CyberXplained

Nmap Command Explorer

Explore and execute Nmap commands for your operating system.

Click on to check if Nmap is installed on your system.

Use Nmap commands to scan and analyze network hosts and services.
Replace 192.168.1.1 with the target IP address.

Target Specification

Basic Scan

Perform a basic scan on the target IP address.

nmap 192.168.1.1

Scan Domain

Scan a domain name to discover open ports and services.

nmap scanme.nmap.org

Multiple Targets

Scan multiple targets by specifying their IP addresses.

nmap 192.168.1.1 127.0.0.1

Scan IP Range

Scan a range of IP addresses within the specified range.

nmap 192.168.1.1-254

Input from File

Read target IP addresses from a file to perform the scan.

nmap -iL targets.txt

Random Targets

Scan 100 random hosts on the network.

nmap -iR 100

Exclude Host

Exclude a specific host from the scan.

nmap --exclude 192.168.1.1

Scan Techniques

TCP SYN Scan

Perform a stealthy scan using TCP SYN packets.(default)

nmap 192.168.1.1 -sS

TCP Connect Scan

Perform a full TCP connection scan on the target.(default without root)

nmap 192.168.1.1 -sT

UDP Scan

Scan for open UDP ports (e.g., DNS) on the target.

nmap 192.168.1.1 -sU

TCP ACK Port Scan

Scan for open ports by sending TCP ACK packets.

nmap 192.168.1.1 -sA

TCP Window Port Scan

Scan for open ports by analyzing the TCP window size.

nmap 192.168.1.1 -sW

TCP Maimon Port Scan

Scan for open ports by sending TCP Maimon packets.

nmap 192.168.1.1 -sM

Host Discovery

List Scan

List target IP addresses without performing a scan.

nmap 192.168.1.1-3 -sL

Ping Scan

Perform a simple ping scan to discover live hosts.

nmap 192.168.1.1/24 -sn

No Ping Scan/Port Scan Only

Disable host discovery and scan the target IP addresses.

nmap 192.168.1.1-5 -Pn

TCP SYN Ping

Perform a TCP SYN ping scan on the target IP addresses.(default port 80)

nmap 192.168.1.1-5 -PS22-25,80

TCP ACK Ping

Perform a TCP ACK ping scan on the target IP addresses.(default port 80)

nmap 192.168.1.1-5 -PA22-25,80

UDP Ping

Perform a UDP ping scan on the target IP addresses.(default port 40125)

nmap 192.168.1.1-5 -PU53

ARP Ping on Local Network

Perform an ARP ping scan on the local network.

nmap 192.168.1.1-1/24 -PR

No DNS Resolution

Disable DNS resolution during the scan.

nmap 192.168.1.1 -n

Port Specifications

Port scan for port 21

Scan a specific port on the target IP address.

nmap 192.168.1.1 -p 21

Port range

Scan a range of ports on the target IP address.

nmap 192.168.1.1 -p 21-100

Port scan multiple TCP and UDP ports

Scan multiple TCP and UDP ports on the target IP address.

nmap 192.168.1.1 -p U:53,T:21-25,80

Port scan all ports

Scan all ports on the target IP address.

nmap 192.168.1.1 -p-

Port scan from service name

Scan ports by specifying service names on the target IP address.

nmap 192.168.1.1 -p http,https

Fast port scan (100 ports)

Perform a fast scan of the top 100 ports on the target IP address.

nmap 192.168.1.1 -F

Port scan the top 2000 ports

Scan the top 2000 most common ports on the target IP address.

nmap 192.168.1.1 --top-ports 2000

Leaving off initial port in range

Start the scan at port 1 and go up to port 65535 on the target IP address.

nmap 192.168.1.1 -p-65535

Leaving off end port in range

Start the scan at port 0 and go through to port 65535 on the target IP address.

nmap 192.168.1.1 -p0-

Service Version Detection

Service Version Detection

Attempts to determine the version of the service running on port.

nmap 192.168.1.1 -sV

Version Intensity

Intensity level 0 to 9. Higher number increases possibility of correctness.

nmap 192.168.1.1 -sV --version-intensity 8

Version Light

Enable light mode. Lower possibility of correctness. Faster.

nmap 192.168.1.1 -sV --version-light

Version All

Enable intensity level 9. Higher possibility of correctness. Slower.

nmap 192.168.1.1 -sV --version-all

Aggressive Scan

Enables OS detection, version detection, script scanning, and traceroute.

nmap 192.168.1.1 -A

Remote OS detection

Remote OS detection using TCP/IP stack fingerprinting.

nmap 192.168.1.1 -O

OS Scan Limit

If at least one open and one closed TCP port are not found it will not try OS detection against host.

nmap 192.168.1.1 -O --osscan-limit

Aggressive OS Guess

Makes Nmap guess more aggressively.

nmap 192.168.1.1 -O --osscan-guess

Max OS Tries

Set the maximum number of OS detection tries against a target.

nmap 192.168.1.1 -O --max-os-tries 1

Timing and Performance

Paranoid (0)

Intrusion Detection System evasion. Slowest scan.

nmap 192.168.1.1 -T0

Sneaky (1)

Intrusion Detection System evasion. Slower scan. Less bandwidth.

nmap 192.168.1.1 -T1

Polite (2)

Slows down the scan to use less bandwidth and use less target machine resources. Default speed.

nmap 192.168.1.1 -T2

Normal (3)

Default speed. Assumes you are on a reasonably fast and reliable network.

nmap 192.168.1.1 -T3

Aggressive (4)

Speeds scans; assumes you are on a reasonably fast and reliable network.

nmap 192.168.1.1 -T4

Insane (5)

Speeds scan; assumes you are on an extraordinarily fast network.

nmap 192.168.1.1 -T5

Firewall/IDS Evasion and Spoofing

Fragmented Packets

Requested scan (including ping scans) use tiny fragmented IP packets. Harder for packet filters.

nmap 192.168.1.1 -f

Set MTU

Set your own offset size.

nmap 192.168.1.1 --mtu 32

Decoy Scan

Send scans from spoofed IPs.

nmap -D 192.168.1.101,192.168.1.102,192.168.1.103,192.168.1.23 192.168.1.1

Decoy Scan Explained

Above example explained.

nmap -D decoy-ip1,decoy-ip2,your-own-ip,decoy-ip3,decoy-ip4 remote-host-ip

Spoof Source Address

Scan Facebook from Microso (-e eth0 -Pn may be required).

nmap -S www.microso.com www.facebook.com

Source Port

Use given source port number.

nmap -g 53 192.168.1.1

Relay Connections

Relay connections through HTTP/SOCKS4 proxies.

nmap --proxies http://192.168.1.1:8080, http://192.168.1.2:8080 192.168.1.1

Append Random Data

Appends random data to sent packets.

nmap --data-length 200 192.168.1.1

Output Formats

Normal Output

Output scan results to the file normal.file in normal format.

nmap 192.168.1.1 -oN normal.file

XML Output

Output scan results to the file xml.file in XML format.

nmap 192.168.1.1 -oX xml.file

Grepable Output

Output scan results to the file grep.file in grepable format.

nmap 192.168.1.1 -oG grep.file

All Formats Output

Output scan results in the three major formats (normal, XML, and grepable) at once.

nmap 192.168.1.1 -oA results

Grepable Output to Screen

Output scan results in grepable format to the screen. -oN - and -oX - are also usable.

nmap 192.168.1.1 -oG -

Append Output

Append scan results to a previous scan file.

nmap 192.168.1.1 -oN file.file --append-output

Increase Verbosity

Increase the verbosity level of the scan output. Use -vv or more for greater effect.

nmap 192.168.1.1 -v

Increase Debugging

Increase the debugging level of the scan output. Use -dd or more for greater effect.

nmap 192.168.1.1 -d

Display Reason

Display the reason a port is in a particular state, similar to using -vv.

nmap 192.168.1.1 --reason

Show Open Ports Only

Only show open (or possibly open) ports in the scan results.

nmap 192.168.1.1 --open

Show Packet Trace

Show all packets sent and received during the scan.

nmap 192.168.1.1 -T4 --packet-trace

List Interfaces and Routes

Show the host interfaces and routes.

nmap --iflist

Resume Scan

Resume a scan from the specified results file.

nmap --resume results.file

NSE Scripts

Scan with default NSE scripts

Considered useful for discovery and safe.

nmap 192.168.1.1 -sC

Scan with default NSE scripts

Considered useful for discovery and safe.

nmap 192.168.1.1 --script default

Scan with a single script

Example banner.

nmap 192.168.1.1 --script=banner

Scan with a wildcard

Example http.

nmap 192.168.1.1 --script=http*

Scan with two scripts

Example http and banner.

nmap 192.168.1.1 --script=http,banner

Scan default, but remove intrusive scripts

Remove intrusive scripts from the default scan.

nmap 192.168.1.1 --script "not intrusive"

NSE script with arguments

Run the snmp-sysdescr script with the specified arguments.

nmap --script snmp-sysdescr --script-args snmpcommunity=admin 192.168.1.1

HTTP site map generator

Generate a site map for the specified HTTP site.

nmap -Pn --script=http-sitemap-generator scanme.nmap.org

Fast search for random web servers

Search for random web servers with the specified scripts.

nmap -n -Pn -p 80 --open -sV -vvv --script banner,http-title -iR 1000

Brute forces DNS hostnames

Guess subdomains by brute forcing DNS hostnames.

nmap -Pn --script=dns-brute domain.com

Safe SMB scripts to run

Run safe SMB scripts on the target.

nmap -n -Pn -vv -O -sV --script smb-enum*,smb-ls,smb-mbenum,smb-os-discovery,smb-s*,smb-vuln*,smbv2* -vv 192.168.1.1

Whois query

Perform a Whois query on the specified domain.

nmap --script whois* domain.com

Detect cross site scripting vulnerabilities

Check for cross site scripting vulnerabilities on the target.

nmap -p80 --script http-unsafe-output-escaping scanme.nmap.org

Check for SQL injections

Check for SQL injection vulnerabilities on the target.

nmap -p80 --script http-sql-injection scanme.nmap.org

Miscellaneous Commands

Enable IPv6 scanning

Scan an IPv6 address.

nmap -6 2607:f0d0:1002:51::4

Nmap Help Screen

Display the Nmap help screen.

nmap -h

Manual Nmap Command

Enter a custom Nmap command: