Nmap Advanced Tutorial
Master Network Scanning and Security Assessment
Essential Nmap Commands
# Basic Scans nmap target.com # Default scan (1000 ports) nmap -p- target.com # All 65535 ports nmap -p 22,80,443,3306 target.com # Specific ports # Scan Types nmap -sS target.com # SYN scan (stealth) nmap -sT target.com # TCP connect scan nmap -sU target.com # UDP scan nmap -sP target.com # Ping sweep nmap -sV target.com # Version detection nmap -O target.com # OS detection nmap -A target.com # Aggressive scan # Output Options nmap -oA results target.com # All formats nmap -oN results.nmap target.com # Normal nmap -oX results.xml target.com # XML (for tools) nmap -oG results.grep target.com # Grepable
Advanced Techniques
# Evasion and Stealth nmap -f -sS target.com # Fragment packets nmap -D RND:10 target.com # Random decoys nmap -g 88 target.com # Source port nmap --data-length 50 target.com # Random payload nmap --ttl 128 target.com # TTL manipulation # Performance nmap -T4 -p- target.com # Aggressive timing nmap --min-rate 1000 target.com # Min packets/sec nmap --max-retries 2 target.com # Retry limit # Script Scanning nmap --script vuln target.com # Vulnerability scan nmap --script exploit target.com # Exploit modules nmap --script auth target.com # Auth testing nmap --script http-enum target.com # Web enum # Firewall/IDS Evasion nmap --badsum target.com # Invalid checksum nmap --scanflags SYNFIN target.com # Custom flags nmap --spoof-mac 0 target.com # Random MAC
NSE Script Examples
# Discovery Scripts nmap --script=banner target.com # Banner grabbing nmap --script=dns-zone-transfer target.com # Zone transfer nmap --script=smb-enum-users target.com # SMB enum # Vulnerability Scripts nmap --script=smb-vuln-ms17-010 target.com # EternalBlue nmap --script=http-sql-injection target.com # SQLi nmap --script=ssl-heartbleed target.com # Heartbleed # Information Gathering nmap --script=whois target.com # Whois lookup nmap --script=http-headers target.com # HTTP headers nmap --script=robots.txt target.com # Robots enum # Custom Script Execution nmap --script=/path/to/script.nse target.com nmap --script-args 'http.useragent="Mozilla"' target.com
Frequently Asked Questions
What is Nmap and why is it important for cybersecurity?
Nmap (Network Mapper) is the industry-standard network scanning tool. Essential for: network discovery and security auditing, port scanning to identify running services, OS fingerprinting, version detection, vulnerability assessment, and penetration testing reconnaissance. It's free, open-source, and used by security professionals worldwide for both defensive and offensive security assessments.
What are the different Nmap scan types?
Scan types: -sS (SYN scan - stealth, half-open), -sT (TCP connect scan), -sU (UDP scan), -sP (ping sweep), -sF (FIN scan), -sX (Xmas scan), -sN (Null scan), -sA (ACK scan), and -sI (Idle/Zombie scan). SYN scan is default and fastest; TCP connect is used when SYN is blocked; UDP scan is slow but necessary for DNS, DHCP, SNMP services.
How do I use NSE scripts effectively?
NSE (Nmap Scripting Engine) scripts: --script=default for basic checks, --script=vuln for vulnerability scanning, --script=exploit for exploitation, --script=discovery for network discovery, --script=auth for authentication testing. Examples: nmap --script=http-enum target.com (enumerate web directories), nmap --script=smb-vuln-ms17-010 target.com (check for EternalBlue), nmap --script=dns-zone-transfer target.com (DNS zone transfer).
What are timing templates in Nmap?
Timing templates (-T0 to -T5): T0/T1 (paranoid/sneaky - for IDS evasion), T2 (polite - slower, less bandwidth), T3 (normal - default), T4 (aggressive - faster scanning), T5 (insane - fastest but may miss results). Use -T4 for most CTF challenges and penetration tests; -T5 only on reliable networks with no rate limiting.
How do I perform stealth scanning with Nmap?
Stealth techniques: Use SYN scan (-sS), fragment packets (-f), randomize target order (--randomize-hosts), add decoy IPs (-D), slow timing (-T0/-T1), use source port manipulation (-g), and avoid ping discovery (--Pn). Remember: true stealth doesn't exist - sophisticated IDS will detect any scanning. Legal scanning only on authorized targets!
Master Nmap with Cyber Defence
Learn advanced network scanning in our ethical hacking course.
View Course