Nmap cheat sheet by Avi

 nmap -T4 -p- -A 192.168.57.134

-T4 --> Is for how fast the scan would finish. Range is 1-5. 5 is too noisy. You may get caught. Slow is for remain undetected. 4 is ideal. 

-p- --> It will scan all ports 65535. If you do not mention -p- switch then it will scan by default 1000 ports.

-p for single port or range of port like 80 or 80,443,53

-p 22 or -p 80,443 or -p 1-65535

-A --> Give us all information that you have got. OS info, version number, everything. Also called aggressive scan. -A includes -sC, -O, -sV etc.

-sT --> Works like a tcp 3-way handshake. Called tcp scan or tcp connect scan.

-sS for SYN scan or stealthy scan. It is called stealthy because instead of sending SYN SYN/ACK ACK, it sends SYN SYN/ACK RST

-sn for ping scan. Disable port scan. I dont want to know the port status. I only want to see the host is up or not.

-Pn --> I know some hosts are online but they are not reply to my ping request. Treat those hosts as online. 

-sV --> Service or version detection. 

-sC or --script=default

--script=vuln     (vuln category script)

-sU --> UDP scan. UDP is connection less so remove -p- and -A switch. Otherwise it will take so much time. 

 

We can also do the following tricky things. 

nmap -T4 -p- 192.168.57.134

Then say we get 22,80,111,139,443,32768 tcp ports open. Now issue the below command:

nmap -T4 -p 22,80,111,139,443,32768 -A 192.168.57.134

This is more efficient way. First we checked how many and what ports are open. Then ran aggressive move to find more details. 

On some ctf challenges:

nmap -sV -sC 10.6.0.2  (will check top 1000 ports) 

nmap -sC -sV -oA nmap/blackfield 10.10.10.192

-oA output all format -->output three major formal at once. The result will be saved on nmap directory and the filename would be blackfield.nmap