Nmap Cheat Sheet For Penetration Testing

What is Nmap?

Nmap (“Network Mapper”) is a free and open source utility for network discovery and security auditing. Many systems and network administrators also find it useful for tasks such as network inventory, managing service upgrade schedules, and monitoring host or service uptime…more

Agressive scan timings are faster, but could yeild inaccurate results!

T5 uses very aggressive scan timings and could lead to missed ports, T4 is a better compromise if you need fast results.

Nmap scan from file

Nmap Scan all Ports

Nmap output formats

Nmap Netbios Examples

–script-args=unsafe=1 has the potential to crash servers / services

Becareful when running this command.

Nmap Nikto Scan

Nmap Cheatsheet

Target Specification

Nmap allows hostnames, IP addresses, subnets.

Example blah.highon.coffee, nmap.org/24, 192.168.0.1; 10.0.0-255.1-254

Host Discovery

Scan Techniques

Port Specification and Scan Order

Service Version Detection

Script Scan

OS Detection

Timing and Performance

Options which take TIME are in seconds, or append ‘ms’ (milliseconds), ‘s’ (seconds), ‘m’ (minutes), or ‘h’ (hours) to the value (e.g. 30m).

Firewalls IDS Evasion and Spoofing

Nmap Output Options

Misc Nmap Options

Nmap Scan Optimisation

Nmap Rate

To speed up your scan increase the rate, be aware that setting a high rate value will result in a less accurate scan.

--max-rate 
--min-rate 

Parallelism

The maximum or minimum amount of parallel tasks.

TIP: If you have an basic IDS / portscan detection blocking your scans you could lower the –min-parallelism in an attempt to reduce the number of concurrent connections

--min-parallelism
--max-parallelism

Host Group Sizes

The number of hosts scanned at the same time, Note: if you are writing output to a file e.g., -oA you will need to wait for the host group to complete scanning before the nmap output will be written to the file. Therefore if you get a lagging host you will may end up waiting a while for the output file, which brings us on to… host timeout.

--min-hostgroup 
--max-hostgroup 

Host Timeout

Nmap allows you to specify the timeout, which is the length of time it waits before giving up on the target. Be careful setting this super low, as you may end up with inaccurate results.

The following example would giveup after 50 seconds.

--host-timeout 50 

Scan Delay

An extremely useful option to defeat basic port scan detection (SOHO devices and some IDS) that essentially monitor and block X amount of connects per second (syn flood etc).

--scan-delay 5s 

For example if you know you can get away with 2 req/sec without getting blacklisted then you could use:

--scan-delay 1.2

added 200ms for a buffer

Disable DNS Lookups

Assuming you do not want domain names being looked up, use the -n flag to dissable resolution and speed up the scan.

Nmap Black List Detection?

1. It ussally takes and extemely long time to complete
2. Droppped probes nmap will increase the timeout, but it’s likely you are already black listed
3. To confirm, recheck a port that you know was open before

As far as I know there is no way of detecting for black listing within nmap natively.

Optimising Portscans for Targets

Once you have identified a target firewall / IDS you can look up the default settings for the portscan black list by reading the manual and use the nmap command switches above to obtain the best performance without getting black listed.

Complete Nmap tutorial