Options Nmap

Nmap (Network Mapper) is a powerful open-source tool used for network
discovery and security auditing. It offers a wide range of options for scanning
hosts, ports, and services. Below is a list of common Nmap scan types and
other important options available in Nmap:
Scan Types:
1. -sS: SYN Scan (Stealth Scan)
o This is the most popular scan type because it is fast and stealthy.
It works by sending SYN packets (part of the TCP handshake) and
analyzing the response.
2. -sT: TCP Connect Scan
o This scan completes the TCP handshake, making it easy to

detect, but useful when SYN scan is not possible (e.g., behind
certain firewalls).
3. -sA: ACK Scan
o Used to determine the presence of a firewall and whether it is

stateful or stateless by sending ACK packets and analyzing the
response.
4. -sW: Window Scan
o A TCP scan that uses the TCP window size to determine the state
of the port. It is useful for stealth scanning but is less commonly
used.
5. -sM: Maimon Scan
o A scan that sends FIN/ACK packets to try to bypass some

firewalls and packet filters.
6. -sF: FIN Scan
o Sends FIN packets to the target and works by exploiting the fact
that closed ports will respond with an RST (reset) packet.
7. -sX: Xmas Scan
o Sends a packet with the FIN, PSH, and URG flags set. Some
firewalls will let the packet through, while others will drop it or
generate unusual responses.
8. -sN: NULL Scan

o Sends a packet with no flags set. This is a stealth scan because it
does not send any TCP flags.
9. -sI: Idle Scan
o A stealth scan that uses a third-party machine to send packets to

the target and measure response times. This can make it very
difficult to trace back to the attacker.
10. -sL: List Scan
o This scan does not actually send any packets to the target; it
only resolves hostnames for the given IP addresses.
11. -sU: UDP Scan
o Scans for open UDP ports. Since UDP is connectionless, it is less

reliable than TCP scans.
12. -sY: SCTP INIT Scan
o Performs a scan to identify open ports using the SCTP protocol

(Stream Control Transmission Protocol).
13. -sZ: SCTP COOKIE ECHO Scan
o Similar to the -sY scan but specifically uses SCTP COOKIE ECHO
message for scanning.
Other Important Nmap Options:
Target Specification:
 -p: Specifies which ports to scan (e.g., -p 80 for port 80, -p 1-1000 for
ports 1 through 1000, -p U:53,T:80 for UDP port 53 and TCP port 80).
 -T: Timing template, controls the speed of the scan (e.g., -T4 for faster
scans).
 -iL: Input from a file with a list of targets.
 -iR: Random target scan (randomly selects hosts to scan).
 -Pn: Skip host discovery and treat all targets as online (useful when
ICMP is blocked).
 -oN: Output to a file in normal format.
 -oX: Output in XML format.

 -oG: Output in "grepable" format.
Service and Version Detection:
 -sV: Service version detection (finds the versions of services running

on open ports).
 -A: Enable OS detection, version detection, script scanning, and

traceroute (aggressive scan).
 -O: OS detection.
 -b: FTP bounce scan (uses a third-party machine to scan the target).
Firewall Evasion and Spoofing:
 -D: Decoy scan (uses multiple decoys to disguise the real source of the
scan).
 -S: Spoof source address.
 -g: Use a specific source port for the scan.
 -f: Fragment packets to evade packet filters.
 --mtu: Set the MTU (Maximum Transmission Unit) for packet

fragmentation.
Nmap Scripting Engine (NSE):
 --script: Specify a script or a category of scripts to use (e.g., --

script=http-enum).
 --script-args: Provide arguments to Nmap scripts.
 --script-help: Get help on a specific script.
Additional Options:
 -v: Enable verbose output.
 -d: Debugging output (increases verbosity).
 --reason: Show the reason a port is in a particular state.
 --open: Show only open ports in the output.
 --traceroute: Perform a traceroute to the target.
 --version-all: Enable detection of all possible versions.

Timing and Performance:
 -T0 to -T5: Timing templates that control the speed and stealth of the
scan. T0 is the slowest and stealthiest, while T5 is the fastest and
most aggressive.
 --min-rate: Set the minimum packet send rate.
 --max-rate: Set the maximum packet send rate.
Operating System and Network Information:
 -O: OS detection (tries to detect the operating system).
 --traceroute: Traces the route packets take to the target.
Example Commands:
 Basic SYN scan: nmap -sS 192.168.1.1
 Service version detection: nmap -sV 192.168.1.1
 Aggressive scan: nmap -A 192.168.1.1
 Scan a range of ports: nmap -p 1-1000 192.168.1.1
 Scan multiple IPs from a file: nmap -iL targets.txt
Conclusion:
Nmap offers a wide array of options for different types of scanning, from
basic port scanning to advanced techniques such as OS detection, service
version detection, and evading firewalls. The options above should give you
a comprehensive understanding of what can be done with Nmap.

Options Nmap

Uploaded by

Copyright:

Available Formats

Options Nmap

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Options Nmap

Uploaded by

Copyright:

Available Formats

Nmap (Network Mapper) is a powerful open-source tool used for network

1. -sS: SYN Scan (Stealth Scan)

2. -sT: TCP Connect Scan

o This scan completes the TCP handshake, making it easy to

3. -sA: ACK Scan

o Used to determine the presence of a firewall and whether it is

4. -sW: Window Scan

5. -sM: Maimon Scan

o A scan that sends FIN/ACK packets to try to bypass some

6. -sF: FIN Scan

7. -sX: Xmas Scan

8. -sN: NULL Scan

9. -sI: Idle Scan

o A stealth scan that uses a third-party machine to send packets to

10. -sL: List Scan

11. -sU: UDP Scan

o Scans for open UDP ports. Since UDP is connectionless, it is less

12. -sY: SCTP INIT Scan

o Performs a scan to identify open ports using the SCTP protocol

13. -sZ: SCTP COOKIE ECHO Scan

Other Important Nmap Options:

 -iL: Input from a file with a list of targets.

 -iR: Random target scan (randomly selects hosts to scan).

 -oN: Output to a file in normal format.

 -oX: Output in XML format.

Service and Version Detection:

 -sV: Service version detection (finds the versions of services running

 -A: Enable OS detection, version detection, script scanning, and

Firewall Evasion and Spoofing:

 -S: Spoof source address.

 -g: Use a specific source port for the scan.

 -f: Fragment packets to evade packet filters.

 --mtu: Set the MTU (Maximum Transmission Unit) for packet

Nmap Scripting Engine (NSE):

 --script: Specify a script or a category of scripts to use (e.g., --

 --script-args: Provide arguments to Nmap scripts.

 --script-help: Get help on a specific script.

 -v: Enable verbose output.

 -d: Debugging output (increases verbosity).

 --reason: Show the reason a port is in a particular state.

 --open: Show only open ports in the output.

 --traceroute: Perform a traceroute to the target.

 --version-all: Enable detection of all possible versions.

 --min-rate: Set the minimum packet send rate.

 --max-rate: Set the maximum packet send rate.

Operating System and Network Information:

 -O: OS detection (tries to detect the operating system).

 --traceroute: Traces the route packets take to the target.

 Basic SYN scan: nmap -sS 192.168.1.1

 Service version detection: nmap -sV 192.168.1.1

 Aggressive scan: nmap -A 192.168.1.1

 Scan a range of ports: nmap -p 1-1000 192.168.1.1

 Scan multiple IPs from a file: nmap -iL targets.txt

You might also like

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.