[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-1-en-105":3,"doc-seo-571410-105":53,"doc-detail-571410-en":127},{"code":4,"msg":5,"data":6},0,"success",[7,14,19,24,29,34,39,44,49],{"id":8,"doc_module":9,"doc_module_name":10,"category_name":11,"show_sort_weight":12,"slug":13},11,1,"Template","Presentations",90,"presentations",{"id":15,"doc_module":9,"doc_module_name":10,"category_name":16,"show_sort_weight":17,"slug":18},12,"Resumes",80,"resumes",{"id":20,"doc_module":9,"doc_module_name":10,"category_name":21,"show_sort_weight":22,"slug":23},14,"Invoices",70,"invoices",{"id":25,"doc_module":9,"doc_module_name":10,"category_name":26,"show_sort_weight":27,"slug":28},15,"Posters",60,"posters",{"id":30,"doc_module":9,"doc_module_name":10,"category_name":31,"show_sort_weight":32,"slug":33},16,"Social Media",50,"social-media",{"id":35,"doc_module":9,"doc_module_name":10,"category_name":36,"show_sort_weight":37,"slug":38},17,"Forms",40,"forms",{"id":40,"doc_module":9,"doc_module_name":10,"category_name":41,"show_sort_weight":42,"slug":43},18,"Letters",30,"letters",{"id":45,"doc_module":9,"doc_module_name":10,"category_name":46,"show_sort_weight":47,"slug":48},21,"Paper Templates",5,"papers-templates",{"id":50,"doc_module":9,"doc_module_name":10,"category_name":51,"show_sort_weight":4,"slug":52},158,"General","general-158",{"code":4,"msg":54,"data":55},"ok",{"site_id":56,"language":57,"slug":58,"title":59,"keywords":60,"description":61,"schema_data":62,"social_meta":120,"head_meta":122,"extra_data":124,"updated_unix":126},105,"en","nmap-cheat-sheet-v10-pocket-reference-guide","Nmap Cheat Sheet - v1.0 - Pocket Reference Guide","","Compact pocket reference guide for using Nmap, covering scripting engine basics, key NSE script categories, and notable example scripts. Includes base scan syntax, target specification formats (IPv4, IPv6, hostnames, ranges, CIDR, and target lists), port selection options, probing options, common scan types, and timing controls from fine-grained to aggregate profiles. Also documents output formats and various miscellaneous flags to tune discovery, detection, and reporting.",{"@graph":63,"@context":119},[64,80,102],{"@type":65,"itemListElement":66},"BreadcrumbList",[67,71,74,77],{"item":68,"name":69,"@type":70,"position":9},"https://docshare.wps.com","Home","ListItem",{"item":72,"name":10,"@type":70,"position":73},"https://docshare.wps.com/template/",2,{"item":75,"name":51,"@type":70,"position":76},"https://docshare.wps.com/template/general/",3,{"item":78,"name":59,"@type":70,"position":79},"https://docshare.wps.com/template/nmap-cheat-sheet-v10-pocket-reference-guide/571410/",4,{"url":78,"name":59,"@type":81,"image":82,"author":87,"headline":59,"publisher":90,"fileFormat":93,"inLanguage":57,"description":61,"dateModified":94,"datePublished":95,"encodingFormat":93,"isAccessibleForFree":96,"interactionStatistic":97},"DigitalDocument",{"url":83,"@type":84,"width":85,"height":86},"https://docshare.wps.com/thumbnails/nmap-cheat-sheet-v10-pocket-reference-guide/571410.png","ImageObject",442,249,{"name":88,"@type":89},"Sophia Brooks","Person",{"url":68,"name":91,"@type":92},"DocShare","Organization","application/pdf","2026-10-27","2026-10-13",true,{"@type":98,"interactionType":99,"userInteractionCount":101},"InteractionCounter",{"@type":100},"ViewAction",8,{"@type":103,"mainEntity":104},"FAQPage",[105,111,115],{"name":106,"@type":107,"acceptedAnswer":108},"How do I run Nmap with the scripting engine (NSE) default scripts and script selection?","Question",{"text":109,"@type":110},"Use -sC to run default scripts, or --script=\u003CScriptName> to run individual scripts. You can also run script groups and provide arguments via --script-args=\u003CName1=Value1,...>.","Answer",{"name":112,"@type":107,"acceptedAnswer":113},"What are common NSE script categories and what do they mean?",{"text":114,"@type":110},"Nmap NSE categories include auth (credentials/authentication handling), broadcast (network host discovery), brute (password guessing), discovery (information gathering), dos (denial of service risk), exploit (attempt exploitation), safe (non-impacting behavior), version (software/protocol version measurement), and vul (known vulnerability checks).",{"name":116,"@type":107,"acceptedAnswer":117},"Which Nmap options control scan targets, ports, and timing?",{"text":118,"@type":110},"Use target specification formats for IPv4/IPv6/hostnames, ranges, CIDR, or -iL for a target file. Choose ports with -F or -p\u003Cports>, and control timing with fine-grained options like --min-rtt-timeout and --max-retries, or aggregate -T0 through -T5 profiles for different speed and detection behavior.","https://schema.org",{"og:url":78,"og:type":121,"og:title":59,"og:site_name":91,"og:description":61},"article",{"robots":123,"canonical":78},"index,follow",{"doc_id":125,"site_id":56},571410,1792087339,{"code":4,"msg":5,"data":128},{"doc_id":125,"user_id":129,"nickname":88,"user_avatar":130,"doc_module":9,"category_id":50,"category_name":51,"doc_title":59,"doc_description":61,"doc_content":131,"file_id":132,"file_url":133,"file_type":134,"file_size":135,"view_count":101,"is_deleted":4,"is_public":9,"is_downloadable":9,"audit_status":9,"page_count":73,"language":136,"language_code":57,"site_id":56,"html_lang":57,"table_of_contents":137,"faqs":138,"seo_title":139,"seo_description":61,"update_tm":140,"read_time":9},962084925636,"https://ap-avatar.wpscdn.com/davatar_994ba38a5ba835b3df7d355c54d3ed8d","| Scripting Engine |\n| --- |\n| -sC Run default scripts--script=\u003CScriptName>|\u003CScriptCategory>|\u003CScriptDir> . . .\u003Cbr>Run individual or groups of scripts\u003Cbr>--script-args=\u003CName1=Value1, . . .>\u003Cbr>Use the list of script arguments\u003Cbr>--script-updatedb\u003Cbr>Update script database |\n\n\n| Script Categories |\n| --- |\n| Nmap's script categories include, but are not limited to, the following:\u003Cbr>auth: Utilize credentials or bypass authentication on target hosts.\u003Cbr>broadcast: Discover hosts not included on command line by broadcasting on local network.\u003Cbr>brute: Attempt to guess passwords on target systems, for a variety of protocols, including [http](http), SNMP, IAX, MySQL, VNC, etc.\u003Cbr>default: Scripts run automatically when-sC or-A are used. discovery: Try to learn more information about target hosts through public sources of information, SNMP, directory services, and more.\u003Cbr>dos: May cause denial of service conditions in target hosts.\u003Cbr>exploit: Attempt to exploit target systems.\u003Cbr>external: Interact with third-party systems not included in target list.\u003Cbr>fuzzer: Send unexpected input in network protocol fields. intrusive: May crash target, consume excessive resources, or otherwise impact target machines in a malicious fashion. malware: Look for signs of malware infection on the target hosts.\u003Cbr>safe: Designed not to impact target in a negative fashion. version: Measure the version of software or protocol spoken by target hosts.\u003Cbr>vul: Measure whether target systems have a known vulnerability. |\n\n\n| Notable Scripts |\n| --- |\n| A full list of Nmap Scripting Engine scripts is available at [http://nmap.org/nsedoc/](http://nmap.org/nsedoc/)\u003Cbr>[Some particularly useful scripts include:](Some particularly useful scripts include:)\u003Cbr>[dns-zone-transfer:](dns-zone-transfer: Attempts to pull a zone file)[ Attempts to pull a zone file](dns-zone-transfer: Attempts to pull a zone file)[ ](dns-zone-transfer: Attempts to pull a zone file)(AXFR) from a DNS server.\u003Cbr>$ nmap--script dns-zone\u003Cbr>transfer .nse--script-args dns-zone\u003Cbr>transfer .domain=\u003Cdomain> -p53 \u003Chosts>\u003Cbr>[http-robots.txt:](http-robots.txt: Harvests)[ Harvests](http-robots.txt: Harvests) robots.txt files from discovered web servers.\u003Cbr>$ nmap--script [http-robots.txt](http-robots.txt)[ ](http-robots.txt)\u003Chosts>\u003Cbr>smb-brute: Attempts to determine valid username and password combinations via automated guessing.\u003Cbr>$ nmap--script smb-brute .nse -p445 \u003Chosts>\u003Cbr>smb-psexec: Attempts to run a series of programs on the target machine, using credentials provided as scriptargs.\u003Cbr>$ nmap --script smb-psexec .nse – script-args=smbuser=\u003Cusername>, smbpass=\u003Cpassword>[,config=\u003Cconfig>]\u003Cbr>-p445 \u003Chosts> |\n\nNmap Cheat Sheet  \nv1 . 0  \nPOCKET REFERENCE GUIDE SANS Institute  \n[http://www.sans.org](http://www.sans.org)  \n\n| Base Syntax |\n| --- |\n|  |\n| \\# nmap [ScanType] [Options] {targets} |\n\n\n| Target Specification |\n| --- |\n|  |\n| IPv4 address: [192.168.1.1](192.168.1.1)\u003Cbr>IPv6 address: AABB:CCDD::FF%eth0\u003Cbr>Host name: [www.target.tgt](www.target.tgt)\u003Cbr>IP address range: 192.168.0-255.0-255\u003Cbr>CIDR block: 192 .168 .0 .0/16\u003Cbr>Use file with lists of targets: -iL \u003Cfilename> |\n\n\n| Target Ports |\n| --- |\n| No port range specified scans 1,000 most popular ports\u003Cbr>-F Scan 100 most popular ports\u003Cbr>-p\u003Cport1>-\u003Cport2> Port range\u003Cbr>-p\u003Cport1>,\u003Cport2>, . . . Port List\u003Cbr>-pU:53,U:110,T20-445 Mix TCP and UDP\u003Cbr>-r Scan linearly (do not randomize ports)--top-ports \u003Cn> Scan n most popular ports\u003Cbr>-p-65535 Leaving off initial port in range makes Nmap scan start at port 1\u003Cbr>-p0- Leaving off end port in range makes Nmap scan through port 65535\u003Cbr>-p- Scan ports 1-65535 |\n\n\n| Probing Options |\n| --- |\n| -Pn Don't probe (assume all hosts are up)\u003Cbr>-PB Default probe (TCP 80, 445 & ICMP)\u003Cbr>-PS\u003Cportlist>\u003Cbr>Check whether targets are up by probing TCP ports\u003Cbr>-PE Use ICMP Echo Request\u003Cbr>-PP Use ICMP Timestamp Request\u003Cbr>-PM Use ICMP Netmask Request |\n\n\n| Scan Types |\n| --- |\n| -sP Probe only (host discov","cbCaiq5bELmo0DQw","https://ap.wps.com/l/cbCaiq5bELmo0DQw","pdf",198045,"English","# Nmap Scripting Engine\n## Script Categories\n## Notable Scripts\n# Base Syntax\n# Target Specification\n# Target Ports\n# Probing Options\n# Scan Types\n# Fine-Grained Timing Options\n# Aggregate Timing Options\n# Output Formats\n# Misc Options","[{\"question\":\"How do I run Nmap with the scripting engine (NSE) default scripts and script selection?\",\"answer\":\"Use -sC to run default scripts, or --script=\\u003cScriptName\\u003e to run individual scripts. You can also run script groups and provide arguments via --script-args=\\u003cName1=Value1,...\\u003e.\"},{\"question\":\"What are common NSE script categories and what do they mean?\",\"answer\":\"Nmap NSE categories include auth (credentials/authentication handling), broadcast (network host discovery), brute (password guessing), discovery (information gathering), dos (denial of service risk), exploit (attempt exploitation), safe (non-impacting behavior), version (software/protocol version measurement), and vul (known vulnerability checks).\"},{\"question\":\"Which Nmap options control scan targets, ports, and timing?\",\"answer\":\"Use target specification formats for IPv4/IPv6/hostnames, ranges, CIDR, or -iL for a target file. Choose ports with -F or -p\\u003cports\\u003e, and control timing with fine-grained options like --min-rtt-timeout and --max-retries, or aggregate -T0 through -T5 profiles for different speed and detection behavior.\"}]","Nmap Cheat Sheet - v1.0 - Pocket Reference Guide | PDF",1791916238]