Top 70 Nmap commands with syntax 2023

Table of Contents

What is Nmap?

Nmap (Network Mapper) is a free and open-source network exploration and security auditing tool. It is used to discover hosts and services on a network, as well as to identify potential security vulnerabilities. Nmap uses various techniques such as port scanning, OS detection, version detection, and scriptable interactions to gather information about network hosts and their services.

Nmap can be used to perform a wide range of tasks, including network inventory, vulnerability assessment, and penetration testing. It is commonly used by system administrators, security professionals, and penetration testers to assess the security of their networks.

Some of the key features of Nmap include:

Host discovery:

Nmap can be used to scan a network to identify all the active hosts on it.

Port scanning:

Nmap can scan the open ports on a network host to determine the services that are running.

Operating System detection:

Nmap can determine the operating system running on a network host.

Service version detection:

Nmap can detect the version of the services running on a network host.

Scriptable interaction:

Nmap provides a scripting engine that can be used to automate complex interactions with network hosts.

Nmap commands with Syntax:

Scanning an IP

Syntax: nmap <target-ip>

Scanning a HOST

Syntax: nmap < www.example.com >

Scanning a range of IPs

Syntax: nmap <ip-address-range>

Scanning a Subnet

Syntax: nmap <ip-address/24>

Scanning a Targets from a Text File

Syntax: nmap -iL <list.txt>

Scanning target & Ignore Discovery

Syntax: nmap -target-ip <-Pn>

Scanning target & Host Discovery

Syntax: nmap -target-ip <-sP>

Scan a Single Port

Syntax: nmap <target-ip> <-p port numbers>

Also Read:

Scan a range of ports

Syntax: nmap <target-ip> <-p firstport-lastport>

Scan all ports (65535)

Syntax: nmap <target-ip><-p->

Scan TCP or UDP Ports

Syntax: nmap <target-ip><-p U:port, T:port>

Fast Port Scan

Syntax: nmap <target-ip><-F> -v

No Randomise Port Scan

Syntax: nmap <target-ip><-r> -v

Nmap Top Ports Scan

Syntax: nmap <target-ip><—top-ports N> -v

Nmap Port Ratio Scan

Syntax: nmap <target-ip><—ports-ratio > -v

Port-knocking an obfuscation-as-security technique.

Syntax: for x in 1-10000; do nmap -Pn -p $x server_ip_address;

Standard Service Detection

Syntax: nmap <target-ip><-sV>

Light Service Detection

Syntax: nmap <target-ip><-sV —version-intensity 0>

Aggressive Service Detection

Syntax: nmap <target-ip><-sV —version-intensity 5>

OS Detection

Syntax: nmap <target-ip> <-O >

OS Detection

Syntax: nmap <target-ip> <—max-os-tries>

OS Detection

Syntax: nmap <target-ip><—osscan-limit >

OS Detection

Syntax: nmap <target-ip><—osscan-guess; —fuzzy >

OS Detection

Syntax: nmap <target-ip><—script —smb-os-discovery >

Save Normal Output to File

Syntax: nmap <target-ip><-oN file.txt>

Save XML Output to File

Syntax: nmap <target-ip><-oX file.txt>

Save XML to CSV for Recon

Syntax: nmap <target-ip><-oX file.txt>

Python parsey.py op.xml op.csv

Save “Grep”able Output to File

Syntax: nmap <target-ip><-oG file.txt>

ScRipT K1dd3 Output to File

Syntax: nmap <target-ip><-oS file.txt>

Save All Types Output to File

Syntax: nmap <target-ip><-oA file.txt>

Scan using Default Safe Scripts

Syntax: nmap <target-ip><-sC>

Getting Help for any Scripts

Syntax: nmap <target-ip><—script-help=scriptname>

Nmap Script Args

Syntax: nmap <target-ip><—script=scriptname —scriptargs>

Scan using specific Scripts

Syntax: nmap <target-ip><—script=script name.nse>

Scan using set of Scripts

Syntax: nmap <target-ip><—script=“http-*”>

Update Script Database

Syntax: nmap <target-ip><—script=updatedb>

Safe Scripts

Syntax: nmap <target-ip><—script=safe,default>

Vulnerability Scripts

Syntax: nmap <target-ip><—script=vuln>

DOS Scripts

Syntax: nmap <target-ip><—script=dos>

Exploit Scripts

Syntax: nmap <target-ip><—script=exploit>

Malware Scripts

Syntax: nmap <target-ip><—script=http-malware-host>

Intrusive Scripts

Syntax: nmap <target-ip><—script=intrusive>

NOT including Scripts

Syntax: nmap <target-ip><—script=not script type>

Boolean Expression Scan

Syntax: nmap <target-ip><—script=and or not script type>

Traceroute Scan

Syntax: nmap <target-ip><—traceroute>

Trace Traffic & Geo Resolution Scan

Syntax: nmap <target-ip><—script=traceroutegeolocation>

DNS BruteForce Scan

Syntax: nmap <target-ip><—script=dns-brute.nse>

Find Hosts on IP Scan

Syntax: nmap <target-ip> <—script=hostmap-bfk.nse>

Whois Scan

Syntax: nmap <target-ip><—script=whois-ip, whoisdomain>

Robots Scan

Syntax: nmap <target-ip><—script=http-robots.txt>

WAF Detect Scan

Syntax: nmap <target-ip><—script=http-waf-detect>

WAF Fingerprint Scan

Syntax: nmap <target-ip><—script=http-waf-fingerprint>

Wafw00f vs Nmap Scan

Syntax: wafw00f <target.com>

Syntax: nmap <target-ip><—script=http-waf-fingerprint>

Firewalk Scan

Syntax: nmap <target-ip><—script=firewalk —traceroute>

Shodan Scan

Syntax: nmap <target-ip><—script=shodan-api>

Email Enumeration

Syntax: nmap <target-ip><—script=http-grep>

Nmap Crawlers Scan

Syntax: nmap <target-ip><—script=http-useragent-tester>

Nmap Discovering Directories Scan

Syntax: nmap <target-ip><—script=http-enum>

Nmap Open Relay Scan

Syntax: nmap <target-ip><—script=smtp-open-relay>

Nmap SMTP User Enum Scan

Syntax: nmap <target-ip><—script=smtp-enum-users>

Nmap SMTP Password Attack Scan

Syntax: nmap <target-ip><—script=smtp-brute>

Nmap SMTP Backdoor Detect Scan

Syntax: nmap <target-ip><—script=smtp-strangeport>

Nmap POP3 Capabilities Scan

Syntax: nmap <target-ip><—script=pop3-capabilities>

Nmap IMAP Capabilities Scan

Syntax: nmap <target-ip><—script=imap-capabilities>

Nmap Cloak Scan with Decoy

Syntax: nmap <target-ip><-D>

Nmap Spoof Mac Address

Syntax: nmap <target-ip><—spoof-mac>

Nmap Select Interface

Syntax: nmap <target-ip><-e ethO>

Nmap Source Port Modify

Syntax: nmap <target-ip><—source-port 7890>

Nmap Fake TTL

Syntax: nmap <target-ip><—ttl 128>

Nmap Relay Proxies

Syntax: nmap <target-ip><—proxies proxy:port>

Nmap Bogus TCP/UDP Checksum

Syntax: nmap <target-ip><—badsum>

Nmap Bogus Fragment Scan

Syntax: nmap <target-ip> <-f>

Nmap MTU Scan

Syntax: nmap <target-ip><-mtu 8>

Also Read: