> ## Documentation Index > Fetch the complete documentation index at: https://0-x.dev/llms.txt > Use this file to discover all available pages before exploring further. # Nmap Nmap is the default tool for working out what's actually alive on a network and what's listening on it. Most scans fall into one of two buckets: finding hosts in the first place, and then scanning the ports on a host you already know exists. Everything else, OS detection, scripting, evasion, builds on top of those two basics. > **Host Discovery** > > Figures out which hosts on a network are up, without touching any ports. The first step on a fresh subnet. > **Port Scanning** > > Probes a known host to see what's listening and, optionally, what service and version is running behind each port. > [!TIP] > > `-Pn` skips the initial ping check entirely. Windows hosts block ICMP by default, so if a scan comes back with nothing, try `-Pn` before assuming the host is down. *** ## The Basics Before getting into flags, nmap works perfectly fine with no options at all. Pointed at a target, it runs a default SYN scan against the top 1000 ports and reports what's open. ```bash theme={null} nmap TARGET ``` `TARGET` accepts a few different formats depending on what you're scanning: ```bash theme={null} nmap 10.10.10.5 # single host nmap 10.10.10.5 10.10.10.6 # multiple hosts nmap 10.10.10.0/24 # entire subnet, CIDR notation nmap 10.10.10.1-254 # IP range nmap scanme.nmap.org # hostname, resolved via DNS nmap -iL targets.txt # list of targets from a file, one per line ``` > [!TIP] > > If you're not sure where to start on a box, `nmap -A TARGET` is a reasonable default: it adds service versions, OS detection, and script scanning on top of the basic scan in a single command. *** ## Host Discovery Before scanning any ports, it's often worth just figuring out what's alive on the network. These scans skip port scanning entirely and rely on different probe types depending on how stealthy you need to be. ```bash theme={null} nmap -sn -v -T4 TARGET # quick ping sweep, sends ARP requests on the local subnet ``` ARP requests get logged by most IDS setups since they're unavoidable on a local network. A TCP SYN ping is quieter and works the same way: a RST back means the host is alive. ```bash theme={null} nmap -sn -PS TARGET # TCP SYN ping, stealthier than a straight ARP sweep nmap -sn -PA TARGET # TCP ACK ping, also looks for a RST in response nmap -sn -PE TARGET # plain ICMP echo request ``` *** ## Port Scanning Once you know a host is up, the next question is what's actually listening on it. The scan type you pick trades off speed, reliability, and how noisy it is on the wire. ```bash theme={null} nmap -Pn -sS TARGET # TCP SYN scan, stealthy since the handshake never completes nmap -Pn -sT TARGET # full TCP connect scan, more reliable but noisier and logged more often nmap -Pn -sU TARGET # UDP scan, slow by nature but necessary since plenty of services only run over UDP ``` > [!TIP] > > UDP scans are painfully slow by default. `sudo nmap -sU --min-rate 10000` pushes packets out much faster at the cost of some accuracy. For a fast first look rather than a full scan: ```bash theme={null} nmap -Pn -F TARGET # top 100 ports only, with ICMP disabled ``` To go the other direction and get everything in one pass: ```bash theme={null} nmap -A -p- -T5 TARGET # full port range plus OS, service and traceroute detection, aggressive timing ``` *** ## Service and OS Detection Knowing a port is open is only half the picture. Version and OS detection tell you what's actually running behind it, which is usually what you need to start looking for a known vulnerability. ```bash theme={null} nmap -sV -O TARGET # service version and OS fingerprint in one pass nmap TARGET -A -v # OS detection, service detection, and traceroute together ``` > [!TIP] > > `-sV --version-intensity 8` pushes version detection to its most thorough setting. It's slower, but worth it when a lighter scan leaves a service unidentified. *** ## Scripting Engine (NSE) Nmap ships with a huge library of scripts for everything from banner grabbing to active vulnerability checks, stored under `/usr/share/nmap/scripts/`. Running the right one against the right port often turns up more than the scan itself. ```bash theme={null} nmap -sS -sV -sC -p- TARGET # default script set alongside a full scan nmap --script smb-os-discovery.nse -p445 TARGET # run one specific script nmap --script=ftp-* -p- TARGET # run every script matching a prefix nmap TARGET --script vuln # run the vulnerability-scanning script category ``` To find a script when you only remember part of the name: ```bash theme={null} ls -la /usr/share/nmap/scripts/ | grep SEARCH_TERM nmap --script-help=SCRIPT_NAME ``` *** ## Firewall and IDS Evasion > [!WARNING] > > None of these reliably bypass a modern, well-configured IDS. They raise the bar against basic signature matching, not a determined analyst watching the traffic. Fragmenting packets splits them below the size some filters inspect at: ```bash theme={null} nmap -sS -sV -p PORTS -f TARGET ``` Spoofing decoy source addresses makes the real scanning host harder to pick out of the noise: ```bash theme={null} nmap -sS -sV -p PORTS -f -D SPOOFED_IP TARGET ``` Combine both with a custom source port to round it out: ```bash theme={null} nmap -sS -sV -p PORTS -f -D SPOOFED_IP -g SPOOFED_PORT TARGET ``` *** ## Flags Reference > **Host discovery and ping flags** > > | Flag | Description | > | - | - | > | `-sn` | Disables port scanning, ping sweep only | > | `-Pn` | Disables ICMP echo requests entirely | > | `-n` | Disables DNS resolution | > | `-PE` | ICMP echo request ping | > | `-PA` / `-PA0-1000` | TCP ACK ping | > | `-PS` / `-PS0-1000` | TCP SYN ping | > | `-PU` / `-PU0-1000` | UDP ping | > | `--disable-arp-ping` | Disables ARP ping requests | > **Scan type and target flags** > > | Flag | Description | > | - | - | > | `10.10.10.0/24`, `10.10.10.0-254` | Target network range | > | `-iL targets.txt` | Scan a list of targets from a file | > | `-sS` / `-sA` / `-sT` / `-sU` | SYN / ACK / connect / UDP scan | > | `-p-` | Scan all 65535 ports | > | `-p22-110` | Scan a port range | > | `-p22,25` | Scan specific ports | > | `-F` | Top 100 ports only | > | `--top-ports=` | Scan the N most common ports | > **Detection and scripting flags** > > | Flag | Description | > | - | - | > | `-sV` | Service version detection | > | `-sV --version-intensity [0-8]` | More thorough version detection, 8 is most accurate | > | `-sC` | Run default-category scripts | > | `--script