7/3/23, 8:50 PM Nmap Cheat Sheet 2023: All the Commands, Flags & Switches
Search our Nmap cheat sheet to find the right cheat for the term you're looking
for. Simply enter the term in the search bar and you'll receive the matching
cheats available.
Search cheats here
Target Specification
SWITCH EXAMPLE DESCRIPTION
nmap 192.168.1.1 Scan a single IP
nmap 192.168.1.1 192.168.2.1 Scan specific IPs
nmap 192.168.1.1-254 Scan a range
nmap scanme.nmap.org Scan a domain
nmap 192.168.1.0/24 Scan using CIDR notation
-iL nmap -iL targets.txt Scan targets from a file
-iR nmap -iR 100 Scan 100 random hosts
-exclude nmap -exclude 192.168.1.1 Exclude listed hosts
Nmap Scan Techniques
SWITCH EXAMPLE DESCRIPTION
-sS nmap 192.168.1.1 -sS TCP SYN port scan (Default)
-sT nmap 192.168.1.1 -sT TCP connect port scan (Default without root privilege)
-sU nmap 192.168.1.1 -sU UDP port scan
-sA nmap 192.168.1.1 -sA TCP ACK port scan
https://www.stationx.net/nmap-cheat-sheet/ 2/18
7/3/23, 8:50 PM Nmap Cheat Sheet 2023: All the Commands, Flags & Switches
SWITCH EXAMPLE DESCRIPTION
-sW nmap 192.168.1.1 -sW TCP Window port scan
-sM nmap 192.168.1.1 -sM TCP Maimon port scan
Download the PDF Version of This NMAP Cheat Sheet!
Want to keep this cheat sheet at your fingertips? Just enter your email address, and we’ll
send a PDF copy to your inbox.
Email Address
DOWNLOAD
Host Discovery
SWITCH EXAMPLE DESCRIPTION
-sL nmap 192.168.1.1-3 -sL No Scan. List targets only
-sn nmap 192.168.1.1/24 -sn Disable port scanning. Host discovery only.
-Pn nmap 192.168.1.1-5 -Pn Disable host discovery. Port scan only.
https://www.stationx.net/nmap-cheat-sheet/ 3/18
7/3/23, 8:50 PM Nmap Cheat Sheet 2023: All the Commands, Flags & Switches
SWITCH EXAMPLE DESCRIPTION
TCP SYN discovery on port x.
-PS nmap 192.168.1.1-5 -PS22-25,80
Port 80 by default
TCP ACK discovery on port x.
-PA nmap 192.168.1.1-5 -PA22-25,80
Port 80 by default
UDP discovery on port x.
-PU nmap 192.168.1.1-5 -PU53
Port 40125 by default
-PR nmap 192.168.1.1-1/24 -PR ARP discovery on local network
-n nmap 192.168.1.1 -n Never do DNS resolution
Nmap Command Generator
Say goodbye to the hassle of trying to remember the exact syntax for your Nmap
commands! With our Nmap Command Generator, you can simply say what you
need Nmap to do and we will generate the command for you.
OS discovery www.google.com
Generate
Port Specification
SWITCH EXAMPLE DESCRIPTION
-p nmap 192.168.1.1 -p 21 Port scan for port x
-p nmap 192.168.1.1 -p 21-100 Port range
nmap 192.168.1.1 -p U:53,T:21-
-p Port scan multiple TCP and UDP ports
25,80
https://www.stationx.net/nmap-cheat-sheet/ 4/18
7/3/23, 8:50 PM Nmap Cheat Sheet 2023: All the Commands, Flags & Switches
SWITCH EXAMPLE DESCRIPTION
-p nmap 192.168.1.1 -p- Port scan all ports
-p nmap 192.168.1.1 -p http,https Port scan from service name
-F nmap 192.168.1.1 -F Fast port scan (100 ports)
-top- nmap 192.168.1.1 -top-ports
Port scan the top x ports
ports 2000
-p- Leaving off initial port in range makes the scan
nmap 192.168.1.1 -p-65535
65535 start at port 1
Leaving off end port in range
-p0- nmap 192.168.1.1 -p0-
makes the scan go through to port 65535
Service and Version Detection
SWITCH EXAMPLE DESCRIPTION
Attempts to determine the version of the
-sV nmap 192.168.1.1 -sV
service running on port
-sV -version- nmap 192.168.1.1 -sV - Intensity level 0 to 9. Higher number increases
intensity version-intensity 8 possibility of correctness
-sV -version- nmap 192.168.1.1 -sV - Enable light mode. Lower possibility of
light version-light correctness. Faster
nmap 192.168.1.1 -sV - Enable intensity level 9. Higher possibility of
-sV -version-all
version-all correctness. Slower
Enables OS detection, version detection, script
-A nmap 192.168.1.1 -A
scanning, and traceroute
OS Detection
SWITCH EXAMPLE DESCRIPTION
-O nmap 192.168.1.1 -O Remote OS detection using TCP/IP stack fingerprinting
https://www.stationx.net/nmap-cheat-sheet/ 5/18
7/3/23, 8:50 PM Nmap Cheat Sheet 2023: All the Commands, Flags & Switches
SWITCH EXAMPLE DESCRIPTION
-O -osscan- nmap 192.168.1.1 -O - If at least one open and one closed TCP port are not
limit osscan-limit found it will not try OS detection against host
-O -osscan- nmap 192.168.1.1 -O -
Makes Nmap guess more aggressively
guess osscan-guess
-O -max-os- nmap 192.168.1.1 -O - Set the maximum number x of OS detection tries
tries max-os-tries 1 against a target
Enables OS detection, version detection, script
-A nmap 192.168.1.1 -A
scanning, and traceroute
Timing and Performance
SWITCH EXAMPLE DESCRIPTION
-T0 nmap 192.168.1.1 -T0 Paranoid (0) Intrusion Detection System evasion
-T1 nmap 192.168.1.1 -T1 Sneaky (1) Intrusion Detection System evasion
Polite (2) slows down the scan to use less bandwidth and use
-T2 nmap 192.168.1.1 -T2
less target machine resources
-T3 nmap 192.168.1.1 -T3 Normal (3) which is default speed
Aggressive (4) speeds scans; assumes you are on a
-T4 nmap 192.168.1.1 -T4
reasonably fast and reliable network
Insane (5) speeds scan; assumes you are on an extraordinarily
-T5 nmap 192.168.1.1 -T5
fast network
Timing and Performance Switches
EXAMPLE
SWITCH DESCRIPTION
INPUT
-host-timeout <time> 1s; 4m; 2h Give up on target after this long
https://www.stationx.net/nmap-cheat-sheet/ 6/18
7/3/23, 8:50 PM Nmap Cheat Sheet 2023: All the Commands, Flags & Switches
EXAMPLE
SWITCH DESCRIPTION
INPUT
-min-rtt-timeout/max-rtt-timeout/initial-
1s; 4m; 2h Specifies probe round trip time
rtt-timeout <time>
-min-hostgroup/max-
50; 1024 Parallel host scan group sizes
hostgroup <size<size>
-min-parallelism/max-
10; 1 Probe parallelization
parallelism <numprobes>
Specify the maximum number of port
-max-retries <tries> 3
scan probe retransmissions
Send packets no slower
-min-rate <number> 100
than <number> per second
Send packets no faster than <number>
-max-rate <number> 100
per second
NSE Scripts
SWITCH EXAMPLE DESCRIPTION
Scan with default NSE scripts.
-sC nmap 192.168.1.1 -sC Considered useful for discovery and
safe
Scan with default NSE scripts.
-script
nmap 192.168.1.1 -script default Considered useful for discovery and
default
safe
Scan with a single script. Example
-script nmap 192.168.1.1 -script=banner
banner
-script nmap 192.168.1.1 -script=http* Scan with a wildcard. Example http
Scan with two scripts. Example http
-script nmap 192.168.1.1 -script=http,banner
and banner
https://www.stationx.net/nmap-cheat-sheet/ 7/18
7/3/23, 8:50 PM Nmap Cheat Sheet 2023: All the Commands, Flags & Switches
SWITCH EXAMPLE DESCRIPTION
Scan default, but remove intrusive
-script nmap 192.168.1.1 -script "not intrusive"
scripts
-script- nmap -script snmp-sysdescr -script-args
NSE script with arguments
args snmpcommunity=admin 192.168.1.1
Useful NSE Script Examples
COMMAND DESCRIPTION
nmap -Pn -script=http-sitemap-generator scanme.nmap.org http site map generator
nmap -n -Pn -p 80 -open -sV -vvv -script banner,http-title -iR Fast search for random web
1000 servers
Brute forces DNS hostnames
nmap -Pn -script=dns-brute domain.com
guessing subdomains
nmap -n -Pn -vv -O -sV -script smb-enum*,smb-ls,smb-
mbenum,smb-os-discovery,smb-s*,smb-vuln*,smbv2* -vv Safe SMB scripts to run
192.168.1.1
nmap -script whois* domain.com Whois query
nmap -p80 -script http-unsafe-output-escaping Detect cross site scripting
scanme.nmap.org vulnerabilities
nmap -p80 -script http-sql-injection scanme.nmap.org Check for SQL injections
Firewall / IDS Evasion and Spoofing
SWITCH EXAMPLE DESCRIPTION
Requested scan
(including ping scans)
-f nmap 192.168.1.1 -f use tiny fragmented
IP packets. Harder for
packet filters
https://www.stationx.net/nmap-cheat-sheet/ 8/18
7/3/23, 8:50 PM Nmap Cheat Sheet 2023: All the Commands, Flags & Switches
SWITCH EXAMPLE DESCRIPTION
Set your own offset
-mtu nmap 192.168.1.1 -mtu 32
size
nmap -D
Send scans from
-D 192.168.1.101,192.168.1.102,192.168.1.103,192.168.1.23
spoofed IPs
192.168.1.1
nmap -D decoy-ip1,decoy-ip2,your-own-ip,decoy-ip3,decoy- Above example
-D
ip4 remote-host-ip explained
Scan Facebook from
-S nmap -S www.microsoft.com www.facebook.com Microsoft (-e eth0 -Pn
may be required)
Use given source port
-g nmap -g 53 192.168.1.1
number
Relay connections
nmap -proxies http://192.168.1.1:8080, through
-proxies
http://192.168.1.2:8080 192.168.1.1 HTTP/SOCKS4
proxies
-data- Appends random data
nmap -data-length 200 192.168.1.1
length to sent packets
Example IDS Evasion command
nmap -f -t 0 -n -Pn --data-length 200 -D
192.168.1.101,192.168.1.102,192.168.1.103,192.168.1.23 192.168.1.1
Output
SWITCH EXAMPLE DESCRIPTION
nmap 192.168.1.1 -oN
-oN Normal output to the file normal.file
normal.file
-oX nmap 192.168.1.1 -oX xml.file XML output to the file xml.file
https://www.stationx.net/nmap-cheat-sheet/ 9/18
7/3/23, 8:50 PM Nmap Cheat Sheet 2023: All the Commands, Flags & Switches
SWITCH EXAMPLE DESCRIPTION
-oG nmap 192.168.1.1 -oG grep.file Grepable output to the file grep.file
-oA nmap 192.168.1.1 -oA results Output in the three major formats at once
Grepable output to screen. -oN -, -oX - also
-oG - nmap 192.168.1.1 -oG -
usable
-append- nmap 192.168.1.1 -oN file.file -
Append a scan to a previous scan file
output append-output
Increase the verbosity level (use -vv or more
-v nmap 192.168.1.1 -v
for greater effect)
Increase debugging level (use -dd or more for
-d nmap 192.168.1.1 -d
greater effect)
Display the reason a port is in a particular
-reason nmap 192.168.1.1 -reason
state, same output as -vv
-open nmap 192.168.1.1 -open Only show open (or possibly open) ports
-packet- nmap 192.168.1.1 -T4 -packet-
Show all packets sent and received
trace trace
-iflist nmap -iflist Shows the host interfaces and routes
-resume nmap -resume results.file Resume a scan
https://www.stationx.net/nmap-cheat-sheet/ 10/18
7/3/23, 8:50 PM Nmap Cheat Sheet 2023: All the Commands, Flags & Switches
Download the PDF Version of This NMAP Cheat Sheet!
Want to keep this cheat sheet at your fingertips? Just enter your email address, and we’ll
send a PDF copy to your inbox.
Email Address
DOWNLOAD
Helpful Nmap Output examples
COMMAND DESCRIPTION
nmap -p80 -sV -oG - -open 192.168.1.1/24 | Scan for web servers and grep to show which
grep open IPs are running web servers
00:00
nmap -iR 10 -n -oX out.xml | grep "Nmap" | cut
00:00
Generate a list of the IPs of live hosts
1
-d " " -f5 > live-hosts.txt
nmap -iR 10 -n -oX out2.xml | grep "Nmap" |
Append IP to the list of live hosts
cut -d " " -f5 >> live-hosts.txt
ndiff scanl.xml scan2.xml Compare output from nmap using the ndif
https://www.stationx.net/nmap-cheat-sheet/ 11/18
7/3/23, 8:50 PM Nmap Cheat Sheet 2023: All the Commands, Flags & Switches
COMMAND DESCRIPTION
xsltproc nmap.xml -o nmap.html Convert nmap xml files to html files
grep " open " results.nmap | sed -r ‘s/ +/ /g’ | sort
Reverse sorted list of how often ports turn up
| uniq -c | sort -rn | less
Miscellaneous Nmap Flags
SWITCH EXAMPLE DESCRIPTION
-6 nmap -6 2607:f0d0:1002:51::4 Enable IPv6 scanning
-h nmap -h nmap help screen
Other Useful Nmap Commands
COMMAND DESCRIPTION
nmap -iR 10 -PS22-
Discovery only on ports x, no port scan
25,80,113,1050,35000 -v -sn
nmap 192.168.1.1-1/24 -PR -sn -vv Arp discovery only on local network, no port scan
nmap -iR 10 -sn -traceroute Traceroute to random targets, no port scan
nmap 192.168.1.1-50 -sL -dns-
Query the Internal DNS for hosts, list targets only
server 192.168.1.1
Show the details of the packets that are sent and
nmap 192.168.1.1 --packet-trace
received during a scan and capture the traffic.
You are only doing yourself a disservice by failing to learn and utilize all of Nmap’s
features. It 00:00
is the first go-to tool you will use in the scanning and00:00
many assessments, setting the foundation for the rest of your pentest.
enumeration
1 stage of
Keep a copy of this Nmap cheat sheet to refer back to, and consider our Complete Nmap
Ethical Hacking Course. It, and many other ethical hacking courses, are available in our
VIP Member’s Section.
https://www.stationx.net/nmap-cheat-sheet/ 12/18
