Nmap

Overview

Nmap (Network Mapper) is the essential first tool on any engagement. It discovers live hosts, open ports, running services, OS fingerprints, and can execute NSE scripts against targets.

Common Scans

Full TCP scan — service versions + default scripts, save all formats

nmap -sCV -p- <target> -oA scans/full

Fast top-1000 ports

nmap -sC -sV <target>

UDP scan (slow — run selectively)

sudo nmap -sU --top-ports 50 <target>

Aggressive (OS detect + traceroute + scripts)

nmap -A <target>

Stealth SYN scan

sudo nmap -sS <target>

Host discovery only (no port scan)

nmap -sn 10.10.10.0/24

Skip host discovery (treat all as up)

nmap -Pn <target>

Useful NSE Scripts

Run all default scripts

nmap -sC <target>

Specific script

nmap --script=http-enum <target>

Vulnerability category

nmap --script=vuln <target>

SMB signing check

nmap --script smb2-security-mode -p 445 <target>

Kerberos user enum

nmap -p 88 --script krb5-enum-users --script-args krb5-enum-users.realm='domain.local' <DC>

Tips

• Always save with -oA — generates .nmap, .xml, .gnmap
• Use -T4 on stable networks; -T2 for stealth
• Parse gnmap: grep "open" scan.gnmap | awk '{print $2}'

nmap [Scan Type(s)] [Options] {target specification}

TARGET SPECIFICATION:
  Hostnames, IPs, networks: 192.168.1.1, 192.168.1.0/24, 10.0.0-255.1-254

SCAN TYPES:
  -sS   TCP SYN (stealth, requires root)
  -sT   TCP Connect (no root needed)
  -sU   UDP scan
  -sn   Ping scan (no port scan)
  -Pn   Skip host discovery

PORT SPECIFICATION:
  -p 22           Single port
  -p 22,80,443    Multiple ports
  -p-             All 65535 ports
  -p 1-1000       Range
  --top-ports 100 Top N most common

SERVICE/OS DETECTION:
  -sV             Service version detection
  -O              OS detection
  -A              Aggressive (sV + O + scripts + traceroute)

SCRIPTS:
  -sC             Default scripts
  --script=<name> Specific script
  --script=vuln   Script category

OUTPUT:
  -oN file.txt    Normal output
  -oX file.xml    XML output
  -oG file.gnmap  Grepable output
  -oA basename    All three formats

TIMING:
  -T0 Paranoid  -T1 Sneaky  -T2 Polite
  -T3 Normal    -T4 Aggressive  -T5 Insane

Vue d’ensemble

Nmap (Network Mapper) est l’outil indispensable en début de mission. Il découvre les hôtes actifs, les ports ouverts, les services en cours d’exécution, les empreintes OS, et peut exécuter des scripts NSE contre les cibles.

Scans courants

# Scan TCP complet : versions de services + scripts par défaut, sauvegarder tous les formats
nmap -sCV -p- <target> -oA scans/full

# Top 1000 ports (rapide)
nmap -sC -sV <target>

# Scan UDP (lent : lancer de manière sélective)
sudo nmap -sU --top-ports 50 <target>

# Agressif (détection OS + traceroute + scripts)
nmap -A <target>

# Scan SYN furtif
sudo nmap -sS <target>

# Découverte d'hôtes uniquement (pas de scan de ports)
nmap -sn 10.10.10.0/24

# Ignorer la découverte d'hôtes (traiter tous comme actifs)
nmap -Pn <target>

Scripts NSE utiles

# Lancer tous les scripts par défaut
nmap -sC <target>

# Script spécifique
nmap --script=http-enum <target>

# Catégorie vulnérabilités
nmap --script=vuln <target>

# Vérification de la signature SMB
nmap --script smb2-security-mode -p 445 <target>

# Énumération d'utilisateurs Kerberos
nmap -p 88 --script krb5-enum-users --script-args krb5-enum-users.realm='domain.local' <DC>

Conseils

• Toujours sauvegarder avec -oA : génère .nmap, .xml, .gnmap
• Utiliser -T4 sur les réseaux stables ; -T2 pour la discrétion
• Parser le gnmap : grep "open" scan.gnmap | awk '{print $2}'

nmap [Scan Type(s)] [Options] {target specification}

TARGET SPECIFICATION:
  Hostnames, IPs, networks: 192.168.1.1, 192.168.1.0/24, 10.0.0-255.1-254

SCAN TYPES:
  -sS   TCP SYN (stealth, requires root)
  -sT   TCP Connect (no root needed)
  -sU   UDP scan
  -sn   Ping scan (no port scan)
  -Pn   Skip host discovery

PORT SPECIFICATION:
  -p 22           Single port
  -p 22,80,443    Multiple ports
  -p-             All 65535 ports
  -p 1-1000       Range
  --top-ports 100 Top N most common

SERVICE/OS DETECTION:
  -sV             Service version detection
  -O              OS detection
  -A              Aggressive (sV + O + scripts + traceroute)

SCRIPTS:
  -sC             Default scripts
  --script=<name> Specific script
  --script=vuln   Script category

OUTPUT:
  -oN file.txt    Normal output
  -oX file.xml    XML output
  -oG file.gnmap  Grepable output
  -oA basename    All three formats

TIMING:
  -T0 Paranoid  -T1 Sneaky  -T2 Polite
  -T3 Normal    -T4 Aggressive  -T5 Insane