Nmap Cheat Sheet: Complete Command Reference [2026]

Nmap (Network Mapper) is the industry-standard tool for network discovery and security auditing. Whether you're conducting a penetration test, performing vulnerability assessments, or mapping network infrastructure, Nmap is an essential tool in your arsenal.

This comprehensive nmap cheat sheet provides a complete command reference with practical examples for every scanning scenario. Bookmark this guide for quick access during security assessments.

Basic Scanning Commands
Scan Types
Port Specification
Service Detection
OS Detection
NSE Scripts
Timing Templates
Output Formats
Firewall Evasion
Useful Command Combinations
Performance Tips
FAQ

Basic Scanning Commands {#basic-scanning}

Nmap's fundamental scanning commands form the foundation of network reconnaissance. Understanding these basics is crucial before moving to advanced techniques.

Single Host Scanning

Bash

# Scan a single IP address
nmap 192.168.1.1

# Scan a hostname
nmap scanme.nmap.org

# Scan with verbose output
nmap -v 192.168.1.1

# Increase verbosity level
nmap -vv 192.168.1.1

Multiple Target Scanning

Bash

# Scan multiple IPs
nmap 192.168.1.1 192.168.1.2 192.168.1.3

# Scan IP range
nmap 192.168.1.1-254

# Scan entire subnet
nmap 192.168.1.0/24

# Scan multiple subnets
nmap 192.168.1.0/24 192.168.2.0/24

# Exclude specific IPs
nmap 192.168.1.0/24 --exclude 192.168.1.5
nmap 192.168.1.0/24 --exclude 192.168.1.5,192.168.1.10

# Exclude IPs from file
nmap 192.168.1.0/24 --excludefile exclude.txt

Target List from File

Bash

# Scan targets from file (one IP/hostname per line)
nmap -iL targets.txt

# Random scan order
nmap -iL targets.txt --randomize-hosts

Host Discovery Options

Command	Description
`nmap -sL 192.168.1.0/24`	List scan - simply list targets without scanning
`nmap -sn 192.168.1.0/24`	Ping scan - disable port scan (host discovery only)
`nmap -Pn 192.168.1.1`	Skip host discovery - treat all hosts as online
`nmap -PS22,80,443 192.168.1.1`	TCP SYN ping on specific ports
`nmap -PA22,80,443 192.168.1.1`	TCP ACK ping on specific ports
`nmap -PU53,161 192.168.1.1`	UDP ping on specific ports
`nmap -PR 192.168.1.0/24`	ARP ping (local network only)
`nmap -PE 192.168.1.1`	ICMP echo request ping
`nmap -PP 192.168.1.1`	ICMP timestamp request ping
`nmap -PM 192.168.1.1`	ICMP address mask request ping

Scan Types {#scan-types}

Understanding different scan types is crucial for effective network reconnaissance. Each scan type has specific use cases, advantages, and stealth characteristics.

TCP Scan Types

Bash

# SYN Scan (Stealth Scan) - DEFAULT
nmap -sS 192.168.1.1
# Fast, stealthy, doesn't complete TCP handshake
# Requires root/administrator privileges
# Most popular scan type

# TCP Connect Scan
nmap -sT 192.168.1.1
# Completes full TCP handshake
# No special privileges required
# More easily detected and logged

# ACK Scan
nmap -sA 192.168.1.1
# Used to map firewall rulesets
# Determines if ports are filtered
# Cannot determine open vs closed ports

# Window Scan
nmap -sW 192.168.1.1
# Similar to ACK scan but examines TCP window field
# Can sometimes differentiate open/closed ports

# Maimon Scan
nmap -sM 192.168.1.1
# Sends FIN/ACK flags
# Named after discoverer Uriel Maimon

UDP Scan

Bash

# UDP Scan
nmap -sU 192.168.1.1
# Scans UDP ports
# Much slower than TCP scans
# Important for DNS, SNMP, DHCP services

# Combined TCP + UDP scan
nmap -sS -sU -p T:80,443,U:53,161 192.168.1.1

Specialized Scan Types

Bash

# NULL Scan
nmap -sN 192.168.1.1
# No flags set
# Can bypass some firewalls

# FIN Scan
nmap -sF 192.168.1.1
# Only FIN flag set
# Stealthy against some systems

# Xmas Scan
nmap -sX 192.168.1.1
# FIN, PSH, URG flags set (lights up like Christmas tree)
# Can evade some IDS systems

# Idle/Zombie Scan
nmap -sI zombie_host:port target
# Ultra-stealth scan using zombie host
# Most advanced stealth technique

# IP Protocol Scan
nmap -sO 192.168.1.1
# Determines which IP protocols are supported

Scan Type Comparison Table

Scan Type	Flags	Stealth Level	Speed	Root Required	Use Case
`-sS` (SYN)	SYN	High	Fast	Yes	Default, general purpose
`-sT` (Connect)	SYN+ACK	Low	Fast	No	When root unavailable
`-sU` (UDP)	-	Medium	Slow	Yes	UDP services (DNS, SNMP)
`-sN` (NULL)	None	Very High	Medium	Yes	Firewall evasion
`-sF` (FIN)	FIN	Very High	Medium	Yes	Firewall evasion
`-sX` (Xmas)	FIN+PSH+URG	Very High	Medium	Yes	IDS evasion
`-sA` (ACK)	ACK	High	Fast	Yes	Firewall rule mapping
`-sW` (Window)	ACK	High	Fast	Yes	Port state detection

Port Specification {#port-specification}

Control which ports Nmap scans to optimize scan time and focus on relevant services.

Basic Port Selection

Bash

# Scan default 1000 most common ports
nmap 192.168.1.1

# Scan specific port
nmap -p 22 192.168.1.1

# Scan multiple specific ports
nmap -p 22,80,443 192.168.1.1

# Scan port range
nmap -p 1-100 192.168.1.1

# Scan all 65535 ports
nmap -p- 192.168.1.1
nmap -p 1-65535 192.168.1.1

# Scan top N most common ports
nmap --top-ports 10 192.168.1.1
nmap --top-ports 100 192.168.1.1
nmap --top-ports 1000 192.168.1.1

Advanced Port Specification

Bash

# Scan ports by name
nmap -p http,https 192.168.1.1
nmap -p ssh,smtp,mysql 192.168.1.1

# Scan specific protocol ports
nmap -p T:80,443,U:53 192.168.1.1

# Scan all TCP ports
nmap -p T:- 192.168.1.1

# Scan all UDP ports
nmap -p U:- 192.168.1.1

# Fast scan (100 most common ports)
nmap -F 192.168.1.1

# Scan sequential port ranges
nmap -p 1-1024,3306,8080,8443 192.168.1.1

# Wildcard port scanning
nmap -p "*" 192.168.1.1  # All protocols

Common Port Combinations

Port Range	Description	Command
1-1024	Well-known ports	`nmap -p 1-1024`
1024-49151	Registered ports	`nmap -p 1024-49151`
49152-65535	Dynamic/private ports	`nmap -p 49152-65535`
Top 20	Most common services	`nmap --top-ports 20`
Web ports	HTTP/HTTPS variations	`nmap -p 80,443,8000,8080,8443`
Database ports	Common databases	`nmap -p 1433,3306,5432,27017`
Mail ports	Email services	`nmap -p 25,110,143,465,587,993,995`

Service Detection {#service-detection}

Service version detection identifies what application is running on open ports, crucial for vulnerability assessment.

Basic Service Detection

Bash

# Enable service/version detection
nmap -sV 192.168.1.1

# Aggressive version detection
nmap -sV --version-intensity 9 192.168.1.1

# Light version detection (faster)
nmap -sV --version-intensity 0 192.168.1.1

# Combined with specific ports
nmap -sV -p 80,443,8080 192.168.1.1

Version Intensity Levels

Bash

# Intensity 0 - Light (fastest, least accurate)
nmap -sV --version-intensity 0 192.168.1.1

# Intensity 5 - Default balance
nmap -sV 192.168.1.1

# Intensity 9 - Maximum (slowest, most accurate)
nmap -sV --version-intensity 9 192.168.1.1

Version Detection Options

Command	Description
`-sV`	Enable version detection
`--version-intensity 0-9`	Set version scan intensity (0=light, 9=try all probes)
`--version-light`	Limit to most likely probes (intensity 2)
`--version-all`	Try every single probe (intensity 9)
`--version-trace`	Show detailed version scan activity

Practical Examples

Bash

# Detect web server version
nmap -sV -p 80,443 192.168.1.1

# Identify database services
nmap -sV -p 1433,3306,5432,27017 192.168.1.1

# Quick service identification
nmap -sV --version-light -F 192.168.1.0/24

# Thorough service detection with script scanning
nmap -sV -sC -p- 192.168.1.1

OS Detection {#os-detection}

Operating system detection helps identify target system characteristics for exploitation planning.

Basic OS Detection

Bash

# Enable OS detection
nmap -O 192.168.1.1

# OS detection with version detection
nmap -O -sV 192.168.1.1

# Aggressive OS detection
nmap -O --osscan-guess 192.168.1.1

# Limit OS detection to promising targets
nmap -O --osscan-limit 192.168.1.0/24

OS Detection Options

Bash

# Maximum OS detection effort
nmap -O --max-os-tries 5 192.168.1.1

# OS detection with increased accuracy
nmap -O --osscan-guess 192.168.1.1

# Skip hosts if OS detection fails
nmap -O --osscan-limit 192.168.1.0/24

Aggressive Scanning

Bash

# Aggressive scan (enables OS detection, version detection, script scanning, traceroute)
nmap -A 192.168.1.1

# Aggressive scan with all ports
nmap -A -p- 192.168.1.1

# Aggressive scan on specific service
nmap -A -p 80,443 192.168.1.1

NSE Scripts {#nse-scripts}

Nmap Scripting Engine (NSE) extends functionality with over 600 scripts for vulnerability detection, exploitation, and reconnaissance. Essential for advanced penetration testing workflows.

Basic NSE Usage

Bash

# Run default NSE scripts
nmap -sC 192.168.1.1
nmap --script=default 192.168.1.1

# Run specific script
nmap --script=http-title 192.168.1.1

# Run multiple scripts
nmap --script=http-title,http-headers 192.168.1.1

# Run scripts by category
nmap --script=vuln 192.168.1.1

# Run all scripts in multiple categories
nmap --script="auth,brute" 192.168.1.1

# Exclude specific scripts
nmap --script="not http-slowloris" 192.168.1.1

NSE Script Categories

Category	Description	Example Command
`default`	Default safe scripts	`nmap -sC`
`auth`	Authentication related	`nmap --script=auth`
`broadcast`	Network broadcast discovery	`nmap --script=broadcast`
`brute`	Brute force attacks	`nmap --script=brute`
`discovery`	Network discovery	`nmap --script=discovery`
`dos`	Denial of service (use carefully!)	`nmap --script=dos`
`exploit`	Exploitation scripts	`nmap --script=exploit`
`external`	Uses external resources	`nmap --script=external`
`fuzzer`	Fuzzing scripts	`nmap --script=fuzzer`
`intrusive`	May crash target	`nmap --script=intrusive`
`malware`	Malware detection	`nmap --script=malware`
`safe`	Won't crash target	`nmap --script=safe`
`version`	Version detection enhancement	`nmap --script=version`
`vuln`	Vulnerability detection	`nmap --script=vuln`

Popular Security Scripts

Bash

# Vulnerability scanning
nmap --script vuln 192.168.1.1

# SQL injection detection
nmap --script=http-sql-injection -p 80,443 192.168.1.1

# Check for common vulnerabilities
nmap --script=vulners 192.168.1.1

# SSL/TLS vulnerabilities
nmap --script=ssl-heartbleed,ssl-poodle,ssl-dh-params -p 443 192.168.1.1

# SMB vulnerabilities (EternalBlue, etc.)
nmap --script=smb-vuln* -p 445 192.168.1.1

# Anonymous FTP check
nmap --script=ftp-anon -p 21 192.168.1.1

# HTTP enumeration
nmap --script=http-enum -p 80,443 192.168.1.1

# Banner grabbing
nmap --script=banner 192.168.1.1

# DNS enumeration
nmap --script=dns-brute domain.com

# MySQL enumeration
nmap --script=mysql-enum -p 3306 192.168.1.1

Essential NSE Scripts Reference

Script Name	Purpose	Target Port
`http-title`	Fetch webpage title	80, 443
`http-headers`	HTTP header analysis	80, 443
`http-enum`	Directory enumeration	80, 443
`http-sql-injection`	Detect SQL injection	80, 443
`http-wordpress-enum`	WordPress enumeration	80, 443
`http-shellshock`	Shellshock vulnerability	80, 443
`ssl-cert`	SSL certificate details	443
`ssl-enum-ciphers`	Enumerate SSL ciphers	443
`ssl-heartbleed`	Heartbleed vulnerability	443
`smb-os-discovery`	SMB OS information	445
`smb-vuln-ms17-010`	EternalBlue detection	445
`smb-vuln-ms08-067`	Conficker vulnerability	445
`ftp-anon`	Anonymous FTP access	21
`ftp-bounce`	FTP bounce attack check	21
`ssh-brute`	SSH brute force	22
`mysql-empty-password`	MySQL empty password	3306
`mysql-enum`	MySQL enumeration	3306
`dns-zone-transfer`	DNS zone transfer	53
`dns-brute`	DNS subdomain brute force	53
`snmp-brute`	SNMP community string brute	161
`smtp-enum-users`	SMTP user enumeration	25

Script Arguments

Bash

# Pass arguments to scripts
nmap --script=http-wordpress-enum --script-args http-wordpress-enum.root="/blog/" 192.168.1.1

# Multiple script arguments
nmap --script=mysql-brute --script-args userdb=users.txt,passdb=passwords.txt 192.168.1.1

# Brute force with custom wordlists
nmap --script=ssh-brute --script-args userdb=users.txt,passdb=pass.txt -p 22 192.168.1.1

# HTTP form brute force
nmap --script http-form-brute --script-args http-form-brute.path=/login -p 80 192.168.1.1

Update NSE Database

Bash

# Update NSE script database
nmap --script-updatedb

# Get help for specific script
nmap --script-help=http-sql-injection

# List all available scripts
locate *.nse
ls /usr/share/nmap/scripts/

Timing Templates {#timing}

Timing templates control scan speed and stealth. Choose based on network conditions and detection avoidance needs.

Timing Template Overview

Bash

# T0 - Paranoid (slowest, for IDS evasion)
nmap -T0 192.168.1.1

# T1 - Sneaky (slow, for IDS evasion)
nmap -T1 192.168.1.1

# T2 - Polite (slows down to use less bandwidth)
nmap -T2 192.168.1.1

# T3 - Normal (default speed)
nmap -T3 192.168.1.1
nmap 192.168.1.1  # Same as T3

# T4 - Aggressive (faster, assumes fast/reliable network)
nmap -T4 192.168.1.1

# T5 - Insane (fastest, may miss ports or crash services)
nmap -T5 192.168.1.1

Timing Template Comparison

Template	Name	Speed	Stealth	Use Case	Typical Scan Time
`-T0`	Paranoid	Slowest	Maximum	IDS evasion	Hours/days
`-T1`	Sneaky	Very Slow	Very High	IDS evasion	Hours
`-T2`	Polite	Slow	High	Low bandwidth	30-60 min
`-T3`	Normal	Medium	Medium	Default balanced scan	5-10 min
`-T4`	Aggressive	Fast	Low	Internal network, fast network	1-5 min
`-T5`	Insane	Fastest	None	Lab environment only	<1 min

Custom Timing Parameters

Bash

# Custom timing granular control
nmap --host-timeout 30m 192.168.1.1
nmap --scan-delay 1s 192.168.1.1
nmap --max-scan-delay 5s 192.168.1.1
nmap --min-rate 100 192.168.1.1
nmap --max-rate 1000 192.168.1.1
nmap --min-parallelism 10 192.168.1.1
nmap --max-parallelism 100 192.168.1.1

# Combine for fine control
nmap --max-rate 50 --scan-delay 2s 192.168.1.1

Recommended Timing by Scenario

Bash

# Red team / stealth required
nmap -T1 -sS -f 192.168.1.1

# Internal network scan
nmap -T4 -F 192.168.1.0/24

# Quick port scan
nmap -T5 --top-ports 100 192.168.1.1

# Thorough but respectful scan
nmap -T3 -sV -p- 192.168.1.1

# Noisy but comprehensive
nmap -T4 -A -p- 192.168.1.1

Output Formats {#output-formats}

Save scan results in various formats for documentation, parsing, or further analysis. Similar to SQL injection cheat sheet documentation, proper output formatting is crucial.

Basic Output Options

Bash

# Normal output (human-readable)
nmap -oN scan_results.txt 192.168.1.1

# XML output (machine-readable, best for parsing)
nmap -oX scan_results.xml 192.168.1.1

# Grepable output (easy to grep)
nmap -oG scan_results.gnmap 192.168.1.1

# Save all formats at once
nmap -oA scan_results 192.168.1.1
# Creates: scan_results.nmap, scan_results.xml, scan_results.gnmap

# Script kiddie format (silly but colorful)
nmap -oS scan_results.txt 192.168.1.1

Advanced Output Options

Bash

# Append to existing file
nmap --append-output -oN scan.txt 192.168.1.1

# Include reason for port state
nmap --reason -oN scan.txt 192.168.1.1

# Show open ports only
nmap --open -oN open_ports.txt 192.168.1.1

# Verbose output with detailed logging
nmap -v -oN verbose_scan.txt 192.168.1.1

# Debug output (very detailed)
nmap -d -oN debug_scan.txt 192.168.1.1

Real-Time Output Monitoring

Bash

# View output on screen AND save to file
nmap -oN scan.txt 192.168.1.1 | tee scan_screen.txt

# Verbose with output
nmap -v -oN scan.txt 192.168.1.1

# Interactive during scan:
# Press 'v' or 'V' to increase/decrease verbosity
# Press 'd' or 'D' to increase/decrease debugging
# Press 'p' or 'P' to enable/disable packet tracing

Parsing Scan Results

Bash

# Extract only open ports from grepable output
grep "open" scan_results.gnmap

# Get list of hosts with port 80 open
grep "80/open" scan_results.gnmap | awk '{print $2}'

# Extract hosts with open SSH
grep "22/open/tcp" scan_results.gnmap | awk '{print $2}'

# Convert XML to HTML report
xsltproc scan_results.xml -o scan_results.html

Output Format Comparison

Format	Extension	Best For	Command
Normal	`.nmap` or `.txt`	Human reading, reports	`-oN`
XML	`.xml`	Parsing, imports, automation	`-oX`
Grepable	`.gnmap`	Command-line parsing, grep	`-oG`
All	`.nmap`, `.xml`, `.gnmap`	Complete documentation	`-oA`

Firewall Evasion {#firewall-evasion}

Bypass firewalls, IDS/IPS systems, and packet filters during penetration testing engagements.

Packet Fragmentation

Bash

# Fragment packets (8-byte fragments)
nmap -f 192.168.1.1

# Fragment with custom MTU
nmap --mtu 16 192.168.1.1
nmap --mtu 24 192.168.1.1
# MTU must be multiple of 8

Decoy Scanning

Bash

# Use decoys
nmap -D RND:10 192.168.1.1
# RND:10 generates 10 random decoy IPs

# Specific decoy IPs
nmap -D 192.168.1.50,192.168.1.60,ME 192.168.1.1
# ME represents your real IP position

# Multiple decoys with custom position
nmap -D 10.0.0.5,10.0.0.10,ME,10.0.0.15,10.0.0.20 192.168.1.1

Source Port Manipulation

Bash

# Use specific source port (common: 53, 80, 443)
nmap --source-port 53 192.168.1.1
nmap -g 53 192.168.1.1  # Same as above

# Common firewall-friendly ports
nmap --source-port 80 192.168.1.1   # HTTP
nmap --source-port 443 192.168.1.1  # HTTPS
nmap --source-port 20 192.168.1.1   # FTP-DATA

IP Spoofing

Bash

# Spoof source IP address
nmap -S 10.0.0.5 192.168.1.1
# Note: Requires raw packet privileges
# Responses go to spoofed IP, not you

# Spoof with MAC address
nmap --spoof-mac 0 192.168.1.1  # Random MAC
nmap --spoof-mac Apple 192.168.1.1  # Apple vendor
nmap --spoof-mac 00:11:22:33:44:55 192.168.1.1  # Specific MAC

Timing-Based Evasion

Bash

# Add delay between packets
nmap --scan-delay 5s 192.168.1.1

# Randomize target order
nmap --randomize-hosts 192.168.1.0/24

# Slow paranoid scan
nmap -T0 --scan-delay 1s 192.168.1.1

Data Length Manipulation

Bash

# Append random data to packets
nmap --data-length 25 192.168.1.1

# Larger packet size
nmap --data-length 100 192.168.1.1

Proxy Chains

Bash

# Route scan through proxy
nmap --proxies http://proxy1:8080,http://proxy2:8080 192.168.1.1

# SOCKS4 proxy
nmap --proxies socks4://proxy:1080 192.168.1.1

Bad Checksum

Bash

# Send packets with bad checksums
nmap --badsum 192.168.1.1
# Legitimate systems drop bad checksum packets
# Some firewalls may not check and respond

Complete Firewall Evasion Example

Bash

# Comprehensive evasion scan
nmap -T1 -f -D RND:10 -g 53 --randomize-hosts --data-length 25 192.168.1.1

# Ultra-stealth scan
nmap -sS -T0 -f --scan-delay 5s --max-parallelism 1 -D RND:5 192.168.1.1

# Aggressive evasion
nmap -sS -sV -f -g 53 -D RND:10 --spoof-mac Apple --data-length 50 192.168.1.1

Firewall Evasion Quick Reference

Technique	Command	Detection Risk
Fragmentation	`-f` or `--mtu`	Low
Decoys	`-D RND:10`	Low
Source port	`-g 53`	Low
Timing delay	`--scan-delay`	Very Low
IP spoof	`-S`	Very Low*
MAC spoof	`--spoof-mac`	Low
Bad checksum	`--badsum`	Low
Random order	`--randomize-hosts`	Low

*IP spoofing has very low detection risk but responses don't reach you

Useful Command Combinations {#useful-combinations}

Real-world Nmap one-liners for common penetration testing scenarios. Add these to your penetration testing methodology.

Quick Reconnaissance

Bash

# Fast host discovery
nmap -sn -T4 192.168.1.0/24

# Quick port scan with service detection
nmap -sS -sV -T4 -F 192.168.1.1

# Top 20 ports with OS detection
nmap -O -sV --top-ports 20 192.168.1.1

# Aggressive scan on common ports
nmap -A -T4 -p 21,22,23,25,80,443,445,3306,3389,8080 192.168.1.1

Web Server Enumeration

Bash

# Comprehensive web server scan
nmap -sV -p 80,443,8080,8443 --script=http-enum,http-title,http-headers 192.168.1.1

# Check for web vulnerabilities
nmap -p 80,443 --script=http-vuln* 192.168.1.1

# SSL/TLS vulnerability scan
nmap -sV -p 443 --script=ssl-heartbleed,ssl-poodle,ssl-dh-params,ssl-ccs-injection 192.168.1.1

# WordPress/CMS detection
nmap -p 80,443 --script=http-wordpress-enum,http-drupal-enum,http-joomla-brute 192.168.1.1

Database Server Scanning

Bash

# MySQL enumeration
nmap -sV -p 3306 --script=mysql-enum,mysql-databases,mysql-empty-password 192.168.1.1

# MSSQL enumeration
nmap -sV -p 1433 --script=ms-sql-info,ms-sql-empty-password,ms-sql-dump-hashes 192.168.1.1

# PostgreSQL enumeration
nmap -sV -p 5432 --script=pgsql-brute 192.168.1.1

# MongoDB enumeration
nmap -sV -p 27017 --script=mongodb-databases,mongodb-info 192.168.1.1

# Redis enumeration
nmap -sV -p 6379 --script=redis-info 192.168.1.1

SMB/Windows Enumeration

Bash

# Comprehensive SMB scan
nmap -p 445 --script=smb-os-discovery,smb-enum-shares,smb-enum-users 192.168.1.1

# Check for SMB vulnerabilities
nmap -p 445 --script=smb-vuln-ms17-010,smb-vuln-ms08-067,smb-vuln-cve-2017-7494 192.168.1.1

# SMB security assessment
nmap -p 445 --script=smb-security-mode,smb-protocols 192.168.1.1

# Windows RDP detection
nmap -p 3389 --script=rdp-enum-encryption,rdp-vuln-ms12-020 192.168.1.1

Network Service Discovery

Bash

# Find all HTTP/HTTPS services
nmap -p- --open -sV --script=http-title 192.168.1.0/24

# SSH server enumeration
nmap -p 22 --script=ssh-hostkey,ssh-auth-methods,ssh2-enum-algos 192.168.1.0/24

# FTP server check
nmap -p 21 --script=ftp-anon,ftp-bounce,ftp-syst 192.168.1.0/24

# SNMP enumeration
nmap -sU -p 161 --script=snmp-info,snmp-brute 192.168.1.0/24

# DNS server enumeration
nmap -p 53 --script=dns-zone-transfer,dns-recursion 192.168.1.1

Vulnerability Assessment

Bash

# Full vulnerability scan
nmap -sV --script=vuln -p- 192.168.1.1

# Quick vuln check on top ports
nmap -sV --script=vuln --top-ports 100 192.168.1.1

# Specific CVE check
nmap --script=vulners,vulscan -sV 192.168.1.1

# Safe vulnerability assessment
nmap --script="vuln and not intrusive" 192.168.1.1

Comprehensive Penetration Test Scans

Bash

# Full internal network assessment
nmap -sS -sV -O -A -T4 -p- --script=default,vuln -oA full_scan 192.168.1.0/24

# Stealth penetration test
nmap -sS -sV -O -T1 -f -D RND:10 --randomize-hosts -oA stealth_scan 192.168.1.1

# External perimeter scan
nmap -sS -sV --top-ports 1000 --script=default,banner -T3 -oA external_scan target.com

# Quick network discovery + service scan
nmap -sn 192.168.1.0/24 -oG - | awk '/Up$/{print $2}' | nmap -sS -sV -p- -iL - -oA live_hosts

Output and Reporting

Bash

# Scan with all output formats
nmap -sS -sV -A -T4 --top-ports 1000 -oA comprehensive_scan 192.168.1.1

# Scan with reasoning
nmap -sS -sV --reason -oN detailed_scan.txt 192.168.1.1

# Only save open ports
nmap -sS --open -oG open_ports.txt 192.168.1.0/24

# Verbose scan with on-screen and file output
nmap -v -sS -sV -p- -oN live_output.txt 192.168.1.1

Scripted Enumeration Chains

Bash

# Multi-stage scan: discovery → port scan → service enum
nmap -sn 192.168.1.0/24 -oG - | awk '/Up$/{print $2}' > live_hosts.txt && \
nmap -sS -iL live_hosts.txt -oG - | grep "open" | awk '{print $2}' > hosts_with_open.txt && \
nmap -sV -A -iL hosts_with_open.txt -oA final_detailed_scan

# Web app comprehensive scan
nmap -p 80,443,8080,8443 -sV --script="http-* and not dos" 192.168.1.1 -oA webapp_scan

# Database server hunt
nmap -p 1433,3306,5432,27017,6379 -sV --script="*database*,*sql*" 192.168.1.0/24 -oA db_scan

Kali Linux Integration

For Kali Linux setup, see our complete Kali installation guide. Once installed, Nmap is pre-installed and ready to use.

Bash

# Update Nmap to latest version on Kali
sudo apt update && sudo apt install nmap -y

# Verify Nmap version
nmap --version

# Check available NSE scripts
ls /usr/share/nmap/scripts/ | wc -l

Performance Tips {#performance-tips}

Optimize Nmap scans for speed, accuracy, and resource efficiency.

Speed Optimization

Bash

# Use SYN scan (faster than connect scan)
nmap -sS 192.168.1.1

# Increase timing template
nmap -T4 192.168.1.1

# Scan fewer ports
nmap -F 192.168.1.1
nmap --top-ports 100 192.168.1.1

# Skip host discovery for known live hosts
nmap -Pn 192.168.1.1

# Limit scan to specific ports
nmap -p 80,443 192.168.1.1

# Disable version detection when not needed
nmap -sS 192.168.1.1  # Instead of -sV

# Limit parallel probes
nmap --min-parallelism 100 --max-parallelism 256 192.168.1.1

# Increase max retries
nmap --max-retries 1 192.168.1.1

Accuracy vs Speed Trade-offs

Bash

# Fast but may miss ports
nmap -T5 -F 192.168.1.1

# Slow but thorough
nmap -T2 -p- -sV 192.168.1.1

# Balanced approach (recommended)
nmap -T3 -sS -sV --top-ports 1000 192.168.1.1

Resource Management

Bash

# Limit bandwidth usage
nmap -T2 --max-rate 100 192.168.1.0/24

# Prevent network flooding
nmap --max-parallelism 10 192.168.1.0/24

# Set reasonable timeout
nmap --host-timeout 5m 192.168.1.0/24

# Control packet rate
nmap --min-rate 50 --max-rate 300 192.168.1.0/24

Large Network Scanning

Bash

# Divide and conquer large networks
# Scan /24 subnets separately instead of /16

# Use host discovery first
nmap -sn 10.0.0.0/16 -oG - | awk '/Up$/{print $2}' > live_hosts.txt
nmap -sS -iL live_hosts.txt

# Scan during off-hours
# Use cron or at for scheduled scans

# Distribute scan across multiple machines
# Scan different subnets from different hosts

Memory and CPU Optimization

Bash

# Limit memory usage
nmap --max-hostgroup 50 192.168.1.0/24

# Control concurrent host scanning
nmap --min-hostgroup 10 --max-hostgroup 100 192.168.1.0/24

# Save progress (resume on crash)
nmap --resume nmap_output.xml

Best Practices Summary

Scenario	Recommended Command Pattern
Quick scan	`nmap -T4 -F <target>`
Thorough scan	`nmap -T3 -sS -sV -p- <target>`
Stealth scan	`nmap -T1 -sS -f <target>`
Large network	`nmap -sn
Web only	`nmap -T4 -p 80,443,8080,8443 <target>`
Full assessment	`nmap -A -T4 --top-ports 1000 <target>`

FAQ {#faq}

1. What is the difference between -sS and -sT scans?

SYN scan (-sS):

Sends SYN packet, receives SYN/ACK, never completes handshake
Faster and stealthier (half-open scan)
Requires root/administrator privileges
Default scan type when run as root
Less likely to be logged by target

TCP Connect scan (-sT):

Completes full TCP three-way handshake
Slower and more detectable
No special privileges required
Default when run as non-root user
More likely to be logged by target

Bash

# As root - uses SYN scan
sudo nmap 192.168.1.1

# As non-root - uses TCP connect
nmap 192.168.1.1

# Force TCP connect even as root
sudo nmap -sT 192.168.1.1

2. How can I scan all 65535 ports quickly?

Balancing speed and completeness:

Bash

# Fast full port scan
nmap -p- -T4 --min-rate 1000 --max-retries 1 192.168.1.1

# With service detection
nmap -p- -T4 -sV --min-rate 1000 192.168.1.1

# Fastest (aggressive)
nmap -p- -T5 --min-rate 5000 192.168.1.1

# Two-stage approach (recommended for large scans)
# Stage 1: Fast discovery
nmap -p- -T4 --min-rate 1000 192.168.1.1 -oG - | grep "open" > open_ports.txt
# Stage 2: Detailed scan of open ports
nmap -sV -sC -p $(cat open_ports.txt | cut -d"/" -f1 | tr '\n' ',') 192.168.1.1

3. Why does Nmap report a port as 'filtered'?

Port states and meanings:

Open: Application is accepting connections
Closed: No application listening, but port is accessible
Filtered: Firewall/filter is blocking probe
Unfiltered: Port is accessible but state unclear (ACK scan)
Open|Filtered: Can't determine if open or filtered (UDP scan)
Closed|Filtered: Can't determine if closed or filtered (rare)

A filtered port means:

Firewall is dropping packets
IDS/IPS is blocking your scan
Router ACL is filtering traffic
No response received (timeout)

Bash

# Use ACK scan to map firewall rules
nmap -sA -p 80,443,445 192.168.1.1

# Try different scan types
nmap -sT -p 80 192.168.1.1
nmap -sS -p 80 192.168.1.1
nmap -sN -p 80 192.168.1.1

4. How do I scan through a firewall without being detected?

Combine multiple evasion techniques:

Bash

# Ultra-stealth scan
nmap -sS -T0 -f --scan-delay 10s --randomize-hosts \
  -D RND:10 -g 53 --data-length 50 \
  --spoof-mac Apple 192.168.1.1

# Source port 53 (DNS) often bypasses firewalls
nmap -g 53 192.168.1.1

# Fragment packets
nmap -f -sS 192.168.1.1

# Use decoys to hide your IP
nmap -D 10.0.0.1,10.0.0.2,ME,10.0.0.3 192.168.1.1

# Slow timing to avoid rate-limiting
nmap -T1 --scan-delay 5s 192.168.1.1

Best approach: Combine techniques based on target environment:

Internal network: -T4 with minimal evasion
External assessment: -T2 with source port manipulation
Red team: -T0 with full evasion suite

5. What are the best NSE scripts for penetration testing?

Top NSE scripts by category:

Vulnerability Detection:

Bash

nmap --script vuln 192.168.1.1
nmap --script vulners 192.168.1.1
nmap --script smb-vuln-ms17-010 -p 445 192.168.1.1

Web Application:

Bash

nmap --script http-enum,http-title,http-headers -p 80,443 192.168.1.1
nmap --script http-sql-injection -p 80,443 192.168.1.1
nmap --script http-wordpress-enum -p 80 192.168.1.1

Authentication:

Bash

nmap --script ssh-brute -p 22 192.168.1.1
nmap --script mysql-empty-password -p 3306 192.168.1.1
nmap --script ftp-anon -p 21 192.168.1.1

Information Gathering:

Bash

nmap --script banner 192.168.1.1
nmap --script ssl-cert -p 443 192.168.1.1
nmap --script smb-os-discovery -p 445 192.168.1.1

SSL/TLS:

Bash

nmap --script ssl-heartbleed,ssl-poodle,ssl-ccs-injection -p 443 192.168.1.1

For penetration testing methodology, integrate with your complete pentest workflow.

Conclusion

This nmap cheat sheet covers essential commands, scan types, scripts, and techniques for effective network reconnaissance and security assessment. From basic port scanning to advanced firewall evasion, Nmap remains the gold standard for network discovery.

Key Takeaways:

Start with host discovery (-sn) before full port scans
Use SYN scans (-sS) for speed and stealth
Enable service detection (-sV) to identify applications
Leverage NSE scripts for vulnerability detection and enumeration
Choose appropriate timing based on network and detection requirements
Save all output formats (-oA) for documentation
Combine evasion techniques for stealth operations

Essential Nmap Resources:

Official Documentation: nmap.org
NSE Script Reference: nmap.org/nsedoc
Kali Linux Docs: kali.org/docs
Security Tools: Browse our tools directory

Pro Tip: Bookmark this nmap cheat sheet and pair it with hands-on practice in a lab environment. Always obtain proper authorization before scanning any network or system you don't own.

Happy scanning, and stay ethical! 🔒

Author: Andrax Pentester / Syed Abrar
Category: Offensive Security
Tags: nmap, cheat sheet, penetration testing, network scanning, cybersecurity, ethical hacking, kali linux
Last Updated: January 2026

For more cybersecurity resources, tutorials, and penetration testing guides, explore andraxpentester.in

Keep reading

Introducing MCPGrade: Securing Model Context Protocol Servers in 2026

The Ultimate Guide to API Penetration Testing: OWASP Top 10, BOLA, BLA & Exploit Chains

Keep reading

Introducing MCPGrade: Securing Model Context Protocol Servers in 2026

The Ultimate Guide to API Penetration Testing: OWASP Top 10, BOLA, BLA & Exploit Chains

Nmap Cheat Sheet: Complete Command Reference [2026]

Table of Contents

Basic Scanning Commands {#basic-scanning}

Single Host Scanning

Multiple Target Scanning

Target List from File

Host Discovery Options

Scan Types {#scan-types}

TCP Scan Types

UDP Scan

Specialized Scan Types

Scan Type Comparison Table

Port Specification {#port-specification}

Basic Port Selection

Advanced Port Specification

Common Port Combinations

Service Detection {#service-detection}

Basic Service Detection

Version Intensity Levels

Version Detection Options

Practical Examples

OS Detection {#os-detection}

Basic OS Detection

OS Detection Options

Aggressive Scanning

NSE Scripts {#nse-scripts}

Basic NSE Usage

NSE Script Categories

Popular Security Scripts

Essential NSE Scripts Reference

Script Arguments

Update NSE Database

Timing Templates {#timing}

Timing Template Overview

Timing Template Comparison

Custom Timing Parameters

Recommended Timing by Scenario

Output Formats {#output-formats}

Basic Output Options

Advanced Output Options

Real-Time Output Monitoring

Parsing Scan Results

Output Format Comparison

Firewall Evasion {#firewall-evasion}

Packet Fragmentation

Decoy Scanning

Source Port Manipulation

IP Spoofing

Timing-Based Evasion

Data Length Manipulation

Proxy Chains

Bad Checksum

Complete Firewall Evasion Example

Firewall Evasion Quick Reference

Useful Command Combinations {#useful-combinations}

Quick Reconnaissance

Web Server Enumeration

Database Server Scanning

SMB/Windows Enumeration

Network Service Discovery

Vulnerability Assessment

Comprehensive Penetration Test Scans

Output and Reporting

Scripted Enumeration Chains

Kali Linux Integration

Performance Tips {#performance-tips}

Speed Optimization

Accuracy vs Speed Trade-offs

Resource Management

Large Network Scanning

Memory and CPU Optimization

Best Practices Summary

FAQ {#faq}

1. What is the difference between -sS and -sT scans?