Kenneth at 22:25, 29 January 2019

2019-01-29T22:25:14Z

New page

[http://insecure.org/nmap/ nmap]

# Syn Scan (defaults to SYN Scan if root, Connect Scan if not. See below)
nmap <ip>

# SYN Scan (default scan type if logged in as root)
nmap -sS <ip>
# "SYN ->" "SYN/ACK <-" "RST ->"

# No port scan (ping only) a list of IPs
nmap -iL list.txt -sn

# TCP Connect Scan (only scan you can do without root privileges)
nmap -sT <ip>
# "SYN ->" "SYN/ACK <-" "ACK ->"

# List Scan does a reverse DNS lookup on a range to find hosts
nmap -sL 66.35.250.150-160

# Ping Scan does a quick ping to each box, and nothing more
nmap -sP 10.0.0.0-255

# Nmap 3.75 help example:
namp -v -sS -) www.my.com 192.168.0.0/16 '192.88-90.*.*'

# Nmap 4.11 help examples:
nmap -v -A scanme.nmap.org
nmap -v -sP 192.168.0.0/16 10.0.0.0/8
nmap -v -iR 10000 -P0 -p 80

Nmap files can be found here (such as nmap-services):
/usr/share/nmap/

You can use --datadir flag to point Nmap to alternate support files.

==Target Specification==
All of these formats will scan the same class B network:

Wildcards: 192.168.*.*
Range: 192.168.0-255.0-255
Mask Notation: 192.168.0.0/16

==Common Options==
-sS TCP SYN Scan
-sT TCP connect() scan
-sU UDP port scans (not very reliable)
-v Verbose output
-vv Very verbose output
-O Detect Operating system (TCP/IP fingerprinting)
-sV Service version detection
-P0 Don't ping, just scan
-A Agressive: same thing as -O -sV
-T Scan timing
-p Choose ports to be scanned
-F Fast Scan: only scan ports in nmap-services file
-n Don't do reverse DNS lookup (increase scan speed)

==nmap References==

Auditor CD?

*[http://www.nmap-tutorial.com/ Nmap-Tutorial.com]
*[http://www.irongeek.com/i.php?page=videos/nmap1 IronGeek: Basic Nmap Usage (video slide show)]
*[http://www.irongeek.com/i.php?page=videos/nmap2 IronGeek: Nmap Video Tutorial 2: Port Scan Boogaloo (video slide show)]
*[http://insecure.org/nmap/man/ nmap Reference guide]

*[http://members.dodo.net.au/~ps2man/Nmap/nmap.html A-SEC Lesson 2 Nmap and other Network Scanning Techniques]
*[http://neworder.box.sk/newsread.php?newsid=1583 Yet Another Nmap Tutorial]
*[http://www.irongeek.com/i.php?page=security/ipinfo What can you find out from an IP?]

* nmap-tutorial - http://nmap.org/bennieston-tutorial/
* Port Scanning Techniques - http://nmap.org/book/man-port-scanning-techniques.html
* Nmap: The Art of Port Scanning - http://nmap.org/nmap_doc.html
* Timing and Performance - http://nmap.org/book/man-performance.html
* http://www.derkeiler.com/Mailing-Lists/securityfocus/security-basics/2007-04/msg00386.html

* Top 30 Nmap Command Examples For Sys/Network Admins - http://www.cyberciti.biz/networking/nmap-command-examples-tutorials/

Nmap - Revision history

Kenneth at 22:25, 29 January 2019