nmap Cheat Sheet - Basic Scanning Techniques - Firewall Evasion Techniques - Version Detection - Nmap Scripting Engine

Oct 13, 2026

nmap Cheat Sheet consolidates practical guidance for using Nmap, covering basic scanning techniques such as single, multiple, list-based, range, subnet, and random host discovery, plus excluding targets and running aggressive scans. It also provides discovery options including ping-scan variants and host list creation. Further sections outline firewall evasion methods like fragmentation, decoys, idle zombie scans, source port selection, payload randomization, and MAC spoofing, alongside version detection and troubleshooting, output formats, statistics, and Ndiff comparisons. It closes with Nmap Scripting Engine usage, script category selection, troubleshooting, and script database updates.

LanguageEnglish

CategoryGeneral

FormatPDF

Pages3

Reading Time1 min

AccessFree to download

Basic Scanning Techniques

Discovery Options

Firewall Evasion Techniques

Version Detection

Output Options

Nmap Scripting Engine

References

nmap Cheat Sheet See-Security Technologies nmap Cheat Sheet Built by Yuval (tisf) Nativ from See-Security 's Hacking Defined Experts program This nmap cheat sheet is uniting a few other cheat sheets Basic Scanning Techniques | • Scan a single target | nmap | [target] | | --- | --- | --- | | • Scan multiple targets | nmap | [target1,target2,etc] | | • Scan a list of targets | nmap | -iL [list.txt] | | • Scan a range of hosts | nmap | [range of IP addresses] | | • Scan an entire subnet | nmap | [IP address/cdir] | | • Scan random hosts | nmap | -iR [number] | | • Excluding targets from a scan | nmap | [targets] –exclude [targets] | | • Excluding targets using a list | nmap | [targets] –excludefile [list.txt] | | • Perform an aggressive scan | nmap | -A [target] | | • Scan an IPv6 target | nmap | -6 [target] | | Discovery Options | | | • Perform a ping scan only • Don’t ping • TCP SYN Ping • TCP ACK ping • UDP ping • SCTP Init Ping • ICMP echo ping • ICMP Timestamp ping • ICMP address mask ping • IP protocol ping • ARP ping • Traceroute • Force reverse DNS resolution • Disable reverse DNS resolution • Alternative DNS lookup • Manually specify DNS servers • Create a host list nmap -sP [target] nmap -PN [target] nmap -PS [target] nmap -PA [target] nmap -PU [target] nmap -PY [target] nmap -PE [target] nmap -PP [target] nmap -PM [target] nmap -PO [target] nmap -PR [target] nmap –traceroute [target] nmap -R [target] nmap -n [target] nmap –system-dns [target] nmap –dns-servers [servers] [target] nmap -sL [targets] nmap Cheat Sheet See-Security Technologies Firewall Evasion Techniques | • Fragment packets | nmap | -f [target] | | --- | --- | --- | | • Specify a specific MTU | nmap | –mtu [MTU] [target] | | • Use a decoy | nmap | -D RND: [number] [target] | | • Idle zombie scan | nmap | -sI [zombie] [target] | | • Manually specify a source port | nmap | –source-port [port] [target] | | • Append random data | nmap | –data-length [size] [target] | | • Randomize target scan order | nmap | –randomize-hosts [target] | | • Spoof MAC Address | nmap | –spoof-mac [MAC|0|vendor] [target] | | • Send bad checksums
Version Detection | nmap | –badsum [target] | | • Operating system detection | | nmap -O [target] | | • Attempt to guess an unknown | | nmap -O –osscan-guess [target] | | • Service version detection | | nmap -sV [target] | | • Troubleshooting version scans | | nmap -sV –version-trace [target] | | • Perform a RPC scan
Output Options | | nmap -sR [target] | | • Save output to a text file | | nmap -oN [scan.txt] [target] | | • Save output to a xml file | | nmap -oX [scan.xml] [target] | | • Grepable output | | nmap -oG [scan.txt] [target] | | • Output all supported file types | | nmap -oA [path/filename] [target] | | • Periodically display statistics | | nmap –stats-every [time] [target] | | • 133t output
Ndiff | | nmap -oS [scan.txt] [target] | • Comparison using Ndiff ndiff [scan1.xml] [scan2.xml] • Ndiff verbose mode ndiff -v [scan1.xml] [scan2.xml] • XML output mode ndiff –xml [scan1.xm] [scan2.xml] nmap Cheat Sheet See-Security Technologies Nmap Scripting Engine • Execute individual scripts • Execute multiple scripts • Execute scripts by category • Execute multiple scripts categories • Troubleshoot scripts • Update the script database • Script categories ◦ all ◦ auth ◦ default ◦ discovery ◦ external ◦ intrusive ◦ malware ◦ safe ◦ vuln nmap –script [script.nse] [target] nmap –script [expression] [target] nmap –script [cat] [target] nmap –script [cat1 ,cat2 , etc] nmap –script [script] –script-trace [target] nmap –script-updatedb References • See-Security's main page • Hacking [Defined.org](Defined.org) • See-Security's Facebook Page • nmap Professional Discovery Guide • nmap's Official Web Page

FAQs

How can I scan a single target, multiple targets, or a list of targets in Nmap?

Use single-target syntax for one host, use comma-separated targets for multiple hosts, and use -iL with a list.txt file for targets read from a list.

What firewall-evasion options does the cheat sheet list?

It includes fragment packets (-f), specifying MTU, using a decoy (-D), idle zombie scan (-sI), manually setting a source port, appending random data, randomizing scan order, and spoofing the MAC address.

How do I run Nmap scripts using the Nmap Scripting Engine section?

Execute an individual script with --script [script.nse], run scripts by category with --script [cat], use multiple categories or expressions with --script, and enable tracing with --script-trace; update the script database with --script-updatedb.

Oct 13, 2026

Upload by Aria Callaghan