Nmap Cheatsheet

Common Recipes

Use this Nmap reference while you build software engineering projects, review code, or refresh the syntax you reach for most.

The five scans that cover most work

# 1. what is alive on this subnet
sudo nmap -sn 10.0.0.0/24

# 2. quick look at one host, top 1000 TCP ports with versions
sudo nmap -sV -T4 --open 10.0.0.5

# 3. every TCP port, fast, then version-scan only what answered
sudo nmap -p- --min-rate 1000 -oG all.gnmap 10.0.0.5
sudo nmap -sV -sC -p "$(awk -F'Ports: ' '/Ports:/{print $2}' all.gnmap \
  | tr ',' '\n' | awk -F'/' '/open/{print $1}' | paste -sd, -)" 10.0.0.5

# 4. the everything scan on one target
sudo nmap -A -T4 -p- -oA full-10.0.0.5 10.0.0.5

# 5. the common UDP services, because full UDP takes hours
sudo nmap -sU --top-ports 100 -T4 10.0.0.5

Recipe 3 is the workhorse pattern. A bare -sS -p- finishes in minutes because it only sends one packet per port, and the expensive work (-sV -sC) then runs against ten ports instead of 65,535.

Recipe table

Goal	Command
Live hosts, no port scan	`sudo nmap -sn 10.0.0.0/24`
Live hosts, skip discovery	`sudo nmap -Pn -p 80,443 10.0.0.0/24`
Fast top-100 sweep	`sudo nmap -F --open 10.0.0.0/24`
All TCP ports on one host	`sudo nmap -p- 10.0.0.5`
Service and version detail	`sudo nmap -sV 10.0.0.5`
Aggressive, everything on	`sudo nmap -A 10.0.0.5`
OS guess	`sudo nmap -O --osscan-guess 10.0.0.5`
Default safe scripts	`sudo nmap -sC 10.0.0.5`
Web app surface	`sudo nmap -p 80,443,8080,8443 --script http-enum,http-title 10.0.0.5`
TLS configuration	`sudo nmap -p 443 --script ssl-enum-ciphers,ssl-cert 10.0.0.5`
SMB detail	`sudo nmap -p 139,445 --script smb-os-discovery,smb-protocols 10.0.0.5`
Known-vuln check	`sudo nmap -sV --script vuln 10.0.0.5`
Common UDP	`sudo nmap -sU --top-ports 100 10.0.0.5`
IPv6 target	`sudo nmap -6 -sV 2001:db8::5`
From a target list	`sudo nmap -iL hosts.txt -oA batch`
Scan without root	`nmap -sT -Pn --top-ports 200 10.0.0.5`
Firewall rule mapping	`sudo nmap -sA -p 1-1000 10.0.0.5`
Quiet and slow	`sudo nmap -sS -T2 -f --top-ports 50 10.0.0.5`
Change detection	`sudo nmap -sV -oX now.xml 10.0.0.0/24 && ndiff prev.xml now.xml`

Discovery on a network you just joined

ip -br addr                                   # find your subnet first
sudo nmap -sn -n 10.0.0.0/24 -oG hosts.gnmap  # ARP sweep, seconds on a LAN
awk '/Up$/{print $2}' hosts.gnmap > live.txt

sudo nmap -iL live.txt -F --open -oA quick    # top 100 ports across live hosts
sudo nmap -iL live.txt -sV -sC --top-ports 200 --open -oA detail

Step	Why
`ip -br addr`	scan the right range, not a guess
`-sn -n`	ARP is fast and skips reverse DNS latency
Build `live.txt`	later scans hit 12 hosts, not 254
`-F --open`	one screen of signal per host
`-sV -sC` last	the slow work runs on a short list

Single-host deep dive

T=10.0.0.5
sudo nmap -Pn -p- --min-rate 1000 -oA "$T-ports" "$T"
PORTS=$(awk -F'Ports: ' '/Ports:/{print $2}' "$T-ports.gnmap" \
  | tr ',' '\n' | awk -F'/' '/open/{print $1}' | paste -sd, -)
sudo nmap -Pn -sV -sC -O -p "$PORTS" -oA "$T-deep" "$T"
sudo nmap -Pn -sU --top-ports 50 -oA "$T-udp" "$T"

Three passes, in the right order: find the ports, interrogate the ports, then check the handful of UDP services that matter. Each pass writes its own -oA set, so nothing gets re-run when you come back to the notes.

Web and TLS specifics

# what is served, and where
sudo nmap -p 80,443,8000,8080,8443 --script http-title,http-headers,http-methods 10.0.0.5

# hidden paths and known app fingerprints
sudo nmap -p 443 --script http-enum --script-args http.useragent='Mozilla/5.0' 10.0.0.5

# certificate and cipher posture, the two questions auditors ask
sudo nmap -p 443 --script ssl-cert,ssl-enum-ciphers 10.0.0.5

# name-based virtual hosts on shared IPs
sudo nmap -p 443 --script ssl-cert 10.0.0.5 | grep -E 'Subject|DNS:'

Script	Answers
`http-title`	is this a login page, an API, or a default install
`http-headers`	server software, framework hints, missing security headers
`http-methods`	is `PUT` or `TRACE` still enabled
`http-enum`	common admin paths and known app signatures
`ssl-cert`	issuer, expiry, and every name on the certificate
`ssl-enum-ciphers`	protocol versions and a per-suite letter grade

Defensive and inventory use

Nmap earns most of its hours on the blue side, answering "what is actually listening" rather than "how do I get in".

# weekly inventory, diffed against last week
sudo nmap -sV -O --top-ports 1000 --noninteractive \
  -oX /var/lib/scans/$(date +%F).xml 10.0.0.0/16
ndiff /var/lib/scans/last.xml /var/lib/scans/$(date +%F).xml

# verify a firewall change did what the ticket said
sudo nmap -Pn -p 22,80,443,3306 --reason 10.0.0.5

# confirm a service is bound where you think it is
sudo nmap -p 5432 --open 10.0.0.0/24        # any stray Postgres on the LAN

# find hosts still speaking old TLS
sudo nmap -p 443 --script ssl-enum-ciphers 10.0.0.0/24 \
  | grep -B5 -E 'TLSv1\.0|SSLv3'

Question	Recipe
Did the firewall change land	`-Pn --reason` on the exact ports
What changed since last week	two `-oX` runs plus `ndiff`
Is a database exposed to the LAN	`-p 5432,3306,27017,6379 --open` on the subnet
Which hosts allow weak TLS	`--script ssl-enum-ciphers` across the range
Is anything unexpected listening	`-p-` on your own hosts, compared to a baseline

Habits worth keeping

Habit	Reason
`-oA <dated-basename>` on every real scan	XML for tooling, normal for `--resume`, grepable for shell work
`--open` on anything wider than one host	closed ports drown the findings
`-n` when you do not need names	reverse DNS is often the slowest part of a sweep
`-Pn` when discovery is filtered	otherwise nmap declares live hosts down and skips them
Two-stage scans	cheap sweep first, expensive detection on the survivors
Sanity-check the range	a typo in a CIDR mask is how people scan someone else's network
Keep scope in writing	permission is the difference between an audit and an offence