Nmap field page

Nmap Cheatsheet

A short action page for building the right scan from small blocks: target, scan type, ports, depth, timing, and output. Use the full Nmap guide for theory; use this page when you need to act.

Before command zero: know the exact target. In a lab, find the VM IP or the lab subnet first. In real work, use the written scope. If you are not sure what belongs to you, stop and identify the target before scanning.

0. Command Skeleton

This is the shape behind almost every useful Nmap command. Treat each part as a block you swap depending on the task.

sudo nmap [scan-type] [ports] [depth] [timing] [output] <target>
Target

192.168.56.101, 192.168.56.0/24, host.local, or -iL targets.txt.

Scan type

-sS for privileged TCP SYN, -sT without sudo, -sU for UDP, -sA for firewall filtering behavior.

Depth

-sV versions, -sC default scripts, -O OS guess, -A all-in-one fingerprinting.

Ports

No -p means default top 1000 TCP ports. Use -p 22,80, -p-, or --top-ports 200 when needed.

Speed

-T3 normal, -T4 fast local lab, -T2 slower and less bursty for careful training. Rate flags are optional lab tuning.

Output

-oA "$(date +%F_%H%M)_name" saves normal, grepable, and XML output with a timestamped base filename. If you are not in Bash, type a clear name manually.

Build Scans From Blocks

Do not memorize random commands. Choose the situation, then combine only the blocks that fit.

Local vulnerable VM

known target + SYN + default ports + aggressive depth + fast timing + saved output

Use for Metasploitable, DVWA, OWASP Juice Shop, and other intentionally vulnerable local labs where noise is not the problem.

Careful training scan

known target + SYN + small port list + version check + slow timing + saved output

Use when practicing disciplined scanning against a monitored lab or a fragile practice network. This is still visible; it is just less bursty.

Basic network recon

subnet + discovery only, then known host + OS/service check

Use when you need to find devices first, then identify likely operating systems and exposed services.

Service follow-up

found ports + version check + only matching scripts

Use after the first scan reveals web, SMB, SSH, FTP, database, or UDP services. Focus the scripts on what actually exists.

Five Master Commands

1. Basic recon: find devices, then ask for OS clues

Use when: you know the subnet, but not the exact VM or device IP.

sudo nmap -sn --reason -oA "$(date +%F_%H%M)_live-hosts" 192.168.56.0/24
sudo nmap -sS -O --osscan-limit --reason -oA "$(date +%F_%H%M)_os-check" 192.168.56.101
  • -sn does host discovery only. It does not port scan.
  • Change 192.168.56.0/24 to your VirtualBox, VMware, home, or lab subnet.
  • -O asks for OS detection after you choose a live host.
  • --osscan-limit keeps OS detection focused on hosts where Nmap has enough signal.

2. Loud default scan for a local lab VM

Use when: you have a Metasploitable-style target and want the useful first scan.

sudo nmap -sS -A -T4 --reason -oA "$(date +%F_%H%M)_lab-default" 192.168.56.101
  • No -p is intentional: Nmap scans the default top 1000 TCP ports.
  • -sS is the normal privileged TCP SYN scan.
  • -A turns on service/version detection, OS detection, default scripts, and traceroute.
  • -T4 is fast and practical for a reliable local lab.
  • --reason tells you why Nmap decided a port state.

3. Slower controlled scan for careful practice

Use when: you are practicing against a monitored lab or a fragile practice network and want fewer bursts.

sudo nmap -sS -sV -T2 --scan-delay 500ms --reason -p 22,80,443 -oA "$(date +%F_%H%M)_careful-scan" 192.168.56.101
  • -p 22,80,443 keeps the scan narrow. Change this list to the ports you actually need.
  • -T2 slows the timing template.
  • --scan-delay 500ms spaces probes out. It does not make the scan invisible.
  • Use this for training discipline, not for pretending a scan cannot be seen.

4. Full TCP sweep, then fingerprint only what matters

Use when: the default scan is not enough and you suspect services on uncommon ports.

sudo nmap -sS -p- -T4 --reason -oA "$(date +%F_%H%M)_all-tcp" 192.168.56.101
sudo nmap -sS -sV -sC -O -p 21,22,80,139,445,3306 -oA "$(date +%F_%H%M)_found-detail" 192.168.56.101
  • -p- checks TCP ports 1 through 65535.
  • -T4 is enough speed control for most local labs. Add --min-rate 3000 only when you are intentionally tuning a fast lab sweep.
  • In the second line, replace the -p list with the open ports from the first scan.
  • This two-step flow keeps the heavy port sweep separate from the detailed fingerprinting.

5. Service-specific deep dive

Use when: you found a service family and need focused scripts, not a huge script dump.

nmap -sV -p 80,443,8080 --script http-title,http-headers,http-methods -oA "$(date +%F_%H%M)_web" 192.168.56.101
Replace the service block with Use when
-p 139,445 --script smb-os-discovery,smb-enum-shares,smb-enum-users SMB or Samba appears open in a lab.
-p 21 --script ftp-anon,ftp-syst FTP is open and you need quick configuration clues.
-p 22 --script ssh-auth-methods,ssh-hostkey SSH is open and you want login method and host key context.

Keep this focused. Pick the service family you actually found, then run the matching script set.

Fast Flag Swaps

Use these as replacement blocks inside the skeleton. They change the behavior of a scan without forcing you to memorize a completely new command.

Flag One-line decision
-sS Use as your normal privileged TCP scan in a lab.
-sT Use when you cannot run with elevated privileges.
-sU Use when DNS, SNMP, NTP, VPN, or other UDP services matter.
-sA Use to study firewall filtering behavior, not to find open services directly.
-A Use for loud all-in-one local-lab fingerprinting.
-sV -sC -O Use when you want the explicit version of what -A bundles together.
-T4 Use on reliable local labs; slow down on fragile or production-like networks.
-oA name Use whenever the result matters enough to save.

Edge-case replacement commands

These are not extra master commands. They are swaps for when the normal answer is missing or when UDP/firewall behavior is the specific question.

sudo nmap -Pn -sS -sV --reason -p 22,80,443 -oA "$(date +%F_%H%M)_no-ping" 192.168.56.101
sudo nmap -sU --top-ports 20 --version-intensity 2 -oA "$(date +%F_%H%M)_udp-top" 192.168.56.101
sudo nmap -sA --reason -p 22,80,443 -oA "$(date +%F_%H%M)_ack-filtering" 192.168.56.101

Do not stack everything by default. A useful scan answers one question cleanly: which hosts exist, which TCP ports are open, what services are behind them, what scripts apply to those services, or whether discovery/filtering is changing the result.

For concepts, examples, port states, NSE categories, timing explanations, and practice scenarios, read the full Nmap guide.