Become an Nmap pro in 30s 👇🕥 Nmap is a port scanner, but it does...
Luke Stephens (hakluke)@hakluke
18 views
Aug 24, 2026
~3 min read
Advertisement
1
Become an Nmap pro in 30s 👇🕥
Nmap is a port scanner, but it does much more including service/OS detection and even vuln scanning.
By default nmap does a standard TCP SYN scan on the top 1000 ports of host.
$ nmap host
For more verbosity use -v or -vv.
$ nmap -vv host
👇
Nmap is a port scanner, but it does much more including service/OS detection and even vuln scanning.
By default nmap does a standard TCP SYN scan on the top 1000 ports of host.
$ nmap host
For more verbosity use -v or -vv.
$ nmap -vv host
👇
2
Nmap accept hostnames, IP addresses, CIDR ranges and dash notation.
$ nmap hostname
$ nmap 123.123.123.123
$ nmap 123.123.123.1/24
$ nmap 123.123.123.1-255
If you just want to find which hosts are alive, you can perform a ping scan with -sn
$ nmap -sn 123.123.123.1/24
$ nmap hostname
$ nmap 123.123.123.123
$ nmap 123.123.123.1/24
$ nmap 123.123.123.1-255
If you just want to find which hosts are alive, you can perform a ping scan with -sn
$ nmap -sn 123.123.123.1/24
3
Sometimes, hosts don't respond to ping (or you are not root). To skip ping checks and just scan the host ports anyway, use -Pn:
$ nmap -Pn host
To scan a list of hosts from a file, use -iL:
$ nmap -iL ./hosts.txt
$ nmap -Pn host
To scan a list of hosts from a file, use -iL:
$ nmap -iL ./hosts.txt
4
There are 9 scan types. The main 2 that you will use are:
TCP SYN (-sS)
UDP (-sU)
Default is SYN. To scan UDP ports use -sU. Other scan types can be useful for stealth or probing firewalls but may sacrifice accuracy or speed.
More about scan types here: nmap.org/book/man-port-…
TCP SYN (-sS)
UDP (-sU)
Default is SYN. To scan UDP ports use -sU. Other scan types can be useful for stealth or probing firewalls but may sacrifice accuracy or speed.
More about scan types here: nmap.org/book/man-port-…
5
You can specify which ports to scan with -p.
To scan ports 1-5000:
$ nmap -p 1-5000 host
To scan all 65535 ports, you can use -p-
You can also specify a comma separated list with single ports, ranges and specific UDP ports:
$ nmap -p 23,23,25,110,80-90,U:53,1000-2000
To scan ports 1-5000:
$ nmap -p 1-5000 host
To scan all 65535 ports, you can use -p-
You can also specify a comma separated list with single ports, ranges and specific UDP ports:
$ nmap -p 23,23,25,110,80-90,U:53,1000-2000
6
When nmap finds an open port it can probe it to discover what service it is running by using -sV. You can set how intense you want the probes to be from 0 (light probe, fast but not accurate) to 9 (try all probes, slow but accurate)
$ nmap -sV --version-intensity 9
$ nmap -sV --version-intensity 9
7
Nmap can guess which operating system a host is running based the scan results. Enable with -O:
$ nmap -O host
It also has extensive firewall evasion functionality. I've never used them but they allow you to do some cool things including spoofing the source address.
$ nmap -O host
It also has extensive firewall evasion functionality. I've never used them but they allow you to do some cool things including spoofing the source address.
8
Nmap offers many output formats. Some are better for humans to read, others are better for parsing into other tools. I tend to output scans into all formats using:
$ nmap -oA outputfile host
Specific options include:
-oN Normal
-oX XML
-oS scr1pt k1dd13
-oG greppable
$ nmap -oA outputfile host
Specific options include:
-oN Normal
-oX XML
-oS scr1pt k1dd13
-oG greppable
9
You can also adjust the speed that nmap scans at. using -T<0-5>. A higher number means a higher speed.
Higher speed means less accuracy, and vice versa.
$ nmap -T3 host
Higher speed means less accuracy, and vice versa.
$ nmap -T3 host
10
This is where nmap gets REALLY interesting! It can also run Lua scripts. These can do pretty much anything. Nmap comes with about 600 of them that perform various vuln scanning and enumeration tasks, but you can also code your own.
Location: <nmap directory>/share/nmap/scripts/*
Location: <nmap directory>/share/nmap/scripts/*
11
You can also find them by running:
$ locate *.nse
For example, to check if a host is vulnerable to Eternal Blue, you could run:
$ nmap --script=smb-vuln-cve-2017-7494 host
Some scripts require arguments, you can specify them with --script-args=n1=v1,n2=v2 etc.
$ locate *.nse
For example, to check if a host is vulnerable to Eternal Blue, you could run:
$ nmap --script=smb-vuln-cve-2017-7494 host
Some scripts require arguments, you can specify them with --script-args=n1=v1,n2=v2 etc.
12
To get help on which arguments may be accepted by a script:
$ nmap --script-help=scriptname
To upgrade your scripts to the latest and greatest, just run:
$ nmap --script-updatedb
$ nmap --script-help=scriptname
To upgrade your scripts to the latest and greatest, just run:
$ nmap --script-updatedb
13
A helpful alias is -A, which will enable OS detection, service version detection, script scanning, and traceroute.
$ nmap -A host
For a thorough scan of a single host, a decent go-to command is: $ nmap -A -p- -v host
$ nmap -A host
For a thorough scan of a single host, a decent go-to command is: $ nmap -A -p- -v host
14
Our of curiousity, which port scanner do you find yourself using the most?
15
If you want content like this produced for your cybersecurity org, check out HackerContent.
We write blogs and manage social media platforms, specifically for cybersecurity orgs!
hackercontent.com
We write blogs and manage social media platforms, specifically for cybersecurity orgs!
hackercontent.com
16