nmap
nmap -sL -n 10.10.12.13/29
nmap -sL -n 10.10.0-255.101-125
The -PR command will only scan for ARP scan.
(Remember to add -sn if you don’t want to follow that with a port scan.)
Tryhackme nmap live host discovery
nmap -PR -sn $IP/24
The -PE command will only scan using ICMP echo request (ICMP Type 8)
(Remember to add -sn if you don’t want to follow that with a port scan.)
sudo nmap -PE -sn $IP/24
The -PP option tells Nmap to use ICMP timestamp requests. (ICMP Type 13)
sudo nmap -PP -sn 10.10.68.220/24
The -PM option tells Nmap to use address mask queries (ICMP Type 17)
sudo nmap -PM -sn $IP/24
The -PS option will use TCP SYN ping.
sudo nmap -PS -sn $IP/24
The -PA option will use ACK flag set
sudo nmap -PA -sn 10.10.68.220/24The -PU option will use UDP packet to check if the host is online
sudo nmap -PU -sn $IPThe -sT option will establish the 3-way handshake of TCP
nmap -sT -oN nmap-connect 10.10.245.44The -sS option will use the half-open or stealth scan
sudo nmap -sS -oN nmap-syn 10.10.202.54The -sU will scan for the UDP ports and -F will enable fast mode it will scan fewer ports
sudo nmap -sU -F -oN nmap-udp 10.10.110.233The -sN option will sent a TCP packet with all six flag bits are set to zero
sudo nmap -sN -oN nmap-null 10.10.97.213The -sF option will only send the fin flag bit
sudo nmap -sF -oN nmap-fin 10.10.97.213The -sX option or the xmas scan will use the fin/ack flag
sudo nmap -sX -oN nmap-xmass 10.10.97.213The -sM option will also use fin/ack flag
It exploits a vulnerability in some older Unix systems, causing them to respond with a RST (reset) packet if the port is closed, rather than ignoring the packet as expected.
sudo nmap -sM -oN nmap-maimon 10.10.97.213The -sA option will use the ACK flag
sudo nmap -sA -oN nmap-ack 10.10.19.144The -sW option or Window Scan uses the ACK flag
sudo nmap -sW -oN nmap-window 10.10.19.144This will give you a spoof IP address
where the third and fourth source IP addresses are assigned randomly, while the fifth source is going to be the attacker’s IP address.
sudo nmap -S SPOOFED_IP 10.10.13.210
nmap -D 10.10.0.1,10.10.0.2,RND,RND,ME 10.10.243.16The -sI will use the Idle scan or Zombie Scan
nmap -sI 10.10.5.5 $victimIPCustom Scan
sudo nmap --scanflags URGACKPSHRSTSYNFIN 10.10.13.210Decoy Scan
nmap -D DECOY_IP,ME 10.10.13.210
sudo nmap 10.129.2.28 -p 80 -sS -Pn -n --disable-arp-ping --packet-trace -D RND:5The -O option will detect the operating system of the system
sudo nmap -O -oN nmap-os 10.10.121.80The -oN option will save the current nmap scan to a file
sudo nmap -oN nmap $IPThe -oX option will save the current nmap scan as a XML file
sudo nmap -oX nmap $IPThe -oS option will save the current nmap scan as a Script Kiddie file
sudo nmap -oS nmap $IPThe -oG option will save the current nmap scan to a grepable format
sudo nmap -oG nmap $IPThe -iL options will read the ips in the list provided
sudo nmap -sn -oA tnet -iL hosts.lst | grep for | cut -d" " -f5Just scanning multiple IP at a time
sudo nmap -sn -oA tnet 10.129.2.18 10.129.2.19 10.129.2.20| grep for | cut -d" " -f5
sudo nmap -sn -oA tnet 10.129.2.18-20| grep for | cut -d" " -f5Just using the vuln script
nmap 10.129.223.9 -p 80 -sV --script vulnShowing the time out
sudo nmap 10.129.2.0/24 -F --initial-rtt-timeout 50ms --max-rtt-timeout 100ms-T 0/-T paranoid-T 1/-T sneaky-T 2/-T polite-T 3/-T normal-T 4/-T aggressive-T 5/-T insane
sudo nmap 10.129.2.0/24 -F -oN tnet.T5 -T 5The -S option will be using different IP
sudo nmap 10.129.2.28 -n -Pn -p 445 -O -S 10.129.2.200 -e tun0Using DNS as source port
# This first one gonna show the port is filtered
sudo nmap 10.129.2.28 -p50000 -sS -Pn -n --disable-arp-ping --packet-trace
# This second one gonna show the port is open since we have the source IP as 53/DNS
sudo nmap 10.129.2.28 -p50000 -sS -Pn -n --disable-arp-ping --packet-trace --source-port 53
# Then we can verify this
ncat -nv --source-port 53 10.129.2.28 50000Enumerating NFS protocol with nse
sudo nmap 10.129.14.128 -p111,2049 -sV -sC
sudo nmap --script nfs* 10.129.14.128 -sV -p111,2049Enumerating SMTP protocol with nse
sudo nmap 10.129.14.128 -p25 --script smtp-open-relay -vEnumerating MySQL protocol with nse
sudo nmap 10.129.14.128 -sV -sC -p3306 --script mysql*Will bruteforce for SID in Oracle TNS
sudo nmap -p1521 -sV 10.129.204.235 --open --script oracle-sid-bruteEnumerating IPMI protocol with nse checking version
sudo nmap -sU --script ipmi-version -p 623 ilo.inlanfreight.localEnumerating Rsync with nse
nmap -sV --script "rsync-list-modules" -p <PORT> <IP>Enumerating RDP with nse
nmap -sV -sC 10.129.201.248 -p3389 --script rdp*Last updated