NMAP Scanning and Enumeration Tutorial

Nmap (“Network Mapper”) is a free and open source (license) utility for network discovery and security auditing. Many systems and network administrators also find it useful for tasks such as network inventory, managing service upgrade schedules, and monitoring host or service uptime. Nmap uses raw IP packets in novel ways to determine what hosts are available on the network, what services (application name and version) those hosts are offering, what operating systems (and OS versions) they are running, what type of packet filters/firewalls are in use, and dozens of other characteristics. It was designed to rapidly scan large networks, but works fine against single hosts. Nmap runs on all major computer operating systems, and official binary packages are available for Linux, Windows, and Mac OS X. In addition to the classic command-line Nmap executable, the Nmap suite includes an advanced GUI and results viewer (Zenmap), a flexible data transfer, redirection, and debugging tool (Ncat), a utility for comparing scan results (Ndiff), and a packet generation and response analysis tool (Nping).

Nmap was named “Security Product of the Year” by Linux Journal, Info World, LinuxQuestions.Org, and Codetalker Digest. It was even featured in twelve movies, including The Matrix ReloadedDie Hard 4Girl With the Dragon Tattoo, and The Bourne Ultimatum.


Target Specification





Scan a single IP


Scan specific IPs


Scan a range

nmap scanme.nmap.org

Scan a domain


Scan using CIDR notation


nmap -iL targets.txt

Scan targets from a file


nmap -iR 100

Scan 100 random hosts


nmap –exclude

Exclude listed hosts

Scan Techniques





nmap -sS

TCP SYN port scan (Default)


nmap -sT

TCP connect port scan
(Default without root privilege)


nmap -sU

UDP port scan


nmap -sA

TCP ACK port scan


nmap -sW

TCP Window port scan


nmap -sM

TCP Maimon port scan

Host Discovery





nmap -sL

No Scan. List targets only


nmap -sn

Disable port scanning. Host discovery only.


nmap -Pn

Disable host discovery. Port scan only.


nmap -PS22-25,80

TCP SYN discovery on port x.

Port 80 by default


nmap -PA22-25,80

TCP ACK discovery on port x.

Port 80 by default


nmap -PU53

UDP discovery on port x.

Port 40125 by default


nmap -PR

ARP discovery on local network


nmap -n

Never do DNS resolution

Port Specification





nmap -p 21

Port scan for port x


nmap -p 21-100

Port range


nmap -p U:53,T:21-25,80

Port scan multiple TCP and UDP ports


nmap -p-

Port scan all ports


nmap -p http,https

Port scan from service name


nmap -F

Fast port scan (100 ports)


nmap –top-ports 2000

Port scan the top x ports


nmap -p-65535

Leaving off initial port in range
makes the scan start at port 1


nmap -p0-

Leaving off end port in range

makes the scan go through to port 65535

Service and Version Detection





nmap -sV

Attempts to determine the version of the service running on port

-sV –version-intensity

nmap -sV –version-intensity 8

Intensity level 0 to 9. Higher number increases possibility of correctness

-sV –version-light

nmap -sV –version-light

Enable light mode. Lower possibility of correctness. Faster

-sV –version-all

nmap -sV –version-all

Enable intensity level 9. Higher possibility of correctness. Slower


nmap -A

Enables OS detection, version detection, script scanning, and traceroute

OS Detection





nmap -O

Remote OS detection using TCP/IP
stack fingerprinting

-O –osscan-limit

nmap -O –osscan-limit

If at least one open and one closed
TCP port are not found it will not try
OS detection against host

-O –osscan-guess

nmap -O –osscan-guess

Makes Nmap guess more aggressively

-O –max-os-tries

nmap -O –max-os-tries 1

Set the maximum number x of OS
detection tries against a target


nmap -A

Enables OS detection, version detection, script scanning, and traceroute

Timing and Performance





nmap -T0

Paranoid (0) Intrusion Detection
System evasion


nmap -T1

Sneaky (1) Intrusion Detection System


nmap -T2

Polite (2) slows down the scan to use
less bandwidth and use less target
machine resources


nmap -T3

Normal (3) which is default speed


nmap -T4

Aggressive (4) speeds scans; assumes
you are on a reasonably fast and
reliable network


nmap -T5

Insane (5) speeds scan; assumes you
are on an extraordinarily fast network


Example input


–host-timeout <time>

1s; 4m; 2h

Give up on target after this long

–min-rtt-timeout/max-rtt-timeout/initial-rtt-timeout <time>

1s; 4m; 2h

Specifies probe round trip time

–min-hostgroup/max-hostgroup <size<size>

50; 1024

Parallel host scan group

–min-parallelism/max-parallelism <numprobes>

10; 1

Probe parallelization

–scan-delay/–max-scan-delay <time>

20ms; 2s; 4m; 5h

Adjust delay between probes

–max-retries <tries>


Specify the maximum number
of port scan probe retransmissions

–min-rate <number>


Send packets no slower than <numberr> per second

–max-rate <number>


Send packets no faster than <number> per second

NSE Scripts





nmap -sC

Scan with default NSE scripts. Considered useful for discovery and safe

–script default

nmap –script default

Scan with default NSE scripts. Considered useful for discovery and safe


nmap –script=banner

Scan with a single script. Example banner


nmap –script=http*

Scan with a wildcard. Example http


nmap –script=http,banner

Scan with two scripts. Example http and banner


nmap –script “not intrusive”

Scan default, but remove intrusive scripts


nmap –script snmp-sysdescr –script-args snmpcommunity=admin

NSE script with arguments



nmap -Pn –script=http-sitemap-generator scanme.nmap.org

http site map generator

nmap -n -Pn -p 80 –open -sV -vvv –script banner,http-title -iR 1000

Fast search for random web servers

nmap -Pn –script=dns-brute domain.com

Brute forces DNS hostnames guessing subdomains

nmap -n -Pn -vv -O -sV –script smb-enum*,smb-ls,smb-mbenum,smb-os-discovery,smb-s*,smb-vuln*,smbv2* -vv

Safe SMB scripts to run

nmap –script whois* domain.com

Whois query

nmap -p80 –script http-unsafe-output-escaping scanme.nmap.org

Detect cross site scripting vulnerabilities

nmap -p80 –script http-sql-injection scanme.nmap.org

Check for SQL injections

Firewall / IDS Evasion and Spoofing





nmap -f

Requested scan (including ping scans) use tiny fragmented IP packets. Harder for packet filters


nmap –mtu 32

Set your own offset size


nmap -D,,,

Send scans from spoofed IPs


nmap -D decoy-ip1,decoy-ip2,your-own-ip,decoy-ip3,decoy-ip4 remote-host-ip

Above example explained


nmap -S www.microsoft.com www.facebook.com

Scan Facebook from Microsoft (-e eth0 -Pn may be required)


nmap -g 53

Use given source port number


nmap –proxies,

Relay connections through HTTP/SOCKS4 proxies


nmap –data-length 200

Appends random data to sent packets

Example IDS Evasion command

nmap -f -t 0 -n -Pn –data-length 200 -D,,,






nmap -oN normal.file

Normal output to the file normal.file


nmap -oX xml.file

XML output to the file xml.file


nmap -oG grep.file

Grepable output to the file grep.file


nmap -oA results

Output in the three major formats at once

-oG –

nmap -oG –

Grepable output to screen. -oN -, -oX – also usable


nmap -oN file.file –append-output

Append a scan to a previous scan file


nmap -v

Increase the verbosity level (use -vv or more for greater effect)


nmap -d

Increase debugging level (use -dd or more for greater effect)


nmap –reason

Display the reason a port is in a particular state, same output as -vv


nmap –open

Only show open (or possibly open) ports


nmap -T4 –packet-trace

Show all packets sent and received


nmap –iflist

Shows the host interfaces and routes


nmap –resume results.file

Resume a scan



nmap -p80 -sV -oG – –open | grep open

Scan for web servers and grep to show which IPs are running web servers

nmap -iR 10 -n -oX out.xml | grep “Nmap” | cut -d ” ” -f5 > live-hosts.txt

Generate a list of the IPs of live hosts

nmap -iR 10 -n -oX out2.xml | grep “Nmap” | cut -d ” ” -f5 >> live-hosts.txt

Append IP to the list of live hosts

ndiff scanl.xml scan2.xml

Compare output from nmap using the ndif

xsltproc nmap.xml -o nmap.html

Convert nmap xml files to html files

grep ” open ” results.nmap | sed -r ‘s/ +/ /g’ | sort | uniq -c | sort -rn | less

Reverse sorted list of how often ports turn up

Miscellaneous Options





nmap -6 2607:f0d0:1002:51::4

Enable IPv6 scanning


nmap -h

nmap help screen

Other Useful Nmap Commands



nmap -iR 10 -PS22-25,80,113,1050,35000 -v -sn

Discovery only on ports x, no port scan

nmap -PR -sn -vv

Arp discovery only on local network, no port scan

nmap -iR 10 -sn -traceroute

Traceroute to random targets, no port scan

nmap -sL –dns-server

Query the Internal DNS for hosts, list targets only

More information and fact sheets download

Loader Loading...
EAD Logo Taking too long?
Reload Reload document
| Open Open in new tab

Download NMAP Cheat Sheet [287.26 KB]


Want to learn? https://www.soutechventures.com/ilearn/courses.php See course details- over 20 Tech Skills

Get 80% Discount when you chat up (234) 8034121380 via WhatsApp

Get Cashback when you refer your friends, Let’s get started!!!

Learn and Earn More-   Smart Passwords: The key to Information Security and why you should create it well and guard it.

Author: SouTech Team
Soutech Ventures is primarily an Information Technology Firm, which was created to be the numero uno in business promotion development & implementation, eBusiness & IT systems integration and consultancy industry of the Nigerian Economy and to partners worldwide. Our Core strengths are - Tech Trainings and Certifications - Data Analytics and Cybersecurity Solutions - Software Development & Deployment for SME & Govt. - Tech Internship, HR & Partnerships
WhatsApp chat