nmap

nmap -sL -n 10.10.12.13/29

The -PR command will only scan for ARP scan.

(Remember to add -sn if you don’t want to follow that with a port scan.)

  • Tryhackme nmap live host discovery

The -PE command will only scan using ICMP echo request (ICMP Type 8)

(Remember to add -sn if you don’t want to follow that with a port scan.)

The -PP option tells Nmap to use ICMP timestamp requests. (ICMP Type 13)

The -PM option tells Nmap to use address mask queries (ICMP Type 17)

The -PS option will use TCP SYN ping.

The -PA option will use ACK flag set

The -PU option will use UDP packet to check if the host is online

The -sT option will establish the 3-way handshake of TCP

The -sS option will use the half-open or stealth scan

The -sU will scan for the UDP ports and -F will enable fast mode it will scan fewer ports

The -sN option will sent a TCP packet with all six flag bits are set to zero

The -sF option will only send the fin flag bit

The -sX option or the xmas scan will use the fin/ack flag

The -sM option will also use fin/ack flag

  • It exploits a vulnerability in some older Unix systems, causing them to respond with a RST (reset) packet if the port is closed, rather than ignoring the packet as expected.

The -sA option will use the ACK flag

The -sW option or Window Scan uses the ACK flag

This will give you a spoof IP address

  • where the third and fourth source IP addresses are assigned randomly, while the fifth source is going to be the attacker’s IP address.

The -sI will use the Idle scan or Zombie Scan

Custom Scan

Decoy Scan

The -O option will detect the operating system of the system

The -oN option will save the current nmap scan to a file

The -oX option will save the current nmap scan as a XML file

The -oS option will save the current nmap scan as a Script Kiddie file

The -oG option will save the current nmap scan to a grepable format

The -iL options will read the ips in the list provided

Just scanning multiple IP at a time

Just using the vuln script

Showing the time out

  • -T 0 / -T paranoid

  • -T 1 / -T sneaky

  • -T 2 / -T polite

  • -T 3 / -T normal

  • -T 4 / -T aggressive

  • -T 5 / -T insane

The -S option will be using different IP

Using DNS as source port

Enumerating NFS protocol with nse

Enumerating SMTP protocol with nse

Enumerating MySQL protocol with nse

Will bruteforce for SID in Oracle TNS

Enumerating IPMI protocol with nse checking version

Enumerating Rsync with nse

Enumerating RDP with nse

Previousarp-scanNextMsfvenom

Last updated