Nmap Syntax
1.Scanning an IP
Syntax: nmap <target-ip>
2.Scanning a HOST
Syntax: nmap <www.example.com>
3.Scanning a range of IPs
Syntax: nmap <ip-address-range>
4.Scanning a Subnet
Syntax: nmap <ip-address/24>
5.Scanning a Targets from a Text File
Syntax: nmap -iL <list.txt>
6.Scanning target & Ignore Discovery
Syntax: nmap -target-ip <-Pn>
7.Scanning target & Host Discovery
Syntax: nmap -target-ip <-sP>
8.Scan a Single Port
Syntax: nmap <target-ip> <-p port numbers>
9.Scan a range of ports
Syntax: nmap <target-ip> <-p firstport-lastport>
10.Scan all ports (65535)
Syntax: nmap <target-ip><-p->
11.Scan TCP or UDP Ports
Syntax: nmap <target-ip><-p U:port, T:port>
12.Fast Port Scan
Syntax: nmap <target-ip><-F> -v
13.No Randomise Port Scan
Syntax: nmap <target-ip><-r> -v
14.Nmap Top Ports Scan
Syntax: nmap <target-ip><—top-ports N> -v
15.Nmap Port Ratio Scan
Syntax: nmap <target-ip><—ports-ratio > -v
16.Port-knocking an obfuscation-as-security technique.
Syntax: for x in 1-10000; do nmap -Pn -p $x server_ip_address;
done
17.Standard Service Detection
Syntax: nmap <target-ip><-sV>
18.Light Service Detection
Syntax: nmap <target-ip><-sV —version-intensity 0>
19.Aggressive Service Detection
Syntax: nmap <target-ip><-sV —version-intensity 5>
20.OS Detection
Syntax: nmap <target-ip> <-O >
21.OS Detection
Syntax: nmap <target-ip> <—max-os-tries>
22.OS Detection
Syntax: nmap <target-ip><—osscan-limit >
23.OS Detection
Syntax: nmap <target-ip><—osscan-guess; —fuzzy >
24.OS Detection
Syntax: nmap <target-ip><—script —smb-os-discovery >
25.Save Normal Output to File
Syntax: nmap <target-ip><-oN file.txt>
26.Save XML Output to File
Syntax: nmap <target-ip><-oX file.txt>
27.Save XML to CSV for Recon
Syntax: nmap <target-ip><-oX file.txt>
• Python parsey.py op.xml op.csv
28.Save “Grep”able Output to File
Syntax: nmap <target-ip><-oG file.txt>
29.ScRipT K1dd3 Output to File
Syntax: nmap <target-ip><-oS file.txt>
30.Save All Types Output to File
Syntax: nmap <target-ip><-oA file.txt>
31.Scan using Default Safe Scripts
Syntax: nmap <target-ip><-sC>
32.Getting Help for any Scripts
Syntax: nmap <target-ip><—script-help=scriptname>
33.Nmap Script Args
Syntax: nmap <target-ip><—script=scriptname —scriptargs>
34.Scan using specific Scripts
Syntax: nmap <target-ip><—script=script name.nse>
35.Scan using set of Scripts
Syntax: nmap <target-ip><—script=“http-*”>
36.Update Script Database
Syntax: nmap <target-ip><—script=updatedb>
37.Safe Scripts
Syntax: nmap <target-ip><—script=safe,default>
38.Vulnerability Scripts
Syntax: nmap <target-ip><—script=vuln>
39.DOS Scripts
Syntax: nmap <target-ip><—script=dos>
40.Exploit Scripts
Syntax: nmap <target-ip><—script=exploit>
41.Malware Scripts
Syntax: nmap <target-ip><—script=http-malware-host>
42.Intrusive Scripts
Syntax: nmap <target-ip><—script=intrusive>
43.NOT including Scripts
Syntax: nmap <target-ip><—script=not script type>
44.Boolean Expression Scan
Syntax: nmap <target-ip><—script=and or not script type>
45.Traceroute Scan
Syntax: nmap <target-ip><—traceroute>
46.Trace Traffic & Geo Resolution Scan
Syntax: nmap <target-ip><—script=traceroutegeolocation>
47.DNS BruteForce Scan
Syntax: nmap <target-ip><—script=dns-brute.nse>
48.Find Hosts on IP Scan
Syntax: nmap <target-ip> <—script=hostmap-bfk.nse>
49.Whois Scan
Syntax: nmap <target-ip><—script=whois-ip, whoisdomain>
50.Robots Scan
Syntax: nmap <target-ip><—script=http-robots.txt>
51.WAF Detect Scan
Syntax: nmap <target-ip><—script=http-waf-detect>
52.WAF Fingerprint Scan
Syntax: nmap <target-ip><—script=http-waf-fingerprint>
53.Wafw00f vs Nmap Scan
Syntax: wafw00f <target.com>
Syntax: nmap <target-ip><—script=http-waf-fingerprint>
54.Firewalk Scan
Syntax: nmap <target-ip><—script=firewalk —traceroute>
55.Shodan Scan
Syntax: nmap <target-ip><—script=shodan-api>
56.Email Enumeration
Syntax: nmap <target-ip><—script=http-grep>
57.Nmap Crawlers Scan
Syntax: nmap <target-ip><—script=http-useragent-tester>
58.Nmap Discovering Directories Scan
Syntax: nmap <target-ip><—script=http-enum>
59.Nmap Open Relay Scan
Syntax: nmap <target-ip><—script=smtp-open-relay>
60.Nmap SMTP User Enum Scan
Syntax: nmap <target-ip><—script=smtp-enum-users>
61.Nmap SMTP Password Attack Scan
Syntax: nmap <target-ip><—script=smtp-brute>
62.Nmap SMTP Backdoor Detect Scan
Syntax: nmap <target-ip><—script=smtp-strangeport>
63.Nmap POP3 Capabilities Scan
Syntax: nmap <target-ip><—script=pop3-capabilities>
64.Nmap IMAP Capabilities Scan
Syntax: nmap <target-ip><—script=imap-capabilities>
65.Nmap Cloak Scan with Decoy
Syntax: nmap <target-ip><-D>
66.Nmap Spoof Mac Address
Syntax: nmap <target-ip><—spoof-mac>
67.Nmap Select Interface
Syntax: nmap <target-ip><-e ethO>
68.Nmap Source Port Modify
Syntax: nmap <target-ip><—source-port 7890>
69.Nmap Fake TTL
Syntax: nmap <target-ip><—ttl 128>
70.Nmap Relay Proxies
Syntax: nmap <target-ip><—proxies proxy:port>
71.Nmap Bogus TCP/UDP Checksum
Syntax: nmap <target-ip><—badsum>
72.Nmap Bogus Fragment Scan
Syntax: nmap <target-ip> <-f>
73.Nmap MTU Scan
Syntax: nmap <target-ip><-mtu 8>
