N-MAP.
md 2025-01-06
Nmap Deep Notes
Index
1. Introduction to Nmap
2. Host Discovery
Specifying Targets
-sn Ping Scan
Additional Tips for Host Discovery
-sL List Scan
3. Port Scanning
TCP Scans
-sT Full TCP Connect Scan
-sS SYN Stealth Scan
UDP Scans
-sU UDP Scan
Limiting Target Ports
4. Version Detection
Techniques: -sV, -A
5. Saving Scan Results
6. Advanced Techniques
Timing and Performance
Verbose and Debugging Modes
7. Summary Table
Introduction to Nmap
Attribute Details
Name Nmap (Network Mapper)
Created By Gordon Lyon (Fyodor)
First Released 1997
Primary Use Network discovery, security auditing
Short History:
Nmap was first released in 1997 and has become one of the most widely used network exploration and
security auditing tools. It helps security professionals assess the status of networks, services, and hosts by
scanning for live devices, open ports, and service versions.
K.H.Patil
1/8
N-MAP.md 2025-01-06
Host Discovery
Specifying Targets
You can specify the target(s) for a scan in the following ways:
Type Example
Specific IP Address 192.168.1.1
Range of IPs 192.168.1.1-50
Subnet 192.168.1.0/24
Example Command:
nmap 192.168.1.0/24
-sn Ping Scan
The -sn option performs a ping scan, which only checks for live hosts without scanning ports. The scan uses
different methods depending on the network environment.
Environment Actions Taken
Local Network Sends ARP requests to identify live hosts.
Remote Network Sends ICMP Echo Requests, TCP SYN packets to port 443, and TCP ACK packets to
(WAN) port 80 to identify live hosts.
Flag Description
ICMP Echo Sends Type 8 (Echo Request)
TCP SYN Sends SYN packet to port 443
TCP ACK Sends ACK packet to port 80
Example Command:
nmap -sn 192.168.1.0/24
Additional Tips for Host Discovery
Flag Purpose Example
-pS TCP SYN-based host discovery nmap -sn -pS22,443 192.168.1.0/24
2/8
N-MAP.md 2025-01-06
Flag Purpose Example
-pA TCP ACK-based host discovery nmap -sn -pA80 192.168.1.0/24
-pU UDP-based host discovery nmap -sn -pU161 192.168.1.0/24
-sL List Scan
The -sL option performs a list scan, where Nmap only lists the targets without sending any probes. This can
be useful to check the list of hosts that will be scanned.
Example Command:
nmap -sL 192.168.1.0/24
Port Scanning
TCP Scans
-sT Full TCP Connect Scan
A Full TCP Connect Scan (-sT) attempts to complete the three-way TCP handshake (SYN, SYN-ACK, ACK) to
detect open ports.
Port State Description
Open Completes the 3-way handshake
Closed Responds with a TCP RST (reset)
Command Example:
nmap -sT 192.168.1.1
Top 10 TCP Ports for -sT Scan
Port Service
22 SSH
80 HTTP
443 HTTPS
21 FTP
25 SMTP
3/8
N-MAP.md 2025-01-06
Port Service
110 POP3
143 IMAP
3306 MySQL
3389 RDP
53 DNS
-sS SYN Stealth Scan
A SYN Stealth Scan (-sS) sends a SYN packet to the target and waits for a response. If the target is open, it
responds with a SYN-ACK. The connection is never fully established, making it harder to detect.
Port State Description
Open Sends SYN-ACK response
Closed Sends RST (reset) response
Command Example:
nmap -sS 192.168.1.1
Top 10 TCP Ports for -sS Scan
Port Service
22 SSH
80 HTTP
443 HTTPS
21 FTP
25 SMTP
110 POP3
143 IMAP
3306 MySQL
3389 RDP
53 DNS
UDP Scans
4/8
N-MAP.md 2025-01-06
-sU UDP Scan
A UDP Scan (-sU) detects open UDP ports by sending a packet and awaiting a response. Open UDP ports
may respond with a valid message, while closed ports often reply with an ICMP unreachable message.
Port State Description
Open Receives a response or no response (depending on service)
Closed Receives an ICMP Type 3 (Destination Unreachable) response
Command Example:
nmap -sU 192.168.1.1
Top 10 UDP Ports for -sU Scan
Port Service
53 DNS
67 DHCP
68 DHCP
69 TFTP
123 NTP
161 SNMP
162 SNMP Trap
500 ISAKMP
514 Syslog
33434 Traceroute
Limiting Target Ports
By default, Nmap scans the top 1000 ports. You can limit the scan to specific ports using options like -F (fast
scan) or -p (range/specific ports).
Option Purpose Example
-F Scans only the top 100 ports nmap -F 192.168.1.1
-p Specifies ports to scan nmap -p 22,80,443 192.168.1.1
Version Detection
5/8
N-MAP.md 2025-01-06
What is it?
Version detection (-sV) allows Nmap to detect versions of services running on open ports. This can help
identify vulnerabilities and misconfigurations.
Why is it useful?
Helps identify outdated software versions.
Enables the detection of potential vulnerabilities in specific services.
How to use it?
Flag Purpose
-sV Service and version detection
-A Aggressive scan (includes service detection)
-Pn Skip host discovery
Example Command:
nmap -sV 192.168.1.1
Saving Scan Results
What is it?
Saving scan results is important for record-keeping, further analysis, or generating reports. Nmap provides
several output formats.
Flag Format Purpose
-oN Normal Saves plain-text human-readable output
-oX XML Saves machine-readable structured XML format
-oG Grepable Saves grep-friendly plain-text format
-oA All formats Saves results in all available formats simultaneously
Command Examples:
1. Save output in human-readable text:
nmap -oN output.txt 192.168.1.1
2. Save output in XML:
6/8
N-MAP.md 2025-01-06
nmap -oX output.xml 192.168.1.1
3. Save all formats:
nmap -oA results 192.168.1.1
Advanced Techniques
K.H.Patil
Timing and Performance
Timing Template Description Best Use Case
T0 Paranoid Avoiding detection in highly secure environments.
T1 Sneaky Slightly faster but still stealthy.
T2 Polite Slow scans for unstable networks.
T3 Normal Default for balanced speed and reliability.
T4 Aggressive Fast scans, may trigger IDS.
T5 Insane Maximum speed, likely to overwhelm targets.
Command Example:
nmap -T4 192.168.1.1
Verbose and Debugging Modes
Flag Description
-v Basic verbosity
-vv More details
-vvv Maximum verbosity
-d Basic debugging
-dd More detailed debugging
Command Example:
7/8
N-MAP.md 2025-01-06
nmap -vv -d 192.168.1.1
Summary Table
Feature Purpose Commands/Flags
Timing and -T0 to -T5, --min-rate, --max-
Optimizes scan speed and stealth
Performance parallelism
Verbose and Shows detailed scan progress and
-v, -vv, -d, -dd
Debugging packet info
Saving Scan Results Stores scan results in reusable formats -oN, -oX, -oG, -oA
K.H.Patil
8/8
