Nmap Scanning Techniques

Basic Nmap Commands Overview

1. Basic Nmap Scan Command

  • Command: nmap <target>

  • Details:

    • Runs a default TCP SYN scan on the 1000 most common ports of the target IP or domain.

    • Checks the state of these ports:

    • open

    • closed

    • filtered

    • Purpose: Provides a quick overview of accessible ports.

2. Scan Specific Ports Command

  • Command: nmap -p <port1>,<port2>,... <target>

  • Details:

    • The -p option allows specification of exact ports to scan instead of the default 1000.

    • Ports can be listed:

    • Individually (e.g., -p 22,80,443)

    • As a combination of single ports and ranges (e.g., -p 22,80-100)

    • Purpose: Useful when specifically checking known services or limiting scan time.

3. Scan Port Range Command

  • Command: nmap -p <start_port>-<end_port> <target>

  • Details:

    • Scans all ports between specified start and end port numbers inclusively.

    • Example: -p 1-1000 scans the first 1000 ports.

    • Purpose: Useful for checking a continuous range instead of the default set.

4. Service Version Detection Command

  • Command: nmap -sV <target>

  • Details:

    • -sV enables version detection on open ports.

    • Nmap probes ports to gather information about the service and its version number (e.g., SSH, HTTP).

    • Purpose: Helps identify running software and discover specific vulnerabilities related to the version.

5. Operating System Detection Command

  • Command: nmap -O <target>

  • Details:

    • -O attempts to identify the operating system of the target using TCP/IP stack fingerprinting.

    • It sends specially crafted packets and analyzes responses.

    • Requirements: Requires root or administrator privileges on the scanning machine.

    • Purpose: Assists in tailoring attacks or checks based on the operating system.

Advanced Scanning Techniques

6. Aggressive Scan Command

  • Command: nmap -A <target>

  • Details:

    • -A enables multiple advanced features:

    • OS detection (-O)

    • Version detection (-sV)

    • Default script scanning (-sC)

    • Traceroute

    • Observations: Provides a comprehensive overview but is slower and more evident to Intrusion Detection Systems (IDS).

    • Purpose: Good for deep reconnaissance once a target is known.

7. Ping Scan (Host Discovery) Command

  • Command: nmap -sn <target>

  • Details:

    • -sn disables port scanning and only performs host discovery (ping sweep).

    • It checks if the host is online by sending ICMP echo requests or other probes.

    • Purpose: Useful for quickly identifying live machines in a network.

8. Scan All TCP Ports Command

  • Command: nmap -p- <target>

  • Details:

    • -p- instructs Nmap to scan all TCP ports from 1 to 65535 instead of the default 1000 ports.

    • Benefit: Provides a complete picture of all TCP services but requires more time.

    • Purpose: Important if you suspect services running on non-standard ports.

9. UDP Scan Command

  • Command: nmap -sU <target>

  • Details:

    • -sU performs a UDP port scan.

    • Consideration: UDP scanning is slower and less reliable than TCP since UDP is connectionless and does not respond if the port is open (no handshake).

    • Purpose: Useful for discovering UDP services like DNS, SNMP, or DHCP.

10. Scan with Default Scripts Command

  • Command: nmap -sC <target>

  • Details:

    • -sC runs the default Nmap Scripting Engine (NSE) scripts.

    • These scripts perform common checks such as:

    • Banner grabbing

    • Vulnerability detection

    • Purpose: Enhances the scan with automated checks beyond just port status.

Output and Miscellaneous Options

11. Verbose Mode Command

  • Command: nmap -v <target>

  • Details:

    • -v increases the verbosity level, enabling Nmap to output more information during the scanning process.

    • Purpose: Useful for understanding Nmap's actions step-by-step or troubleshooting.

12. Output Results to File Command

  • Command: nmap -oN <filename> <target>

  • Details:

    • -oN saves the scan results in a normal (human-readable) text file specified by <filename>.

    • Other output formats:

    • -oX for XML

    • -oG for grepable

    • Purpose: Useful for documentation or sharing results.

13. Example Combined Command

  • Command: nmap -A -p 22,80,443 -v <target>

  • Details:

    • Combines an aggressive scan (-A) with verbosity (-v) while limiting the ports scanned to 22, 80, and 443 (-p).

    • Purpose: Provides a balance between depth and speed by focusing on common service ports.

Additional Nmap Options

14. TCP SYN Scan (Stealth Scan) Command

  • Command: nmap -sS <target>

  • Details:

    • -sS performs a TCP SYN scan.

    • Sends SYN packets and analyzes responses without completing the TCP handshake.

    • Characteristics: Known as a “stealth” scan as it’s less likely to be logged by the target.

    • Default: Default scan type if run as root.

15. TCP Connect Scan Command

  • Command: nmap -sT <target>

  • Details:

    • -sT performs a full TCP connection (three-way handshake) scan.

    • Usage: Utilized if root privileges are not available since SYN scan requires raw packet privileges.

    • Consideration: Generally more detectable than the SYN scan.

16. UDP Scan with Port Specification Command

  • Command: nmap -sU -p <port> <target>

  • Details:

    • Combines UDP scanning (-sU) with a specific port or port range.

    • Purpose: Speeds up UDP scans by focusing on important ports.

17. Timing Templates Command

  • Command: nmap -T<0-5> <target>

  • Details:

    • Controls the speed and stealthiness of the scan.

    • Levels:

    • -T0: Slowest and stealthiest

    • -T5: Fastest but loud and more likely detected

    • Commonly used levels: -T3 (default) and -T4 (faster scan).

    • Purpose: Useful to adapt scan aggressiveness based on the environment.

18. Exclude Hosts Command

  • Command: nmap <target_range> --exclude <host1>,<host2>

  • Details:

    • Excludes specific hosts from scanning when working with ranges or subnets.

    • Purpose: Beneficial when scanning large networks but needing to skip certain IPs.

19. Scan IPv6 Targets Command

  • Command: nmap -6 <target>

  • Details:

    • Enables IPv6 scanning mode for targets with IPv6 addresses.

    • Importance: Increasingly vital as IPv6 adoption grows.

20. Scan with Custom Source Port Command

  • Command: nmap --source-port <port> <target>

  • Details:

    • Sets the source port for the scan packets.

    • Purpose: Sometimes used to bypass firewall rules that allow traffic from specific ports.

21. Use Decoys to Obscure Scan Origin Command

  • Command: nmap -D <decoy1,decoy2,...> <target>

  • Details:

    • Sends scan packets appearing to come from multiple IPs (decoys) to confuse logging systems.

    • Purpose: Useful for conducting stealth scans or evading detection, though can be noisy.

22. Fragment Packets Command

  • Command: nmap -f <target>

  • Details:

    • Sends fragmented packets to evade simple packet inspection firewalls.

    • Purpose: Can help bypass some IDS/IPS systems.

23. Scan Specific Interface Command

  • Command: nmap -e <interface> <target>

  • Details:

    • Specifies which network interface to use for scanning when multiple interfaces are available (e.g., eth0, wlan0).

24. Enable Firewall Evasion Techniques Command

  • Command: nmap --data-length <number> <target>

  • Details:

    • Adds random extra data to packets to evade basic packet filters.

25. Use a Specific NSE Script Command

  • Command: nmap --script <script_name> <target>

  • Details:

    • Runs a specific Nmap Scripting Engine script for checking specific vulnerabilities or gathering further information.

    • Example: --script http-enum enumerates HTTP services.

26. Disable DNS Resolution Command

  • Command: nmap -n <target>

  • Details:

    • Skips DNS resolution and scans IP addresses directly without resolving hostnames.

    • Purpose: Speeds up the scan and minimizes DNS-related noise.

27. Enable DNS Resolution Command

  • Command: nmap -R <target>

  • Details:

    • Forces reverse DNS resolution on all scanned IPs, even when scanning a range.

28. Send Custom TCP Flags Command

  • Command: nmap --scanflags <flags> <target>

  • Details:

    • Allows specification of custom TCP flags for packets (e.g., SYN, ACK, FIN).

    • Purpose: Useful for advanced scanning or evading firewalls.

29. Use IP Protocol Scan Command

  • Command: nmap -sO <target>

  • Details:

    • Scans which IP protocols (e.g., ICMP, TCP, UDP) are supported on the target.

    • Difference: Different from standard port scanning as it checks protocol availability.

30. List Targets without Scanning Command

  • Command: nmap --excludefile <file>

  • Details:

    • Reads from a file containing IPs to exclude from scanning.

    • Purpose: Useful for conducting large or automated scans.

31. Scan with Randomized Host Order Command

  • Command: nmap --randomize-hosts <target_range>

  • Details:

    • Scans hosts in random order to avoid detectable scanning patterns.

32. Timing and Performance Control Command

  • Commands:

    • nmap --min-rate <num>

    • nmap --max-rate <num>

  • Details:

    • Controls the minimum or maximum packet sending rate to regulate scan speed.

33. Use a Proxy for Scans Command

  • Command: nmap --proxies <proxy1,proxy2,...> <target>

  • Details:

    • Routes scan traffic through HTTP/SOCKS proxies for anonymization during scans.

34. Debug Output Command

  • Command: nmap -d <level> <target>

  • Details:

    • Enables debug output for troubleshooting scanning processes.

35. Scan IPv4 and IPv6 Simultaneously Command

  • Command: nmap -6 -4 <target>

  • Details:

    • Scans both IPv4 and IPv6 addresses if applicable.

36. Scan with a Spoofed MAC Address Command

  • Command: nmap --spoof-mac <MAC> <target>

  • Details:

    • Uses a fabricated MAC address to mask the scanning device’s identity.

37. Scan with Fragmentation and Timing Command

  • Command: nmap -f --mtu <size> <target>

  • Details:

    • Fragment packets into smaller MTU size packets for IDS evasion.

38. Scan Using SCTP INIT Scan Command

  • Command: nmap -sY <target>

  • Details:

    • Scans SCTP ports (Stream Control Transmission Protocol).

    • Note: Less common but relevant in certain environments.

39. Scan Using SCTP COOKIE-ECHO Scan Command

  • Command: nmap -sZ <target>

  • Details:

    • Alternate variant of SCTP scanning.

40. Script Scan Categories Command

  • Command: nmap --script <category>

  • Details:

    • Runs all scripts within a specified category (e.g., default, discovery, vuln, auth).

    • Purpose: Useful for narrowing down the types of scripts to run.

Final Note

  • This guide captures a wide array of Nmap commands and their descriptions; however, Nmap possesses hundreds of scripts and many options. The provided commands cover most typical and some advanced use cases.