Mastering Nmap: Your ultimate cheatsheet for 2024 commands

This post is based on the Hack The Box (HTB) Academy module (or course) on Network Enumeration with Nmap. The module teaches the fundamental skills needed for Nmap to perform effective network enumeration.

You can learn more by browsing the catalog of free or advanced cybersecurity courses on the HTB Academy! 

What is Nmap?

Network Mapper (Nmap) is an open-source network analysis and security auditing tool. It is designed to scan networks and identify which hosts are available on the network using raw packets, services, and applications. 

Nmap can also identify the operating systems and versions of these hosts. It offers scanning capabilities that can determine if packet filters, firewalls, or intrusion detection systems (IDS) are configured as needed.

Every cybersecurity professional should use and understand Nmap to: 

• Gain visibility into networks: Paired with knowledge of network infrastructure and knowing which commands to use, Nmap provides a detailed view of a network’s  landscape.

• Assess targets during vulnerability assessment or pentests: Armed with OS and version data, you can pinpoint vulnerabilities specific to each host.

• Make informed decisions to defend networks: Nmap empowers you to make informed choices—whether it’s tweaking firewall rules or fine-tuning IDS settings.

Haven’t used it yet? You can download it here.

💡Further reading: HTB’s 15 must-know Nmap commands in 2024. This blog covers how to use Nmap, top use cases, and some of the most essential commands.

Nmap commands cheatsheet for key use cases

Nmap is an essential tool for cybersecurity professionals to get comfortable with. Common use cases include: 

• Enumeration: uncover information including device types, reverse DNS (Domain Name System) names, MAC addresses, and IP addresses of all active hosts.

• Auditing: survey the security aspects of a network.

• Testing: simulate penetration tests using Nmap. 

• Find security issues: Scan servers and uncover paths attackers may use to exploit. 

• Detect vulnerabilities: Analysts and pentesters can use Nmap to detect vulnerabilities on the network. 

• Host discovery: discover live hosts within the network.

• Identify open ports: Nmap conducts port scanning of target hosts.

• OS version detection: discover the operating system (OS) and version of a target system quickly. 

We’ve covered all of the commands you need to know, alongside their use cases below.

 

Types of Nmap scans

Nmap supports a whole host of scan types, however, the most common ones include: 

1. TCP connect scans (-sT): Nmap sends a TCP packet to a port with the SYN flag set. This lets the user know whether ports are open, closed, or unknown. However, this isn’t the most reliable scanning method as firewalls can easily drop all incoming packets. 

2. SYN scans (-sS): this scan is stealthier, as Nmap sends an RST packet, which prevents multiple requests and shortens the scan time. 

3. UDP scans (-sU): this scan focuses more on speed over quality, working on the principle of “fire and forget”, rather than waiting for a returning handshake like the previous scans. 

Host discovery

Host discovery is a key way many analysts and pentesters use Nmap. Its purpose is to gain an overview of which systems are online and some additional insight into how we can access these. 

Here are the most essential host discovery Nmap commands:

Service and version detection

When we enumerate using Nmap, determining the application and its version is vital. We can use this information to scan for known vulnerabilities and analyze the source code.

OS detection

For more information during our Nmap enumeration, we may also want to discover what operating systems are being used. 

Network and port scanning

Once we’ve gathered whether a host is active or not, the next step is to understand what state the scanned port is in. There are six different states:

1. Open: a connection to the scanned port has been established.

2. Closed: the TCP protocol indicates that the packet we received back contains an RST flag.

3. Filtered: Nmap cannot correctly identify whether the scanned port is open or closed because either no response is returned from the target for the port or we get an error code from the target.

4. Unfiltered: the port is accessible, but it cannot be determined whether it is open or closed.

5. Open|filtered: this indicates that a firewall or packet filter may protect the port.

6. Closed|filtered: impossible to determine if the scanned port is closed or filtered by a firewall.

Timing and performance

You can tweak Nmap’s timing and performance commands to run scans faster or slower based on your target or working environment.

This enables you to obtain the information you require most while adhering to certain timing constraints. This minimizes the risk of detection when performing a penetration test, for example. 

Generating reports (output)

When conducting any scan using Nmap, we’d always recommend saving your findings. This could be essential for later comparison, documentation, and reporting. After all, different tools may produce different results. 

Here are some key commands to store your Nmap scans:

Firewall evasion

When conducting an Nmap scan, you’ll likely come across some security measures. To effectively perform a penetration test, for example, you’ll need to bypass these. 

This is possible using the following commands:

Nmap scripting engine

Another handy feature of Nmap is the Nmap Scripting Engine (NSE). It provides us with the possibility to create scripts in Lua for interaction with certain services.

These scripts fit into the following categories:

Some useful NSE examples that you may use in your scans include:

Learn Nmap today

Nmap is an extremely powerful tool for all infosec professionals, whether you’re using it to protect your network or perform penetration tests, these commands are essential for all cybersecurity professionals to have at hand.

However, it’s important to not only rely on tools to do your job. You need to also understand how and why these tools work and what the information you find actually means. 

Ready to dive in? 

Find out everything you need to know about Nmap with our Academy module:

Author bio: Dimitrios Bougioukas (Dimitris), Senior Director of IT Security Training Services, Hack The Box Dimitrios has extensive experience in upskilling the IT security teams of Fortune 100/500 tech companies and government organizations. He enjoys analyzing the threat landscape as well as interpreting market and data analytics to assist Hack The Box in devising its training strategy and roadmaps, from go-to-market all the way to the syllabus level.  Prior to Hack The Box, Dimitrios directed the development of training and certifications through eLearnSecurity/INE and was behind certifications like eCPTX, eWPT, and eCIR. You can connect with him on LinkedIn here.