Nmap - Network Enumeration

Cheatsheet

# entire range scan 
rustscan -a 192.168.1.0/24
 
# simply use this and forget 
sudo rustscan -a 192.168.1.7 -- -A -oA results
 
# Full TCP scan with service detection and default scripts
sudo nmap <IP> -p- -sV -sC -oA full_tcp
 
# top 1000 ports
sudo nmap <IP> -sS -Pn -n -oA quick
 
# Aggressive scan
sudo nmap <IP> -A -oA aggressive
 
# UDP scan top 100 ports
sudo nmap <IP> -sU -F -oA udp_fast
 
# Host discovery sweep a subnet
sudo nmap <NETWORK>/24 -sn -oA discovery
 
# Host discovery from file
sudo nmap -sn -iL hosts.lst -oA discovery
 
# NSE vuln scan on specific port
sudo nmap <IP> -p <PORT> -sV --script vuln -oA vuln_check
 
# Firewall evasion    decoy scan
sudo nmap <IP> -p <PORT> -sS -Pn -n --disable-arp-ping -D RND:5
 
# Firewall evasion    source port 53
sudo nmap <IP> -p <PORT> -sS -Pn -n --disable-arp-ping --source-port 53
 
# Connect to a filtered port using source port 53
ncat -nv --source-port 53 <IP> <PORT>
 
# Convert XML output to HTML report
xsltproc target.xml -o target.html

Methodology

Phase 1: Host Discovery

• Sweep the network range with -sn to identify live hosts.
• If targets are on the same subnet, ARP pings fire automatically check results.
• If hosts appear down, retry with TCP SYN to common ports (-PS22,80,443) or TCP ACK (-PA80).
• For specific targets from a list, use -iL hosts.lst.
• Save all discovery results with -oA for comparison across methods.
• Note which hosts responded and which did not non-responders may or may not need further investigation.

# Subnet sweep
sudo nmap 10.129.2.0/24 -sn -oA tnet | grep for | cut -d" " -f5
 
# IP range shorthand
sudo nmap -sn -oA tnet 10.129.2.18-20
 
# Force ICMP echo (disable ARP on local subnet)
sudo nmap <IP> -sn -PE --disable-arp-ping --packet-trace
 
# Use --reason to confirm why Nmap considers a host alive
sudo nmap <IP> -sn -PE --reason

Phase 2: Port Scanning

• Run a fast initial scan (-F or --top-ports=100/1000) to get a quick picture.
• Launch a full TCP port scan (-p-) in the background.
• Check filtered ports, use --packet-trace and --reason to determine if packets are dropped or rejected.
• Run a UDP scan (-sU -F) on the target, administrators often forget UDP filtering.
• Record all port states: open, closed, filtered, open|filtered.
• If time-constrained, prioritize full TCP then targeted UDP on common services (53, 67, 68, 69, 123, 137, 138, 161, 500, 514, 1900, 5353).

# SYN scan top 1000 (default, requires root)
sudo nmap <IP> -sS -oA syn_scan
 
# Connect scan
nmap <IP> -sT -oA connect_scan
 
# Full port range
sudo nmap <IP> -p- -oA all_ports
 
# Trace a specific port to understand firewall behavior
sudo nmap <IP> -p <PORT> --packet-trace -Pn -n --disable-arp-ping
 
# UDP scan top 100
sudo nmap <IP> -sU -F -oA udp_scan

Phase 3: Service Enumeration and Version Detection

• Run -sV on all discovered open ports to fingerprint services.
• Manually banner-grab interesting/unknown ports with nc or ncat to catch details Nmap misses.
• Use -sC (default scripts) for safe additional enumeration.
• Run the aggressive scan (-A) if noise is acceptable and combines -sV, -O, --traceroute, -sC.
• Compare automatic results with manual ones, Nmap sometimes truncates banner data.
• Record exact versions for exploit research.

# Service version detection
sudo nmap <IP> -p- -sV -oA versions
 
# Version + default scripts
sudo nmap <IP> -p- -sV -sC -oA full_enum
 
# Manual banner grab to validate
ncat -nv <IP> <PORT>
 
# Monitor progress on long scans
sudo nmap <IP> -p- -sV --stats-every=5s

Phase 4: NSE Scripts and Vulnerability Assessment

• Run --script vuln against high-value ports to identify known vulnerabilities.
• Use targeted scripts for specific services (e.g., banner,smtp-commands for SMTP).
• Avoid brute, dos, exploit, and intrusive categories unless explicitly authorized and OPSEC-acceptable.
• Cross-reference CVEs reported by NSE with version data, validate applicability.
• Record all script output for the report.

# Default safe scripts
sudo nmap <IP> -p <PORT> -sC
 
# Vulnerability scanning
sudo nmap <IP> -p <PORT> -sV --script vuln
 
# Specific scripts
sudo nmap <IP> -p 25 --script banner,smtp-commands
 
# Script category
sudo nmap <IP> --script discovery

Phase 5: Firewall and IDS/IPS Evasion

• Compare SYN scan results with ACK scan results to map firewall rules.
• Test filtered ports with --source-port 53,poorly configured firewalls trust DNS traffic.
• Use decoy scans (-D RND:5) to obscure the true source among noise.
• Try scanning from a different source IP (-S <IP> -e <interface>) to test subnet-based rules.
• Fragment packets (-f) to evade shallow packet inspection.
• Use --data-length <num> to make packets less signature-matchable.
• If a VPS gets blocked, switch to another IP/MAC address, confirms IPS is active.
• Connect to newly discovered open ports via ncat --source-port 53 to confirm access.

# ACK scan to detect firewall rules
sudo nmap <IP> -p 21,22,25 -sA -Pn -n --disable-arp-ping --packet-trace
 
# Decoy scan with 5 random IPs
sudo nmap <IP> -p 80 -sS -Pn -n --disable-arp-ping -D RND:5
 
# Source port 53 to bypass misconfigured firewalls
sudo nmap <IP> -p <PORT> -sS -Pn -n --disable-arp-ping --source-port 53
 
# Spoof source IP (must specify interface)
sudo nmap <IP> -p <PORT> -O -S <SPOOFED_IP> -e tun0
 
# Confirm access to a filtered port using source port 53
ncat -nv --source-port 53 <IP> <PORT>
 
# Specify DNS servers for queries
sudo nmap <IP> --dns-server <NS1>,<NS2>

Phase 6: Performance Tuning

• For whitelisted/lab environments, use -T4 or --min-rate 300 to speed scans.
• For stealth, use -T2 or -T1 and accept longer scan times.
• Adjust --initial-rtt-timeout and --max-rtt-timeout based on observed latency.
• Reduce --max-retries (default 10) to speed up but accept potential misses.
• Always compare results between fast and default scans to quantify what speed costs.

# Aggressive timing
sudo nmap <NETWORK>/24 -F -T4
 
# Insane timing (lab only)
sudo nmap <NETWORK>/24 -F -T5
 
# Custom rate    minimum 300 packets/second
sudo nmap <NETWORK>/24 -F --min-rate 300
 
# Reduced RTT for fast networks
sudo nmap <NETWORK>/24 -F --initial-rtt-timeout 50ms --max-rtt-timeout 100ms
 
# Zero retries (fastest, may miss ports)
sudo nmap <NETWORK>/24 -F --max-retries 0

When the Scan Finds Nothing

• Re-run with -p- -Pn to force a full scan even if the host looks dead.
• Add a UDP scan if you only ran TCP.
• Slow down (-T2, default retries) and compare against the fast baseline.
• Try alternate techniques: -sT (no root), -sA (firewall mapping), --source-port 53.
• Switch source IP/VPS if an IPS may have blocked you.
• Confirm reachability outside Nmap (ping, nc, traceroute) before assuming the host is offline.

OPSEC

Port scanning is inherently noisy assume a competent defender can see it. Pick the technique that matches your noise budget.

OPSEC Noise: medium-high · Telemetry: IDS portscan alerts, firewall deny logs, service connection logs, netflow · Prereq: root for -sS/-sU/-O · Footprint: connection log entries; no persistent change on target

Reference

Nmap Architecture

Nmap divides into five core capabilities:

1. Host discovery determine which targets are alive
2. Port scanning identify open, closed, and filtered ports
3. Service enumeration fingerprint services and versions
4. OS detection identify the operating system
5. NSE scriptable interaction with target services

Syntax

nmap <scan types> <options> <target>

Scan Techniques

Port States

TCP SYN Scan Behavior

• Sends SYN → receives SYN-ACK = open
• Sends SYN → receives RST = closed
• Sends SYN → no response after retries = filtered

The three-way handshake is never completed, so no full TCP connection is logged by most services. Advanced IDS/IPS can still detect half-open scans.

TCP Connect Scan Behavior

Completes the full three-way handshake. More accurate but generates connection logs. Behaves like a normal client, making it less likely to crash fragile services.

UDP Scan Behavior

• Sends empty datagram → receives UDP response = open
• Sends empty datagram → receives ICMP port unreachable (type 3, code 3) = closed
• Sends empty datagram → no response after retries = open|filtered

UDP scanning is significantly slower than TCP due to lack of acknowledgment and longer timeouts.

OS Detection

-O fingerprints the operating system using TCP/IP stack behavior (packet ordering, initial sequence numbers, TCP options, window sizes). It needs root and is most accurate with at least one open and one closed port.

# Standalone OS detection
sudo nmap <IP> -O
 
# More aggressive guessing when no exact match
sudo nmap <IP> -O --osscan-guess

When Nmap cannot find an exact match it prints percentage-based “Aggressive OS guesses.” Treat these as hints, not facts corroborate with the TTL of replies (≈64 = Linux/Unix, ≈128 = Windows, ≈255 = network gear) and service banners. OS detection packets are distinctive and easily flagged, so run it only when the noise is acceptable.

NSE Script Categories

Output Formats

Convert XML to HTML: xsltproc target.xml -o target.html

Timing Templates

Performance Tuning Options

Firewall Evasion Techniques

ACK Scan for Firewall Mapping

The ACK scan (-sA) cannot determine if a port is open or closed it determines whether a port is filtered or unfiltered by a firewall:

• RST response = unfiltered (firewall allows the packet through)
• No response / ICMP error = filtered (firewall blocks it)

Compare -sS and -sA results side-by-side to understand which ports the firewall protects.

Banner Grabbing Beyond Nmap

Nmap’s -sV can miss details from service banners. Validate manually:

# Manual banner grab
nc -nv <IP> <PORT>
 
# Capture the three-way handshake + banner with tcpdump
sudo tcpdump -i eth0 host <LHOST> and <IP>

The PSH-ACK packet after the handshake often contains the full banner including OS distribution details that Nmap may truncate.

Key Differences: Dropped vs. Rejected Packets

Rejected packets reveal firewall presence immediately. Dropped packets waste attacker time but also confirm filtering if you compare timing.

Knowledge Check

Common Mistakes

Attack Chains / Related Notes

• Leads to: Service-specific enumeration based on discovered ports FTP, SMB, SSH, SMTP, DNS, SNMP
• Leads to: Exploit research based on version information → Exploitation
• Leads to: Firewall rule mapping feeds into Lateral Movement pivot planning
• Related: Infrastructure Enumeration for broader recon context and alternative alive-detection when Nmap is blocked