CS - Nmap

---

Basic Command Structure :

nmap <scan types> <options> <target>

• There are a lot of available scan types.

---

Basic Scans

TCP connect scan

nmap -sT {{ip}}

SYN scan

sudo nmap -sS {{ip}}

If ran without sudo it will be behaving like TCP connect scan instead.

UDP scan

sudo nmap -sU {{ip}}

Merging UDP and TCP syn scan

sudo nmap -sU -sS {{ip}}

OS fingerprinting

sudo nmap -O {{ip}} --osscan-guess

---

HOST Discovery

Scan IP range for online hosts

nmap -sn {{ip_address_range}}

It do more than just sending an ICMP echo request. Nmap also sends a TCP SYN packet to port 443, a TCP ACK packet to port 80, and an ICMP timestamp request to verify whether a host is available.

One liner to display active host IP

sudo nmap -v -sn {{ip_addr_range}} -oG ping-sweep.txt ; grep Up ping-sweep.txt | cut -d " " -f 2

Display machine with open port 80

sudo nmap -p 80 {{ip_addr_range}} -oG web-sweep.txt; grep Up web-sweep.txt | cut -d " " -f 2

Scan top 20 ports of ip-range

nmap -sT -A --top-ports=20 {{ip_addr_Range}} -oG top-port-sweep.txt

---

nmap -sT -A {{ip}}

nmap --script http-headers {{ip}}

nmap --script-help http-headers

---

Caution

Banners can be modified by system administrators and intentionally set to fake service names to mislead potential attackers.