Nmap - Network Enumeration

Cheatsheet

# Scan the full range
rustscan -a 192.168.1.0/24
 
# Default scan with OS and service detection
sudo rustscan -a 192.168.1.7 -- -A -oA results
 
# Full TCP scan with service detection and default scripts
sudo nmap <IP> -p- -sV -sC -oA full_tcp
 
# Top 1000 ports
sudo nmap <IP> -sS -Pn -n -oA quick
 
# Aggressive scan
sudo nmap <IP> -A -oA aggressive
 
# UDP scan of the top 100 ports
sudo nmap <IP> -sU -F -oA udp_fast
 
# Host discovery on a subnet
sudo nmap <NETWORK>/24 -sn -oA discovery
 
# Host discovery from a file
sudo nmap -sn -iL hosts.lst -oA discovery
 
# NSE vulnerability scan on one port
sudo nmap <IP> -p <PORT> -sV --script vuln -oA vuln_check
 
# Firewall evasion with a decoy scan
sudo nmap <IP> -p <PORT> -sS -Pn -n --disable-arp-ping -D RND:5
 
# Firewall evasion with source port 53
sudo nmap <IP> -p <PORT> -sS -Pn -n --disable-arp-ping --source-port 53
 
# Connect to a filtered port with source port 53
ncat -nv --source-port 53 <IP> <PORT>
 
# Convert XML output to an HTML report
xsltproc target.xml -o target.html

Methodology

Phase 1: Host Discovery

• Sweep the network range. Use -sn to find live hosts.
• Check ARP results on the same subnet. Nmap sends ARP pings automatically when targets are local.
• Retry hosts that appear down. Use TCP SYN to common ports (-PS22,80,443) or TCP ACK (-PA80).
• Scan targets from a list. Use -iL hosts.lst.
• Save discovery results. Use -oA so you can compare methods.
• Record which hosts responded. Non-responders may or may not need more investigation.

# Subnet sweep
sudo nmap 10.129.2.0/24 -sn -oA tnet | grep for | cut -d" " -f5
 
# IP range shorthand
sudo nmap -sn -oA tnet 10.129.2.18-20
 
# Force ICMP echo. Disable ARP on the local subnet.
sudo nmap <IP> -sn -PE --disable-arp-ping --packet-trace
 
# Use --reason to show why Nmap marks a host alive
sudo nmap <IP> -sn -PE --reason

Phase 2: Port Scanning

• Run a fast first scan. Use -F or --top-ports=100/1000.
• Start a full TCP port scan. Use -p- in the background.
• Check filtered ports. Use --packet-trace and --reason. See if the target dropped or rejected the packets.
• Run a UDP scan. Use -sU -F. Administrators often forget UDP filtering.
• Record all port states. Record open, closed, filtered, and open|filtered.
• If you have little time, set an order. Finish full TCP first. Then scan common UDP services (53, 67, 68, 69, 123, 137, 138, 161, 500, 514, 1900, 5353).

# SYN scan top 1000 (default, needs root)
sudo nmap <IP> -sS -oA syn_scan
 
# Connect scan
nmap <IP> -sT -oA connect_scan
 
# Full port range
sudo nmap <IP> -p- -oA all_ports
 
# Trace one port to observe firewall behavior
sudo nmap <IP> -p <PORT> --packet-trace -Pn -n --disable-arp-ping
 
# UDP scan top 100
sudo nmap <IP> -sU -F -oA udp_scan

Phase 3: Service Enumeration and Version Detection

• Fingerprint services. Run -sV on all open ports.
• Grab banners manually. Use nc or ncat on unknown or interesting ports. Catch details that Nmap misses.
• Run default scripts. Use -sC for extra enumeration that is safe.
• Run an aggressive scan if noise is acceptable. -A combines -sV, -O, --traceroute, and -sC.
• Compare automatic results with manual results. Nmap sometimes truncates banner data.
• Record exact versions for exploit research.

# Service version detection
sudo nmap <IP> -p- -sV -oA versions
 
# Version detection and default scripts
sudo nmap <IP> -p- -sV -sC -oA full_enum
 
# Manual banner grab to check results
ncat -nv <IP> <PORT>
 
# Monitor progress on long scans
sudo nmap <IP> -p- -sV --stats-every=5s

Phase 4: NSE Scripts and Vulnerability Assessment

• Scan high-value ports for known vulnerabilities. Use --script vuln.
• Use scripts for the specific service. Example: banner,smtp-commands for SMTP.
• Avoid brute, dos, exploit, and intrusive. Run them only when they are explicitly authorized and OPSEC-acceptable.
• Compare CVEs from NSE with version data. Check that each CVE applies.
• Record all script output for the report.

# Default safe scripts
sudo nmap <IP> -p <PORT> -sC
 
# Vulnerability scanning
sudo nmap <IP> -p <PORT> -sV --script vuln
 
# Specific scripts
sudo nmap <IP> -p 25 --script banner,smtp-commands
 
# Script category
sudo nmap <IP> --script discovery

Phase 5: Firewall and IDS/IPS Evasion

• Compare SYN scan results with ACK scan results. Map firewall rules.
• Test filtered ports with --source-port 53. Poorly configured firewalls trust DNS traffic.
• Use decoy scans (-D RND:5). Hide the true source among other addresses.
• Scan from a different source IP. Use -S <IP> -e <interface> to test subnet-based rules.
• Fragment packets (-f). Evade shallow packet inspection.
• Use --data-length <num>. Add data so packets match signatures less often.
• If the target blocks a VPS, switch IP or MAC address. This shows an IPS is active.
• Connect to newly found open ports. Use ncat --source-port 53 to check access.

# ACK scan to detect firewall rules
sudo nmap <IP> -p 21,22,25 -sA -Pn -n --disable-arp-ping --packet-trace
 
# Decoy scan with 5 random IPs
sudo nmap <IP> -p 80 -sS -Pn -n --disable-arp-ping -D RND:5
 
# Source port 53 to bypass misconfigured firewalls
sudo nmap <IP> -p <PORT> -sS -Pn -n --disable-arp-ping --source-port 53
 
# Spoof source IP. You must set the interface.
sudo nmap <IP> -p <PORT> -O -S <SPOOFED_IP> -e tun0
 
# Check access to a filtered port with source port 53
ncat -nv --source-port 53 <IP> <PORT>
 
# Specify DNS servers for queries
sudo nmap <IP> --dns-server <NS1>,<NS2>

Phase 6: Performance Tuning

• Speed scans in whitelisted or lab environments. Use -T4 or --min-rate 300.
• For stealth, use -T2 or -T1. Accept longer scan times.
• Set --initial-rtt-timeout and --max-rtt-timeout. Use values based on observed latency.
• Reduce --max-retries (default 10) to increase speed. Accept that you may miss ports.
• Always compare fast scans with default scans. Measure what speed costs.

# Aggressive timing
sudo nmap <NETWORK>/24 -F -T4
 
# Insane timing (lab only)
sudo nmap <NETWORK>/24 -F -T5
 
# Custom rate. Minimum 300 packets per second.
sudo nmap <NETWORK>/24 -F --min-rate 300
 
# Reduced RTT for fast networks
sudo nmap <NETWORK>/24 -F --initial-rtt-timeout 50ms --max-rtt-timeout 100ms
 
# Zero retries. Fastest. May miss ports.
sudo nmap <NETWORK>/24 -F --max-retries 0

When the Scan Finds Nothing

• Re-run with -p- -Pn. Force a full scan even if the host looks down.
• Add a UDP scan if you only ran TCP.
• Reduce speed. Use -T2 and default retries. Compare against the fast baseline.
• Try other techniques. Use -sT (no root), -sA (firewall mapping), or --source-port 53.
• Switch source IP or VPS if an IPS may have blocked you.
• Check reachability outside Nmap. Use ping, nc, and traceroute before you assume the host is offline.

OPSEC

Port scanning is noisy. Assume a competent defender can see it. Pick the technique that matches your noise budget.

OPSEC. Noise: medium-high. Telemetry: IDS portscan alerts, firewall deny logs, service connection logs, and netflow. Prerequisite: root for -sS, -sU, and -O. Footprint: connection log entries. No persistent change on the target.

Reference

Nmap Architecture

Nmap divides into five core capabilities:

1. Host discovery. Determine which targets are alive.
2. Port scanning. Identify open, closed, and filtered ports.
3. Service enumeration. Fingerprint services and versions.
4. OS detection. Identify the operating system.
5. NSE. Scriptable interaction with target services.

Syntax

nmap <scan types> <options> <target>

Scan Techniques

Port States

TCP SYN Scan Behavior

• Sends SYN → receives SYN-ACK = open
• Sends SYN → receives RST = closed
• Sends SYN → no response after retries = filtered

Nmap never completes the three-way handshake. Most services do not log a full TCP connection. Advanced IDS or IPS can still detect half-open scans.

TCP Connect Scan Behavior

A Connect scan completes the full three-way handshake. It is more accurate. It also creates connection logs. It behaves like a normal client. That makes it less likely to crash fragile services.

UDP Scan Behavior

• Sends empty datagram → receives UDP response = open
• Sends empty datagram → receives ICMP port unreachable (type 3, code 3) = closed
• Sends empty datagram → no response after retries = open|filtered

UDP scanning is slower than TCP. UDP has no acknowledgment. Timeouts are longer.

OS Detection

-O fingerprints the operating system from TCP/IP stack behavior. It uses packet order, initial sequence numbers, TCP options, and window sizes. It needs root. It is most accurate with at least one open port and one closed port.

# Standalone OS detection
sudo nmap <IP> -O
 
# More aggressive guessing when there is no exact match
sudo nmap <IP> -O --osscan-guess

When Nmap cannot find an exact match, it prints percentage-based Aggressive OS guesses. Treat these as hints, not facts. Compare them with reply TTL values and service banners. Approximate TTL values: 64 for Linux or Unix, 128 for Windows, 255 for network gear. OS detection packets are distinctive. Defenders can flag them easily. Run OS detection only when the noise is acceptable.

NSE Script Categories

Output Formats

Convert XML to HTML: xsltproc target.xml -o target.html

Timing Templates

Performance Tuning Options

Firewall Evasion Techniques

ACK Scan for Firewall Mapping

The ACK scan (-sA) cannot determine if a port is open or closed. It determines whether a firewall filters or does not filter the port:

• RST response = unfiltered (the firewall allows the packet through)
• No response / ICMP error = filtered (the firewall blocks it)

Compare -sS and -sA results. Identify which ports the firewall protects.

Banner Grabbing Beyond Nmap

Nmap -sV can miss details from service banners. Check banners manually:

# Manual banner grab
nc -nv <IP> <PORT>
 
# Capture the three-way handshake and banner with tcpdump
sudo tcpdump -i eth0 host <LHOST> and <IP>

The PSH-ACK packet after the handshake often contains the full banner. That banner may include OS distribution details that Nmap may truncate.

Key Differences: Dropped vs. Rejected Packets

Rejected packets show a firewall immediately. Dropped packets waste attacker time. Dropped packets also show filtering if you compare timing.

Knowledge Check

Common Mistakes

Attack Chains / Related Notes

• Leads to: Service enumeration from discovered ports. Then: FTP, SMB, SSH, SMTP, DNS, SNMP
• Leads to: Exploit research from version data. See Exploitation.
• Leads to: Firewall rule mapping for pivot planning. See Lateral Movement.
• Related: Infrastructure Enumeration. Use it for wider recon. Use it for other alive-detection when a control blocks Nmap.