# Network Mapper (nmap)

### Target Specification

<table data-full-width="false"><thead><tr><th width="233">Switch</th><th>Usage</th><th>Description</th></tr></thead><tbody><tr><td><code>nmap</code></td><td><code>nmap 192.168.0.2</code></td><td>Single target IP scan</td></tr><tr><td></td><td><code>nmap 192.168.0.2 192.168.0.3</code></td><td>Specific target IPs scan</td></tr><tr><td></td><td><code>nmap domain.com</code></td><td>Scan target domain</td></tr><tr><td></td><td><code>nmap 192.168.0.1/24</code></td><td>Scan IP address range using CIDR notation</td></tr><tr><td><code>-iL</code></td><td><code>nmap -iL target_file.txt</code></td><td>Scan targets listed in a file</td></tr><tr><td><code>-iR</code></td><td><code>nmap -iR 100</code></td><td>Scan 100 random hosts</td></tr><tr><td><code>--exclude</code></td><td><code>nmap --exclude &#x3C;target_ip></code></td><td>Exclude listed targets</td></tr></tbody></table>

### Scan Types

<table data-full-width="true"><thead><tr><th width="249">Switch</th><th>Type</th><th>Open</th><th>Close</th><th>Filtered</th></tr></thead><tbody><tr><td><code>-sT</code></td><td>Full TCP connect scan (Request - SYN packets)</td><td><code>SYN + ACK</code></td><td><code>RST</code></td><td>No response</td></tr><tr><td><code>-sS</code></td><td>Stealth/Half Open scan (Request - single SYN packet)</td><td><code>SYN + ACK</code></td><td><code>RST</code></td><td>No response</td></tr><tr><td><code>-sU</code></td><td>UDP scan (Request - UDP Packet)</td><td>No response</td><td>ICMP error</td><td>No response</td></tr><tr><td><code>-sN</code></td><td>Null scan ( Request - Null probe packet)</td><td>No response</td><td><code>RST</code></td><td>No response</td></tr><tr><td><code>-sF</code></td><td>TCP FIN scan (Request - FIN probe packet)</td><td>No response</td><td><code>RST</code></td><td>No response</td></tr><tr><td><code>-sX</code></td><td>Xmas scan (Request - FIN + URG + PSH probe packets)</td><td>No response</td><td><code>RST</code></td><td>No response</td></tr><tr><td><code>-sA</code></td><td>ACK scan (Request - ACK packet)</td><td><code>RST</code></td><td></td><td>No response (statefule firewall)</td></tr><tr><td><code>-sW</code></td><td>TCP Window scan</td><td><code>RST</code>(port Window value is non-zeror)</td><td><code>RST</code>(port Window value is zero)</td><td>ICMP error</td></tr><tr><td><code>-sM</code></td><td>TCP Maimon scan (Request - FIN/ACK packet)</td><td>No response</td><td><code>RST</code></td><td>ICMP error</td></tr><tr><td><code>-sA -ttl 100</code></td><td>TTL-based ACK scan (Request - several thousand ACK packets to different TCP ports)</td><td><code>RST</code>(port TTL value &#x3C; 64)</td><td><code>RST</code>(port TTL value i> 64)</td><td></td></tr><tr><td><code>-Sp</code></td><td>Ping scan</td><td>-</td><td>-</td><td>-</td></tr></tbody></table>

### Nmap Vulnerability Scripts

* Nmap Scripting Engine (NSE) categories:
  * *safe*:- Won't affect the target
  * *intrusive*:- Not safe: likely to affect the target
  * *vuln*:- Scan for vulnerabilities
  * *exploit*:- Attempt to exploit a vulnerability
  * *auth*:- Attempt to bypass authentication for running services (e.g. Log into an FTP server anonymously)
  * *brute*:- Attempt to bruteforce credentials for running services
  * *discovery*:- Attempt to query running services for further information about the network (e.g. query an SNMP server).
* A more exhaustive list can be found [here](https://nmap.org/book/nse-usage.html).
* To run a specific script, we would use --script=\<script-name> , e.g. --script=http-fileupload-exploiter.
* Multiple scripts can be run simultaneously in this fashion by separating them by a comma. For example: --script=smb-enum-users,smb-enum-shares
* A full list of scripts and their corresponding arguments (along with example use cases) can be found [here](https://nmap.org/nsedoc/).
* Nmap stores its scripts on Linux at /usr/share/nmap/scripts. All of the NSE scripts are stored in this directory by default.
* It's also possible to install the scripts manually by downloading the script from Nmap (`sudo wget -O /usr/share/nmap/scripts/<script-name>.nse <https://svn.nmap.org/nmap/scripts/><script-name>.nse`). This must then be followed up with `nmap --script-updatedb`, which updates the `script.db` file to contain the newly downloaded script.
* Use locate `*.nse | grep <protocol_name>` to search for the applicable scripts
* To execute nmap with scripts use the following flags:
  * `-sC` flag loads the default scripts: `nmap -sC <target>` or `nmap --script=default <target> or nmap --script default <target>`
  * `--script` flag to load specific scripts found above: `nmap --sript http-headers <target>`
  * `--script-help` will provide a brief description of the script: `nmap --sript-help http-headers <target>`

<table data-header-hidden data-full-width="true"><thead><tr><th>Switch</th><th>Usage</th><th>Description</th></tr></thead><tbody><tr><td><code>-sC</code></td><td><code>nmap 192.168.1.1 -sC</code></td><td>Scan with default NSE scripts. Considered useful for discovery and safe</td></tr><tr><td><code>--script</code></td><td></td><td>Activate nmap scripting library</td></tr><tr><td><code>--script=vuln</code></td><td></td><td>Activate nmap scripts in the "vuln" category</td></tr><tr><td><code>--script default</code></td><td><code>nmap 192.168.1.1 --script default</code></td><td>Scan with default NSE scripts. Considered useful for discovery and safe</td></tr><tr><td></td><td><code>nmap 192.168.1.1 --script=banner</code></td><td>Scan with a single script. Example banner</td></tr><tr><td></td><td><code>nmap 192.168.1.1 --script=http*</code></td><td>Scan with a wildcard. Example http</td></tr><tr><td></td><td><code>nmap 192.168.1.1 --script=http,banner</code></td><td>Scan with two scripts. Example http and banner</td></tr><tr><td></td><td><code>nmap 192.168.1.1 --script "not intrusive</code></td><td>Scan default, but remove intrusive scripts</td></tr><tr><td><code>--script-args</code></td><td><code>nmap --script snmp-sysdescr --script-args snmpcommunity=admin 192.168.1.1</code></td><td>NSE script with arguments</td></tr></tbody></table>

### Timing and Performance

<table data-header-hidden data-full-width="true"><thead><tr><th>Switch</th><th>Usage</th><th>Description</th></tr></thead><tbody><tr><td><code>-T0</code></td><td></td><td>Paranoid (0) Intrusion Detection System evasion</td></tr><tr><td><code>-T1</code></td><td></td><td>Sneaky (1) Intrusion Detection System evasion</td></tr><tr><td><code>-T2</code></td><td></td><td>Polite (2) slows down the scan to use less bandwidth and use less target machine resources</td></tr><tr><td><code>-T3</code></td><td></td><td>Normal (3) which is default speed</td></tr><tr><td><code>-T4</code></td><td></td><td>Aggressive (4) speeds scans; assumes you are on a reasonably fast and reliable network</td></tr><tr><td><code>-T5</code></td><td></td><td>Insane (5) speeds scan; assumes you are on an extraordinarily fast network</td></tr><tr><td><code>--host-timeout &#x3C;time></code></td><td>1s; 4m; 2h</td><td>Give up on target after this long</td></tr><tr><td><code>--min-rtt-timeout/max-rtt-timeout/initial-rtt-timeout &#x3C;time></code></td><td>1s; 4m; 2h</td><td>Specifies probe round trip time</td></tr><tr><td><code>--min-hostgroup/max-hostgroup &#x3C;size&#x3C;size></code></td><td>50; 1024</td><td>Parallel host scan group sizes</td></tr><tr><td><code>--min-parallelism/max-parallelism &#x3C;numprobes></code></td><td>10; 1</td><td>Probe parallelization</td></tr><tr><td><code>--scan-delay/--max-scan-delay &#x3C;time></code></td><td>20ms; 2s; 4m; 5h</td><td>Adjust delay between probes</td></tr><tr><td><code>--max-retries &#x3C;tries></code></td><td>3</td><td>Specify the maximum number of port scan probe retransmissions</td></tr><tr><td><code>--min-rate &#x3C;number></code></td><td>100</td><td>Send packets no slower than &#x3C;number> per second</td></tr><tr><td><code>--max-rate &#x3C;number></code></td><td>100</td><td>Send packets no faster than &#x3C;number> per second</td></tr></tbody></table>

### Optimizing Nmap Scans

* Omit Non-Critical Tests:
  * Skip port scan `-sn` when only determining what hosts are alive; larger IP address range.
  * Limit the number of ports; rate limiting and firewalls drop probe packets without responding. Use `-F` (most popular 100 ports) `-p` or `--top-ports`
  * Skip advanced scans; use `-sC` and `-sV` on large networks.
  * Turn off DNS resolution when not needed; use the `-n` flag
* Optimize Timing Parameters:
  * Use the `-T4`and `--min-rate 1000` switches if detection is not an issue.
  * Nmap Manual: [Timing and Performance](#timing-and-performance)
  * Nmap Manual: [Timing Templates (-T)](https://nmap.org/book/performance-timing-templates.html)
  * Nmap Manual: [Low-Level Timing Controls](https://nmap.org/book/performance-low-level.html)
* Separate and Optimize TCP & UDP scans.
* Execute concurrent Nmap Instances.

### Port Specification

<table><thead><tr><th width="196">Switch</th><th>Usage</th><th>Description</th></tr></thead><tbody><tr><td><code>-p</code></td><td><code>nmap 192.168.1.1 -p &#x3C;x></code></td><td>Scan port x</td></tr><tr><td></td><td><code>nmap IP_add -p 21-100</code></td><td>Scan port range between 21 &#x26; 100</td></tr><tr><td></td><td><code>nmap  IP_add -p U:53, T:21-25, 80</code></td><td>Scan multiple TCP &#x26; UDP ports</td></tr><tr><td></td><td><code>nmap IP_add -p http, https</code></td><td>Scan port protocol name</td></tr><tr><td><code>-p-</code></td><td>`nmap IP_add -p-`</td><td>Scan all 65K ports</td></tr><tr><td><code>-F</code></td><td><code>nmap IP_add -F</code></td><td>Fast scan 100 ports</td></tr><tr><td><code>--top-ports</code></td><td><code>nmap IP_add --top-ports &#x3C;x></code></td><td>Scan top x ports</td></tr></tbody></table>

### OS & Service Detection

| Switch                   | Usage                                  | Description                                                                                                        |
| ------------------------ | -------------------------------------- | ------------------------------------------------------------------------------------------------------------------ |
| `-O`                     | `nmap IP_add -O`                       | Remote OS detection using TCP/IP stack fingerprinting.                                                             |
| `-O --osscan-limit`      | `nmap IP_add -O --osscan-limit`        | If at least one open & one closed TCP port are not found, it will not try OS detection.                            |
| `-O --osscan-guess`      | `nmap IP_add -O --osscan-guess`        | Increases nmap's aggressive guessing.                                                                              |
| `-O --max-os-tries`      | `nmap IP_add -O --max-os-tries <x>`    | Set the max number of OS detection tries against target.                                                           |
| `-sV`                    | `nmap IP_add -sV`                      | Attempt to determine the version of the service running on a port.                                                 |
| `-sV --version-intesity` | `nmap IP_add -sV --version-intesity 8` | Intensity level 0 to 9. Higher number increases accuracy probability.                                              |
| `-sV --version-light`    | `nmap IP_add -sV --version-light`      | Enable light mode; lower accuracy probability, but faster.                                                         |
| `-sV --version-all`      | `nmap IP_add -sV --version-all`        | Enable intensity level 9; higher accuracy probability, but slower.                                                 |
| `-A`                     | `nmap IP_add -A`                       | "Aggressive" scan mode; activates service version detection, OS detection, traceroute, and common script scanning. |

### Host Discovery

| Switch | Usage                     | Description                                      |
| ------ | ------------------------- | ------------------------------------------------ |
| `-sn`  | `nmap IP_add -sn`         | Disable port scanning; host discovery only.      |
| `-sL`  | `nmap IP_add -sL`         | No scan, list targets only                       |
| `-Pn`  | `nmap IP_add -Pn`         | Disable host discovery, port scan only.          |
| `-PS`  | `nmap IP_add -PS22-25,80` | TCP SYN discovery on port x. Port 80 by default. |
| `-PA`  | `nmap IP_add -PA22-25,80` | TCP ACK discovery on port x. Port 80 by default. |
| `-PU`  | `nmap IP_add -PU53`       | UDP discovery on port x. Port 40125 by default.  |
| `-PR`  | `nmap IP_add -PR`         | ARP discovery on local network. Faster than ICMP |
| `-n`   | `nmap IP_add -n`          | Disable DNS resolution.                          |

### Scan output

| Switch            | Usage                                      | Description                                                 |
| ----------------- | ------------------------------------------ | ----------------------------------------------------------- |
| `-oA`             | `nmap IP_add -oA scan_result`              | Output scan results in the 3 major formats                  |
| `-oN`             | `nmap IP_add -oN normal.file`              | Save nmap results in the normal.file                        |
| `-oG`             | `nmap IP_add -oG grep.file`                | Save nmap results in 'grepable' format                      |
| `-oX`             | `nmap IP_add -oX file.xml`                 | Save nmap results as an XML file                            |
| `-oG -`           | `nmap IP_add -oG -`                        | Grepable output to the screen. `-oN -`& `-oX -`also usable. |
| `--append-output` | `nmap IP_add -oN file.txt --append-output` | Append scan results to existing file.                       |

### Firewall Evasion

* Use the `-Pn`switch to disable host discovery (ICMP/ping) and treat the target as being alive, effectively bypassing the ICMP block.
* If on the same LAN, nmap can also use `ARP`requests to determine target status, thus use the&#x20;
* A comprehensive list of nmap switches to assist with firewall evastion can be found  [here](https://nmap.org/book/man-bypass-firewalls-ids.html).
  * `f`:- Used to fragment the packets (i.e. split them into smaller pieces) making it less likely that the packets will be detected by a firewall or IDS.
  * An alternative to `-f`, but providing more control over the size of the packets: `--mtu <number>`, accepts a maximum transmission unit size to use for the packets sent. This *must* be a multiple of 8.
  * `-scan-delay <time>ms`:- used to add a delay between packets sent. This is very useful if the network is unstable, but also for evading any time-based firewall/IDS triggers which may be in place.
  * `-badsum`:- this is used to generate in invalid checksum for packets. Any real TCP/IP stack would drop this packet, however, firewalls may potentially respond automatically, without bothering to check the checksum of the packet. As such, this switch can be used to determine the presence of a firewall/IDS.
* Firewalls are usually configured to drop incoming TCP packets (with the `SYN` flag set) to blocked/filtered ports, thus blocking new connection initiation requests. By sending request packets without the `SYN`flag, bypassing this kind of firewall is possible. However, modern IDS solutions can detect these scan types, so do not rely on this scan technique.
* Consider using the `-sF`,`-sX`, and `-sN`switches for firewall detection and evasion. These packets do not include a set `SYN` flag.

### Useful nmap Commands

<table data-header-hidden data-full-width="true"><thead><tr><th>Command</th><th>Description</th></tr></thead><tbody><tr><td><code>nmap -sn -PR 192.168.1.0/24</code></td><td>Discover live hosts on network</td></tr><tr><td><code>nmap -p80 -sV -oG - --open 192.168.1.1/24 | grep open</code></td><td>Scan for web servers and grep to show which IPs are running web servers</td></tr><tr><td><code>nmap -iR 10 -n -oX out.xml | grep "Nmap" | cut -d " " -f5 > live-hosts.txt</code></td><td>Generate a list of the IPs of live hosts</td></tr><tr><td><code>nmap -iR 10 -n -oX out2.xml | grep "Nmap" | cut -d " " -f5 >> live-hosts.txt</code></td><td>Append IP to the list of live hosts</td></tr><tr><td><code>ndiff scanl.xml scan2.xml</code></td><td>Compare output from nmap using the ndif</td></tr><tr><td><code>xsltproc nmap.xml -o nmap.html</code></td><td>Convert nmap xml files to html files</td></tr><tr><td><code>grep " open " results.nmap | sed -r 's/ +/ /g' | sort | uniq -c | sort -rn | less</code></td><td>Reverse sorted list of how often ports turn up</td></tr><tr><td><code>nmap -iR 10 -PS22-25,80,113,1050,35000 -v -sn</code></td><td>Discovery only on ports x, no port scan</td></tr><tr><td><code>nmap 192.168.1.1-1/24 -PR -sn -vv</code></td><td>Arp discovery only on local network, no port scan</td></tr><tr><td><code>nmap -iR 10 -sn -traceroute</code></td><td>Traceroute to random targets, no port scan</td></tr><tr><td><code>nmap 192.168.1.1-50 -sL --dns-server 192.168.1.1</code></td><td>Query the Internal DNS for hosts, list targets only</td></tr><tr><td><code>nmap -Pn --script=http-sitemap-generator scanme.nmap.org</code></td><td>http site map generator</td></tr><tr><td><code>nmap -n -Pn -p 80 --open -sV -vvv --script banner,http-title -iR 1000</code></td><td>Fast search for random web servers</td></tr><tr><td><code>nmap -Pn --script=dns-brute domain.com</code></td><td>Brute forces DNS hostnames guessing subdomains</td></tr><tr><td><code>nmap -n -Pn -vv -O -sV --script smb-enum*,smb-ls,smb-mbenum,smb-os-discovery,smb-s*,smb-vuln*,smbv2* -vv 192.168.1.1</code></td><td>Safe SMB scripts to run</td></tr><tr><td><code>nmap --script whois* domain.com</code></td><td>Whois query</td></tr><tr><td><code>nmap -p80 --script http-unsafe-output-escaping scanme.nmap.org</code></td><td>Detect cross site scripting vulnerabilities</td></tr><tr><td><code>nmap -p80 --script http-sql-injection scanme.nmap.org</code></td><td>Check for SQL injections</td></tr><tr><td><code>nmap -f -t 0 -n -Pn --data-length 200 -D 192.168.1.101,192.168.1.102,192.168.1.103,192.168.1.23 192.168.1.1</code></td><td>Example IDS Evasion command</td></tr></tbody></table>


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://cybersecc-ptblackb3ard.gitbook.io/cybersecc-ptblackb3ard/cyber-security/offensive-security/scanning-and-enumeration/network-enumeration/network-mapper-nmap.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.