Scanning Methodology
Host Discovery
Port Scan
Service Detection
NSE Scripts
Vuln Scan
Pro Tip
Always save scan output with -oA filename to get all formats. Run a quick scan first with RustScan, then targeted nmap on discovered ports.
1 Nmap Basics
MOST USED
Standard Service Scan
Service Detection + Default Scripts
nmap -sC -sV -oA output <IP>
-sC default scripts, -sV version detection, -oA all output formats
FULL SCAN
All 65535 Ports
Complete port scan with aggressive mode
nmap -p- -sC -sV -A -T4 -oA full <IP>
-A enables OS detection, traceroute, and script scanning
FAST
Quick TCP Scan
Speed scan for CTFs - all ports quickly
nmap -sT -p- --min-rate 5000 -T4 <IP>
UDP
Don't forget UDP!
Top 100 UDP ports
nmap -sU --top-ports 100 -sV <IP>
SNMP (161), DNS (53), TFTP (69), NTP (123) often hide valuable info
SYN + UDP combined scan
nmap -sS -sU -p T:1-65535,U:53,67,68,69,111,123,135,137-139,161,162,445,500,514,520,631,1434,1900,4500,49152 <IP>
2 Port Specification
All ports
-p-
Port range
-p 1-1024
Specific ports
-p 22,80,443,445,8080
Top N ports
--top-ports 1000
TCP & UDP specific
-p T:22,80,U:53,161
Fast scan (100 common)
-F
3 Host Discovery
Ping sweep - find live hosts
nmap -sn 192.168.1.0/24
ARP discovery (local network only)
nmap -sn -PR 192.168.1.0/24
Most reliable on local network - can't be blocked by firewall
Skip host discovery (host blocks ICMP)
nmap -Pn <IP>
TCP SYN discovery
-PS22,80,443
TCP ACK discovery
-PA80,443
UDP discovery
-PU53,161
ICMP timestamp
-PP
List targets without scanning
nmap -sL 192.168.1.0/24
4 Service & Version Detection
Standard version detection
nmap -sV <IP>
Aggressive version detection (intensity 0-9)
nmap -sV --version-intensity 9 <IP>
Higher intensity = more probes = slower but more accurate
Light version detection (fast)
nmap -sV --version-light <IP>
OS detection
nmap -O --osscan-guess <IP>
Aggressive mode (all detection + traceroute)
nmap -A <IP>
Equivalent to: -sV -O -sC --traceroute
5 NSE Scripts
Default scripts
nmap -sC <IP> # same as --script=default
VULN SCAN
Vulnerability scanning
nmap --script vuln <IP>
SMB vulnerabilities (EternalBlue, etc.)
nmap --script "smb-vuln*" -p 445 <IP>
SMB enumeration
nmap --script smb-enum-shares,smb-enum-users,smb-os-discovery -p 445 <IP>
HTTP enumeration
nmap --script http-enum,http-headers,http-methods,http-title -p 80,443,8080 <IP>
DNS enumeration
nmap --script dns-brute,dns-zone-transfer -p 53 <IP>
FTP enumeration & anonymous check
nmap --script ftp-anon,ftp-bounce,ftp-syst,ftp-vsftpd-backdoor -p 21 <IP>
Safe enumeration only
nmap --script "safe" <IP>
Multiple categories
nmap --script "default and safe" <IP>
nmap --script "vuln or exploit" <IP>
nmap --script "not intrusive" <IP>
Script with arguments
nmap --script http-brute --script-args userdb=users.txt,passdb=pass.txt -p 80 <IP>
NSE Script Categories:
auth
broadcast
brute
default
discovery
dos
exploit
fuzzer
intrusive
safe
version
vuln
6 Timing & Performance
Timing Templates
-T0
Paranoid
-T1
Sneaky
-T2
Polite
-T3
Normal
-T4
Use this!
-T5
Insane
T4 for labs/CTFs, T2-T3 for real engagements, T0-T1 for IDS evasion
Set minimum packet rate
nmap --min-rate 1000 <IP> # At least 1000 packets/sec
Set maximum retries
nmap --max-retries 2 <IP> # Reduce retries for speed
Host timeout
nmap --host-timeout 5m <IP> # Give up after 5 minutes per host
Parallel host scanning
nmap --min-hostgroup 64 --max-hostgroup 256 192.168.1.0/24
Ultimate speed combo for CTF
nmap -p- -T4 --min-rate 10000 --max-retries 1 <IP>
7 Firewall/IDS Evasion
Evasion techniques should only be used with proper authorization. These can trigger alerts and may be illegal without permission.
Fragment packets
nmap -f <IP> # Fragment into 8-byte chunks
nmap -ff <IP> # 16-byte chunks
Custom MTU (must be multiple of 8)
nmap --mtu 24 <IP>
Decoy scan (hide among decoys)
nmap -D RND:10 <IP> # 10 random decoys
nmap -D 192.168.1.5,192.168.1.6,ME <IP> # Specific decoys
Spoof source IP
nmap -S 192.168.1.100 -e eth0 <IP>
Spoof source port
nmap --source-port 53 <IP> # Appear as DNS traffic
nmap -g 80 <IP> # Short form
Append random data
nmap --data-length 25 <IP>
Randomize host order
nmap --randomize-hosts 192.168.1.0/24
Spoof MAC address
nmap --spoof-mac 0 <IP> # Random MAC
nmap --spoof-mac Dell <IP> # Vendor prefix
nmap --spoof-mac 00:11:22:33:44:55 <IP> # Specific MAC
Zombie/idle scan
nmap -sI zombie_host <target>
Bounce scan off idle zombie host - completely blind scan
8 Output Formats
-oN
Normal text
-oX
XML format
-oG
Grepable
-oA
All formats!
Save all formats (always use this!)
nmap -sC -sV -oA scan_results <IP>
Creates: scan_results.nmap, scan_results.xml, scan_results.gnmap
Verbose and debug output
nmap -v <IP> # Verbose
nmap -vv <IP> # Very verbose
nmap -d <IP> # Debug
nmap -dd <IP> # More debug
Resume interrupted scan
nmap --resume scan_results.gnmap
Parse grepable output for open ports
grep "open" scan.gnmap | awk '{print $2}'
9 Fast Scanning Tools
RustScan
Scans all 65535 ports in seconds, then pipes to nmap
Basic scan with nmap handoff
rustscan -a <IP> -- -sC -sV
With custom batch size and timeout
rustscan -a <IP> -b 500 -t 1500 -- -A
Scan multiple hosts
rustscan -a <IP1>,<IP2>,<IP3> -- -sC -sV
Greppable output
rustscan -a <IP> -g
Masscan
Fastest port scanner - can scan entire internet
Basic scan
masscan -p 1-65535 <IP> --rate 1000
Scan subnet with nmap-style output
masscan -p 80,443,8080 192.168.1.0/24 --rate 10000 -oG output.gnmap
UDP + TCP scan
masscan -pU:53,161,500 -pT:1-1024 <IP> --rate 1000
Banner grabbing
masscan -p 80 <IP> --banners --rate 1000
AutoRecon
Fully automated recon - perfect for OSCP
Single target
autorecon <IP>
Multiple targets
autorecon <IP1> <IP2> <IP3>
From targets file
autorecon -t targets.txt
With custom output directory
autorecon -o ./results <IP>
nmapAutomator
All scan types
nmapAutomator.sh <IP> All
Vulners scan
nmapAutomator.sh <IP> Vulns
10 Advanced Techniques
STEALTH
Two-phase scan (fast then deep)
# Phase 1: Quick port discovery
nmap -p- --min-rate 10000 -oG ports.txt <IP>
# Extract ports
ports=$(grep -oP '\d{1,5}/open' ports.txt | cut -d '/' -f1 | tr '\n' ',' | sed 's/,$//')
# Phase 2: Deep scan on discovered ports
nmap -p$ports -sC -sV -A -oA detailed <IP>
Scan through proxy/tor
proxychains nmap -sT -Pn -p 80,443,22 <IP>
Only TCP connect scan (-sT) works through proxy
IPv6 scanning
nmap -6 -sC -sV <IPv6>
Scan from file
nmap -iL targets.txt -sC -sV -oA multi_scan
Exclude hosts
nmap 192.168.1.0/24 --exclude 192.168.1.1,192.168.1.254
nmap 192.168.1.0/24 --excludefile exclude.txt
Compare two scans
ndiff scan1.xml scan2.xml
OS fingerprint (alternative ports)
nmap -O --osscan-limit --max-os-tries 1 <IP>