Nmap Wiki

# Debian/Ubuntu/Kali
sudo apt install nmap

# Arch Linux
sudo pacman -S nmap

# macOS (Homebrew)
brew install nmap

# From source (get every NSE script + latest fingerprints)
git clone https://github.com/nmap/nmap.git
cd nmap
./configure
make
sudo make install

# Verify version and confirm script count
nmap --version

┌─────────────────────┐
│ 1. Target           │  Expand target spec (CIDR/range/list/DNS)
│    Enumeration      │
└──────────┬──────────┘
           ▼
┌─────────────────────┐
│ 2. Host Discovery   │  ARP (LAN) / ICMP+TCP+UDP probes (routed)
│    (skip with -Pn)  │  -sn stops here (ping sweep only)
└──────────┬──────────┘
           ▼
┌─────────────────────┐
│ 3. Reverse-DNS      │  PTR lookups (skip with -n)
│    Resolution       │
└──────────┬──────────┘
           ▼
┌─────────────────────┐
│ 4. Port Scanning    │  SYN/Connect/UDP/etc against live hosts
└──────────┬──────────┘
           ▼
┌─────────────────────┐
│ 5. Version Detection│  -sV: probe open ports for banners/behavior
└──────────┬──────────┘
           ▼
┌─────────────────────┐
│ 6. OS Detection     │  -O: TCP/IP stack fingerprinting
└──────────┬──────────┘
           ▼
┌───────────────────────┐
│ 7. NSE Scripting      │  --script: scriptrules run against results
│    (script/version/   │
│     traceroute phases)│
└──────────┬────────────┘
           ▼
┌─────────────────────┐
│ 8. Output           │  Normal / XML / Grepable / All
└─────────────────────┘

nmap 10.10.10.5                      # single host
nmap 10.10.10.0/24                   # CIDR
nmap 10.10.10.1-50                   # range (last octet)
nmap 10.10.10.1 10.10.10.5 10.10.11.0/24   # multiple, mixed
nmap -iL targets.txt                 # from file, one target per line
nmap -iR 100                         # 100 random targets (internet scanning — use carefully)
nmap --exclude 10.10.10.5            # exclude a host
nmap --excludefile excluded.txt      # exclude a list

nmap -sn 10.10.10.0/24        # ping sweep only, no port scan
nmap -Pn 10.10.10.5           # skip discovery entirely, treat host as up
nmap -PS22,80,443 10.10.10.5  # TCP SYN ping to specific ports
nmap -PA80,443 10.10.10.5     # TCP ACK ping
nmap -PU53 10.10.10.5         # UDP ping
nmap -PE 10.10.10.5           # ICMP echo ping
nmap -PR 10.10.10.0/24        # ARP ping (default and automatic on LAN)
nmap -n 10.10.10.5            # never do reverse DNS resolution
nmap -R 10.10.10.5            # always do reverse DNS resolution

nmap -p 80 10.10.10.5              # single port
nmap -p 22,80,443 10.10.10.5       # list
nmap -p 1-1000 10.10.10.5          # range
nmap -p- 10.10.10.5                # all 65535 ports
nmap -p U:53,111,T:21-25,80 host   # mixed UDP/TCP
nmap -F 10.10.10.5                 # fast mode, top 100 ports
nmap --top-ports 20 10.10.10.5     # N most common ports
nmap -r 10.10.10.5                 # scan ports in order given, don't randomize

nmap -sS 10.10.10.5     # SYN scan ("half-open") — default with root, requires raw sockets
nmap -sT 10.10.10.5     # Connect scan — full 3-way handshake, no root needed
nmap -sA 10.10.10.5     # ACK scan — maps firewall rulesets (stateful vs stateless), not port state
nmap -sW 10.10.10.5     # Window scan — variant of ACK using TCP window size quirks
nmap -sM 10.10.10.5     # Maimon scan — FIN/ACK probe, exploits certain BSD-derived stack bugs
nmap -sN 10.10.10.5     # NULL scan — no flags set
nmap -sF 10.10.10.5     # FIN scan — FIN flag only
nmap -sX 10.10.10.5     # Xmas scan — FIN, PSH, URG flags set

nmap -sU 10.10.10.5                    # UDP scan
nmap -sU -p 53,161,162,500 10.10.10.5  # common UDP services only — full UDP is slow
nmap -sU --top-ports 20 -T4 10.10.10.5 # fast-ish UDP triage

nmap -sO 10.10.10.5              # IP protocol scan — which IP protocols (TCP/UDP/ICMP/GRE/etc) respond
nmap -sI zombie_ip 10.10.10.5    # Idle/zombie scan — spoofs source via a third host's IP ID sequence
nmap -sY 10.10.10.5              # SCTP INIT scan
nmap -sZ 10.10.10.5              # SCTP COOKIE ECHO scan
nmap --scanflags SYNFIN 10.10.10.5  # custom TCP flag combination

nmap -sV 10.10.10.5                  # version detection against open ports
nmap -sV --version-intensity 9 host  # max intensity — try every probe (slow, thorough)
nmap -sV --version-light host        # light probes only — fast, less accurate
nmap -sV --version-all host          # try every single probe regardless of rarity
nmap -A 10.10.10.5                   # aggressive: -sV -O -sC --traceroute combined

nmap -O 10.10.10.5                # OS detection
nmap -O --osscan-guess host       # more aggressive guessing when match is imperfect
nmap -O --osscan-limit host       # only attempt against hosts with 1 open + 1 closed port (higher confidence data)
nmap -O --max-os-tries 1 host     # limit retries — speeds up large scans, less accurate

nmap -T0 host    # paranoid — 5min between probes, IDS evasion
nmap -T1 host    # sneaky
nmap -T2 host    # polite — reduces load, slower
nmap -T3 host    # normal — default
nmap -T4 host    # aggressive — assumes reasonably fast/reliable network, common for CTF
nmap -T5 host    # insane — assumes very fast network, sacrifices accuracy for speed

nmap -f 10.10.10.5                  # fragment packets (8 bytes per fragment)
nmap -ff 10.10.10.5                 # smaller fragments (16-byte, more fragmentation)
nmap --mtu 24 10.10.10.5            # custom fragment size (multiple of 8)
nmap -D RND:5 10.10.10.5            # 5 random decoy source IPs mixed with real scan
nmap -D decoy1,decoy2,ME 10.10.10.5 # explicit decoys, ME marks your real position
nmap -S 10.10.10.200 10.10.10.5     # spoof source IP (rarely returns usable results unless on-path)
nmap -e eth0 10.10.10.5             # specify interface
nmap -g 53 10.10.10.5               # spoof source port (e.g. to slip past naive ACLs allowing port 53)
nmap --data-length 25 10.10.10.5    # append random data to pad packet size
nmap --randomize-hosts host1 host2  # randomize scan order across targets
nmap --spoof-mac 0 10.10.10.5       # random MAC address
nmap --spoof-mac Cisco 10.10.10.5   # vendor-prefixed random MAC
nmap --badsum 10.10.10.5            # send invalid checksums, see what responds anyway (finds naive stacks)

nmap -sC 10.10.10.5                       # run default category scripts
nmap --script default,vuln 10.10.10.5     # multiple categories
nmap --script=smb-vuln* 10.10.10.5        # wildcard match
nmap --script smb-enum-shares.nse host    # explicit single script
nmap --script vuln --script-args=unsafe=1 host   # pass script arguments
nmap --script-help smb-enum-shares         # see what a script does and its args
nmap --script-updatedb                     # refresh script database after adding scripts manually

# SMB enumeration — extremely common on AD boxes
nmap --script smb-os-discovery,smb-enum-shares,smb-enum-users,smb-protocols -p445 host

# SMB vuln checks (EternalBlue etc)
nmap --script smb-vuln* -p445 host

# HTTP enumeration
nmap --script http-enum,http-title,http-headers,http-methods -p80,443 host

# FTP anonymous login check
nmap --script ftp-anon -p21 host

# Kerberos user enumeration
nmap --script krb5-enum-users --script-args krb5-enum-users.realm='DOMAIN.LOCAL' -p88 host

# LDAP enumeration
nmap --script ldap-search -p389 host

# SSL/TLS cert + cipher info
nmap --script ssl-cert,ssl-enum-ciphers -p443 host

# DNS zone transfer attempt
nmap --script dns-zone-transfer --script-args dns-zone-transfer.domain=target.local -p53 host

# SNMP enumeration
nmap --script snmp-info,snmp-sysdescr -p161 --script-args snmpcommunity=public host

# General vuln sweep
nmap --script vuln host

-- basic-check.nse
description = [[
Checks for a specific HTTP header on the target and reports it.
]]

author = "operator"
license = "Same as Nmap"
categories = {"discovery", "safe"}

local http = require "http"
local shortport = require "shortport"

portrule = shortport.http

action = function(host, port)
  local response = http.get(host, port, "/")
  if response and response.header then
    return response.header["server"] or "no Server header"
  end
end

# Run a custom/local script directly by path
nmap --script /path/to/basic-check.nse -p80 host

nmap -oN scan.txt 10.10.10.5          # normal output to file (same as stdout)
nmap -oX scan.xml 10.10.10.5          # XML — parseable, feeds other tools
nmap -oG scan.gnmap 10.10.10.5        # grepable — legacy but still handy for quick grep/awk
nmap -oA scan_base 10.10.10.5         # all three formats at once, using scan_base as prefix
nmap -v 10.10.10.5                    # verbose
nmap -vv 10.10.10.5                   # very verbose
nmap -d 10.10.10.5                    # debug output
nmap --reason 10.10.10.5              # show why a port was marked open/closed/filtered
nmap --open 10.10.10.5                # only show open (or open|filtered) ports
nmap --stats-every 10s 10.10.10.5     # periodic progress updates, useful on long full-port scans

# Ncat — netcat replacement with SSL, proxy, and broker support
ncat -l 4444                          # listen
ncat 10.10.10.5 4444                  # connect
ncat --ssl -l 4444                    # SSL-wrapped listener
ncat -e /bin/bash -l 4444             # bind shell (lab/CTF use)
ncat --broker -l 4444                 # chat/relay broker mode — connects multiple clients together

# Nping — packet crafting and RTT/latency measurement
nping --tcp -p 80 -c 3 10.10.10.5     # send 3 TCP packets to port 80
nping --icmp -c 5 10.10.10.5          # ICMP echo, 5 packets
nping --udp --data-string "test" -p 53 10.10.10.5

# Ndiff — compare two scan results (great for change detection across re-scans)
ndiff scan1.xml scan2.xml

# Zenmap — GUI front end, wraps the above with saved profiles and topology view
zenmap

# 1. Fast full-port TCP sweep to find everything open
nmap -p- --min-rate 5000 -T4 -oG allports.gnmap 10.10.10.5

# 2. Extract open ports from the grepable output
ports=$(grep -oP '\d{1,5}/open' allports.gnmap | cut -d/ -f1 | tr '\n' ',' | sed 's/,$//')

# 3. Thorough scan against only the open ports found
nmap -sC -sV -p$ports -oA detailed 10.10.10.5

# 4. If SMB/AD services present, add targeted NSE
nmap --script smb-os-discovery,smb-enum-shares,smb-enum-users -p445 10.10.10.5

# 5. Don't forget UDP — at least a top-ports sweep
nmap -sU --top-ports 20 -T4 10.10.10.5

# 1. Full TCP sweep — AD boxes have a very recognizable port fingerprint
nmap -p- --min-rate 5000 -T4 10.10.10.5

# Recognizable AD ports: 53 (DNS), 88 (Kerberos), 135 (RPC), 139/445 (SMB),
# 389/636 (LDAP/LDAPS), 3268/3269 (Global Catalog), 5985 (WinRM)

# 2. Targeted enumeration once AD is confirmed
nmap -p88,389,445 --script krb5-enum-users,ldap-search,smb-os-discovery,smb-enum-shares \
     --script-args krb5-enum-users.realm='DOMAIN.LOCAL' 10.10.10.5

# 3. Hand off to specialized AD tooling (NetExec, BloodHound, Impacket)
# once service versions and domain name are confirmed from Nmap output

# 1. Standard port sweep
nmap -p- --min-rate 5000 -T4 10.10.10.5

# 2. HTTP-focused enumeration
nmap -sC -sV -p80,443 --script http-enum,http-title,http-headers,ssl-cert,ssl-enum-ciphers 10.10.10.5

# 3. Confirm vhosts / naming conventions from headers and cert SANs
#    before moving to gobuster/ffuf/whatweb for deeper web enum

# 1. Confirm the host is actually up via an out-of-band method,
#    then force Nmap to skip discovery
nmap -Pn -p- --min-rate 3000 -T4 10.10.10.5

# 2. ACK scan to distinguish stateful filtering from a genuinely closed port
nmap -sA -p- 10.10.10.5

# 3. If results are inconsistent, slow down and retry —
#    aggressive rate limiting on the target side can cause false negatives
nmap -Pn -p<suspect-ports> -T2 --max-retries 3 10.10.10.5

nmap -sn 10.10.10.0/24              # ping sweep
nmap -Pn host                       # skip discovery
nmap -PR 10.10.10.0/24              # ARP ping (LAN)

nmap -p- --min-rate 5000 -T4 host

nmap -sC -sV -p<ports> -oA output host

nmap -A -T4 host

nmap -sU --top-ports 20 -T4 host

nmap -sS host      # SYN (default, root)
nmap -sT host      # Connect (no root)
nmap -sU host      # UDP
nmap -sA host      # ACK (firewall mapping)
nmap -sN/-sF/-sX host  # NULL/FIN/Xmas

nmap -sV host
nmap -O host
nmap -A host        # combines both + scripts + traceroute

nmap -sC host                        # default scripts
nmap --script vuln host              # vuln checks
nmap --script smb-vuln* -p445 host   # wildcard category
nmap --script-help <script>          # script docs
nmap --script-args key=value host    # pass args

nmap -f host                # fragment
nmap -D RND:5 host          # decoys
nmap --spoof-mac 0 host     # random MAC
nmap --data-length 25 host  # pad packets

nmap -oA basename host      # all formats
nmap -oX scan.xml host      # XML for tooling
nmap --open host            # only show open ports

ncat -l 4444                 # listener
ncat --ssl -l 4444           # SSL listener
nping --tcp -p80 -c3 host    # packet crafting
ndiff scan1.xml scan2.xml    # diff two scans

-T0 paranoid   -T1 sneaky   -T2 polite
-T3 normal     -T4 aggressive (common CTF default)   -T5 insane
--min-rate 5000   # forces high packet rate regardless of template