nmap 192.168.1.1 | Scan single host |
nmap 192.168.1.1-100 | Scan IP range |
nmap 192.168.1.0/24 | Scan subnet |
nmap -iL targets.txt | Scan from file |
nmap --exclude 192.168.1.1 | Exclude host |
nmap example.com | Scan domain |
nmap -sS 192.168.1.1 | TCP SYN scan (default) |
nmap -sT 192.168.1.1 | TCP connect scan |
nmap -sU 192.168.1.1 | UDP scan |
nmap -sA 192.168.1.1 | TCP ACK scan |
nmap -sN 192.168.1.1 | TCP NULL scan |
nmap -sF 192.168.1.1 | TCP FIN scan |
nmap -sX 192.168.1.1 | Xmas scan |
nmap -sn 192.168.1.0/24 | Ping scan (no port scan) |
nmap -Pn 192.168.1.1 | Skip host discovery |
nmap -PS22,80,443 192.168.1.1 | TCP SYN ping |
nmap -PA80,443 192.168.1.1 | TCP ACK ping |
nmap -PU53 192.168.1.1 | UDP ping |
nmap -PE 192.168.1.1 | ICMP echo ping |
nmap -PP 192.168.1.1 | ICMP timestamp ping |
nmap --traceroute 192.168.1.1 | Traceroute |
nmap -p 22 192.168.1.1 | Single port |
nmap -p 22,80,443 192.168.1.1 | Multiple ports |
nmap -p 1-1000 192.168.1.1 | Port range |
nmap -p- 192.168.1.1 | All 65535 ports |
nmap -p U:53,T:22,80 192.168.1.1 | UDP and TCP ports |
nmap --top-ports 100 192.168.1.1 | Top 100 ports |
nmap -F 192.168.1.1 | Fast scan (100 ports) |
nmap -sV 192.168.1.1 | Service version detection |
nmap -sV --version-intensity 5 192.168.1.1 | Aggressive version scan |
nmap -O 192.168.1.1 | OS detection |
nmap -A 192.168.1.1 | Aggressive (OS, version, scripts) |
nmap -sV -sC 192.168.1.1 | Version + default scripts |
nmap -sC 192.168.1.1 | Default scripts |
nmap --script vuln 192.168.1.1 | Vulnerability scripts |
nmap --script http-* 192.168.1.1 | HTTP scripts |
nmap --script smb-vuln* 192.168.1.1 | SMB vulnerability scripts |
nmap --script ssl-heartbleed 192.168.1.1 | Heartbleed check |
nmap --script-updatedb | Update script database |
# HTTP enumeration
nmap --script http-enum 192.168.1.1
# SQL injection test
nmap --script http-sql-injection 192.168.1.1
# SMB shares
nmap --script smb-enum-shares 192.168.1.1
# DNS brute force
nmap --script dns-brute example.com
# SSL/TLS info
nmap --script ssl-cert,ssl-enum-ciphers -p 443 192.168.1.1
# Banner grabbing
nmap --script banner 192.168.1.1 nmap -T0 192.168.1.1 | Paranoid (IDS evasion) |
nmap -T1 192.168.1.1 | Sneaky |
nmap -T2 192.168.1.1 | Polite |
nmap -T3 192.168.1.1 | Normal (default) |
nmap -T4 192.168.1.1 | Aggressive |
nmap -T5 192.168.1.1 | Insane (fast) |
nmap --min-rate 1000 192.168.1.1 | Min 1000 packets/sec |
nmap -oN output.txt 192.168.1.1 | Normal output |
nmap -oX output.xml 192.168.1.1 | XML output |
nmap -oG output.gnmap 192.168.1.1 | Grepable output |
nmap -oA output 192.168.1.1 | All formats |
nmap -v 192.168.1.1 | Verbose |
nmap -vv 192.168.1.1 | Very verbose |
nmap --open 192.168.1.1 | Show only open ports |