning 💾

nmap -sU 192.168.10.1

Useful Nmap Switches ⚙️

• -h : Help
• -v : Verbose
• -vv : Very Verbose
• -n : No DNS Reverse Lookup
• -T : Sets the speed of the scan (-T5 being the fastest, -T0 the slowest)
• -p : Specify ports
  • -p 80 : Specific port
  • -p 1-10 : Range of ports
  • -p- : All ports
• -o : To output a file

Identifying OS and Applications 🤖

• -sV : Enable Version Detection
• -O : Enable OS Detection
• -A : Enable OS Detection, Version Detection, Script Scanning, and Traceroute
• --osscan-guess : Aggressive OS guessing

Nmap Scripts 📜

Syntax: nmap —script scriptname targetIP

Examples:

nmap —script http-headers 192.168.10.1
nmap —script smtp-commands 192.168.10.1  
nmap -sV --script=banner 192.168.10.1
nmap -sV --script=smb* 192.168.10.1
nmap --script=http-title 192.168.10.1
nmap --script=http-enum 192.168.10.0/24

How to Use Nmap Script Engine (NSE) Scripts in Linux

Batch Script for Nmap 💻

1. First, download Neovim or your favorite text editor. 📝

2. Create a file named nmapScan.sh.

#!/bin/bash

nmap -sT -p 1-10000 -v -v -T5 -sV -O --osscan-guess --script=banner -oN 192.168.10.1TCP.txt 192.168.10.1 

nmap -sU -p 1-500 -v -v --scan-delay 1s -sV --script=banner -oN 192.168.10.1UDP.txt 192.168.10.1

nmap -sT -p 1-10000 -v -v -T5 -sV -O --osscan-guess --script=banner -oN 192.168.10.2TCP.txt 192.168.10.2

nmap -sU -p 1-500 -v -v --scan-delay 1s -sV --script=banner -oN 192.168.10.2UDP.txt 192.168.10.2

3. Save and exit. 💾

4. Make the script executable:

sudo chmod +x nmapScan.sh

5. Run the script:

sudo ./nmapScan.sh