> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/reconnaissance/nmap.md).

# Nmap

Nmap reconnaissance notes for port scanning, service detection, NSE scripts, host discovery, firewall evasion, and vulnerability scanning.

Nmap is used during reconnaissance to identify live hosts, open ports, service versions, operating systems, NSE script results, and potential attack paths.

{% hint style="info" %}
**Nmap**, which stands for "*Network Mapper*", is an open source tool used to explore and audit networks, as well as discover hosts and services on a network. It was originally created by Gordon Lyon, also known as Fyodor Vaskovich. Nmap provides network scanning capabilities that allow users to discover devices connected to a network, identify services running on those devices, and obtain detailed information about the network configuration.
{% endhint %}

#### Common commands and option reference:

## Nmap Option Reference

### Target and Host Discovery

| Option               | Description                                              |
| -------------------- | -------------------------------------------------------- |
| `10.10.10.0/24`      | Target network range.                                    |
| `-sL`                | List scan. Lists targets without scanning them.          |
| `-sn`                | Disables port scanning and performs host discovery only. |
| `-Pn`                | Treats hosts as online and skips host discovery probes.  |
| `-n`                 | Disables DNS resolution.                                 |
| `-PE`                | Performs host discovery using ICMP Echo Requests.        |
| `--disable-arp-ping` | Disables ARP ping requests on local networks.            |
| `--dns-server <ns>`  | Performs DNS resolution using the specified name server. |

### Port Selection and Scan Types

| Option              | Description                                                                   |
| ------------------- | ----------------------------------------------------------------------------- |
| `--open`            | Shows only open ports.                                                        |
| `--top-ports <num>` | Scans the specified number of most common ports.                              |
| `-p-`               | Scans all TCP ports.                                                          |
| `-p22-110`          | Scans all ports between 22 and 110.                                           |
| `-p22,25`           | Scans only the specified ports 22 and 25.                                     |
| `-F`                | Fast scan. Scans the top 100 ports.                                           |
| `-sS`               | Performs a TCP SYN scan.                                                      |
| `-sT`               | Performs a TCP connect scan, useful when SYN scan privileges are unavailable. |
| `-sA`               | Performs a TCP ACK scan, useful for firewall rule mapping.                    |
| `-sU`               | Performs a UDP scan.                                                          |
| `-sV`               | Detects service versions on discovered services.                              |
| `-sC`               | Runs NSE scripts categorized as `default`.                                    |
| `--script <script>` | Runs the specified NSE script or script category.                             |

### Detection and Evasion

| Option                               | Description                                                                   |
| ------------------------------------ | ----------------------------------------------------------------------------- |
| `-O`                                 | Performs OS detection.                                                        |
| `-A`                                 | Enables OS detection, version detection, NSE default scripts, and traceroute. |
| `--packet-trace`                     | Shows packets sent and received.                                              |
| `--reason`                           | Displays the reason Nmap reported a port or host state.                       |
| `-D RND:5`                           | Uses five random decoys for firewall/IDS evasion.                             |
| `-e <interface>`                     | Specifies the network interface used for the scan.                            |
| `-S 10.10.10.200`                    | Specifies the source IP address for the scan.                                 |
| `-g <port>` / `--source-port <port>` | Specifies the source port for the scan.                                       |

### Output Options

| Option         | Description                                                                       |
| -------------- | --------------------------------------------------------------------------------- |
| `-oA filename` | Stores results in all available output formats using `filename` as the base name. |
| `-oN filename` | Stores results in normal format.                                                  |
| `-oG filename` | Stores results in grepable format.                                                |
| `-oX filename` | Stores results in XML format.                                                     |

### Performance Options

| Option                       | Description                                                |
| ---------------------------- | ---------------------------------------------------------- |
| `--max-retries <num>`        | Sets the number of retries for port scan probes.           |
| `--stats-every=5s`           | Displays scan status every 5 seconds.                      |
| `-v` / `-vv`                 | Displays verbose output during the scan.                   |
| `--initial-rtt-timeout 50ms` | Sets the initial RTT timeout.                              |
| `--max-rtt-timeout 100ms`    | Sets the maximum RTT timeout.                              |
| `--min-rate 300`             | Sends packets no slower than the specified rate.           |
| `-T <0-5>`                   | Sets the timing template, from `0` paranoid to `5` insane. |

## **Port scan**

```bash
nmap --open -p- -sS --min-rate 5000 -vvv -n -Pn 192.168.0.1 -oG allPorts
```

Fast full-port TCP SYN scan that skips DNS and host discovery, shows verbose progress, and stores grepable output.

<figure><img src="https://hacking-notes.jord4n.pro/~gitbook/image?url=https%3A%2F%2F3467118603-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FwJ00xYl3QY03Wq54i4By%252Fuploads%252Fe6BGuXp1hLil6uT3Jtic%252Fimage.png%3Falt%3Dmedia%26token%3D96d46423-ca25-4471-a563-42daeae3be1e&#x26;width=768&#x26;dpr=4&#x26;quality=100&#x26;sign=bcba8a61&#x26;sv=1" alt=""><figcaption></figcaption></figure>

## **Port version scan**

```bash
nmap -p22,80,443 -sCV 192.168.0.1 -oN targeted
```

Targeted service and default-script scan against selected ports, saved in normal output format.

<figure><img src="https://hacking-notes.jord4n.pro/~gitbook/image?url=https%3A%2F%2F3467118603-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FwJ00xYl3QY03Wq54i4By%252Fuploads%252F2MsfGLpxVpuiWEE7sRjJ%252Fimage.png%3Falt%3Dmedia%26token%3D767e772a-f3ea-4fee-b266-0c73398b7a4f&#x26;width=768&#x26;dpr=4&#x26;quality=100&#x26;sign=b468a586&#x26;sv=1" alt=""><figcaption></figcaption></figure>

## **Identification of devices connected to the network**

```bash
nmap -sn 192.168.0.1/24
```

Host discovery scan for identifying live systems in a network range without scanning ports.

<figure><img src="https://hacking-notes.jord4n.pro/~gitbook/image?url=https%3A%2F%2F3467118603-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FwJ00xYl3QY03Wq54i4By%252Fuploads%252FEFDeAo8BSjtTrsirRHC8%252Fimage.png%3Falt%3Dmedia%26token%3D679e4610-aa84-4b59-80e0-1a08f0c9140b&#x26;width=768&#x26;dpr=4&#x26;quality=100&#x26;sign=753ed2d0&#x26;sv=1" alt=""><figcaption></figcaption></figure>

## Evading firewalls with Nmap

{% hint style="info" %}
There are several methods to bypass a firewall using the Nmap tool. Below are some of the most used and effective techniques for this purpose
{% endhint %}

### Adjust the size of sent packets

> The MTU or "Maximum Transmission Unit" evasion technique consists of adjusting the size of the packets sent in order to avoid their detection by the firewall. Nmap allows you to manually configure the maximum packet size to ensure that packets are small enough to pass through the firewall without being detected.

```bash
nmap 192.168.0.1 --mtu 8
```

### Add padding data

> This technique involves changing the length of the data sent so that it is short enough not to be detected by the firewall. Nmap allows users to manually configure the length of data sent to evade detection.

```bash
nmap -p22 192.168.0.1 --data-length 21
```

### Manually set the source port number

> This technique involves manually configuring the source port number of sent packets to avoid detection. With Nmap, users can specify a random source port or a specific port to bypass the firewall.

```bash
nmap -p22 192.168.0.1 --source-port 53
```

### Sending fake packets to the network

> This evasion technique allows spoofed packets to be sent across the network in order to confuse intrusion detection systems and avoid detection by the firewall. With the `-D` option, Nmap sends spoofed packets with real packets to hide user activity.

```bash
nmap -p22 192.168.0.1 -D 192.168.0.100,192.168.0.152
```

### Fragmentation of sent packets

> This technique involves fragmenting sent packets so that the firewall cannot identify the traffic as a scan. Nmap's `-f` option allows packets to be fragmented and sent in pieces to evade detection.

```bash
nmap -p22 192.168.0.1 -f
```

### Change packet MAC address

> This evasion technique consists of modifying the MAC address of the packet to avoid its detection by the firewall. Nmap allows you to manually configure the MAC address to disguise traffic.

```bash
nmap -p22 192.168.0.1 --spoof-mac f4:69:42:f4:a7:d0
```

## Vulnerability scanning with Nmap scripts

```bash
nmap --script "vuln and safe" -p445 10.10.10.10 -oN vulnScan
```

> This Nmap script allows you to analyze the vulnerabilities of a specific host. By running scripts from the **vuln** (vulnerabilities) and **safe** (safe scans) category, it identifies possible security vulnerabilities. The results are saved in a file named **vulnScan** for later analysis.

**Linux enumeration (without Credentials)**

```bash
enum4linux -a 10.10.10.10
```

<figure><img src="https://131707722-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fgit-blob-fce72ab9ffa72b4149e4e03a00e2fef1cef79467%2Fimage%20(600).png?alt=media" alt=""><figcaption></figcaption></figure>

**Linux enumeration with Credentials**

```bash
enum4linux -a 10.10.10.10 -u admin -p password1
```

<figure><img src="https://131707722-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fgit-blob-729956858769d747348cf1bc4f10825b000854d4%2Fimage%20(601).png?alt=media" alt=""><figcaption></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://hacking-notes.jord4n.pro/reconnaissance/nmap.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.