Nmap Commands

Fast Scan

Cyber security experts, network administrators using Nmap (“Network Mapper”) open source tool for network exploration and security auditing. If you want to scan your target with nmap tool without any additional installations, skills, or it is lazy to configure or open terminal and enter this commands then nmap.online for you.

nmap command

nmap -F [hostname]

[hostname] - is your host name or IP address

This command scan just the most popular 100 ports with the -F (fast scan) option.

Nmap Scan

nmap command

nmap [hostname]

[hostname] - is your domain name or IP address

Scan Nmap ports on a remote system.

Port scan

nmap command

nmap -sV -p 21,22,25,80,110,143,443,445 [hostname]

[hostname] - is your domain name or IP address

TCP scan for FTP(21), SSH(22), SMTP(25), HTTP(80), POP(110), IMAP(143), HTTPS(443), SMB(445). Service detection (-sV) is also enabled in this port scanning configuration and you will get the version of the running services.

Ping Scan

nmap command

nmap -sP [hostname]

[hostname] - is your domain name or IP address

This option tells Nmap to only perform a ping scan, then print out the available hosts that responded to the scan. No further testing (such as port scanning or OS detection) is performed. This is one step more intrusive than a list scan, and can often be used for the same purposes. It performs light reconnaissance of a target network quickly and without attracting much attention. Knowing how many hosts are up is more valuable to attackers than the list of every single IP and host name.

Scan OS information and Traceroute

nmap command

nmap -A [hostname]

[hostname] - is your host name or IP address

To identify operating system (OS) on target, which is useful for an inventory sweep of your network. 
Use the -A switch to determine the OS for a remote system.

HTTP Headers Script

The http-headers script performs a HEAD request for the root folder ("/") of a web server and displays the HTTP headers returned.

nmap command

nmap --script http-headers [hostname]

[hostname] - is your host name or IP address
 

Banner grabbing

A simple banner grabber which connects to an open TCP port and prints out anything sent by the listening service within five seconds.

The banner will be truncated to fit into a single line, but an extra line may be printed for every increase in the level of verbosity requested on the command line.

nmap command

nmap --script banner [hostname]

[hostname] - is your host name or IP address
 

Forward-confirmed Reverse DNS

nmap command

nmap -sn -Pn --script fcrdns  [hostname]

[hostname] - is your domain name or IP address

Performs a Forward-confirmed Reverse DNS lookup and reports anomalous results.

OS Detection

nmap command

nmap -O [hostname]

[hostname] - is your domain name or IP address

One of Nmap's best-known features is remote OS detection using TCP/IP stack fingerprinting. Nmap sends a series of TCP and UDP packets to the remote host and examines practically every bit in the responses. 
Command with -O Enables OS detection on nmap scan.
 

HTTP Vulnerabilities

Check all HTTP Vulnerabilities

nmap command

nmap --script "http-vuln*" [hostname]

[hostname] - is your host name or IP address

log4shell

Nmap NSE scripts to check against log4shell or LogJam vulnerabilities (CVE-2021-44228). 

CVE-2021-41773 Path Traversal

Check CVE-2021-41773 Path Traversal vulnerability affecting Apache Web Server version 2.4.49.

nmap command

nmap --script=http-vuln-cve-2021-41773 [hostname]

[hostname] - is your host name or IP address

Determining Firewall Rules

nmap command

nmap -sA [hostname]

[hostname] - is your host name or IP address

-sA (TCP ACK scan)

When scanning unfiltered systems, open and closed ports will both return a RST packet. Nmap then labels them as unfiltered, meaning that they are reachable by the ACK packet, but whether they are open or closed is undetermined. Ports that don't respond, or send certain ICMP error messages back, are labeled filtered. 

Nmap responses to ACK scan
TCP RST response - unfiltered
No response received (even after retransmissions) - filtered
ICMP unreachable error (type 3, code 1, 2, 3, 9, 10, or 13) - filtered

Scan most popular ports

nmap command

nmap --top-ports [x] [hostname]

[x] - a number to find the most common ports

[hostname] - is your domain name or IP address

Scan the top [x] most common ports.

Scan All Ports

To specify all ports in nmap is a dash. We can use -p- which is more practical then port range specification.

Use -sU for UDP protocol specification.


nmap commands

TCP scanning:
nmap -p- [hostname]

UDP scanning:
nmap -sU -p- [hostname]

[hostname] - is your domain name or IP address

Scan TCP or UDP protocols

nmap command

TCP scanning:
nmap -sT [hostname]

UDP scanning:
nmap -sU [hostname]

[hostname] - is your domain name or IP address

Scan TCP or UDP-based services

Detecting malware infections

nmap command

nmap -sV --script=http-malware-host [hostname]

[hostname] - is your domain name or IP address

Detect malware and backdoors by running extensive tests on a few popular OS services like on Identd, Proftpd, Vsftpd, IRC, SMB, and SMTP.