Search for connected devices in the network or all open ports on a device:
sudo nmap -sV -sC -oN scan.output 10.10.10.10
SCANNING
- nmap -sP 192.168.0.0/24
- Ping scan
- nmap -sT 10.0.0.1,10.0.0.2
- Scan most common TCP ports
- nmap -sU 192.168.0.1
- Scan most common UDP ports
- nmap -sS 192.168.0.1
- Stealth scan
- nmap -sA 192.168.0.1
- ACK scan
- nmap -sF 192.168.0.1
- FIN scan
- nmap -sI 192.168.0.1
- IDLE scan
- nmap -sL 192.168.0.1
- DNS scan
- nmap -sN 192.168.0.1
- NULL scan
- nmap -sO 192.168.0.1
- Protocol scan
- nmap -sR 192.168.0.1
- RPC scan
- nmap -sW 192.168.0.1
- Windows scan
- nmap -sX 192.168.0.1
- XMAS scan
- nmap -p- 192.168.0.1
- Scan all 65535 ports (takes some time)
- nmap -p2000-3000 192.168.0.1
- Scan a range of ports
- nmap -O 192.168.0.1
- Guess the operating system
- nmap -A 192.168.0.1
- Run all tests (takes a lot of time)
- nmap -F 192.168.0.1
- Fast scan
- nmap -sV 192.168.0.1
- Service version detection
- nmap -sn 192.168.0.1
- Ping-only scan
- nmap -Pn 192.168.0.1
- Skip ping
- nmap –traceroute 192.168.0.1
- Traceroute
- nmap -R 192.168.0.1
- Force reverse DNS
- nmap -sL 192.168.0.1
- Create a host list
- nmap -T4 192.168.0.1
- Fast parallel speed (0 to 4)
- nmap -oA outputFile 192.168.0.1
- Save output in all formats
- nmap -oX outputFile 192.168.0.1
- Save output in XML format
- nmap -oN outputFile 192.168.0.1
- Save output in normal format. Alternatives: -oX for XML, -oS for script-kiddie, -oG for grepable, and -oA for all formats.
- nmap -sC 192.168.0.1
- Script scan using default scripts, equivalent to –script=default
Nmap Script Engine (NSE)
- safe – Won’t affect the target
- intrusive – Likely to affect the target
- vuln – Scan for vulnerabilities
- exploit – Attempt to exploit a vulnerability
- auth – Attempt to bypass authentication for running services (e.g. log in to an FTP server anonymously)
- brute – Attempt to brute force credentials for running services
- discovery – Query running services for further network information (e.g. query an SNMP server)
COMPARING SCANS
- ndiff -v scan2.xml scan1.xml
- Verbosely compare output files
- ndiff –xml scan2.xml scan1.xml
- Output the comparison in XML
Scan a list of networks from a file using 10 parallel threads:
cat networks_list.txt | xargs -I CMD -P 10 nmap -sT -sV -sC -n -vvv -Pn -oX - CMD
Check for vulnerabilities using the Nmap Scripting Engine:
sudo nmap --script vuln 192.168.0.1
ZenMap is the official GUI for Nmap. See at [Link].