NMAP Cheat Sheet
================

## Base nmap Syntax:

nmap [ScanType] [Options] {targets}

If no port range is specified, Nmap scans the 1,000 most popular ports.

-p -: Scans a port range
-p ,,...: Scans a port list
-pU:53,U:110,T20-445: Mix TCP and UDP
-r: Scans linearly (does not randomize ports)
--top-ports : Scan n most popular ports
-p-65535: Leaving off the initial port in range makes Nmap scan start at port 1
-p-: Leaving off the end port in range makes Nmap scan all ports
-F: (Fast (limited port) scan)

## Port Status

- Open: This indicates that an application is listening for connections on this port.
- Closed: This indicates that the probes were received but there is no application listening on this port.
- Filtered: This indicates that the probes were not received and the state could not be established. It also indicates that the probes are being dropped by some kind of filtering.
- Unfiltered: This indicates that the probes were received but a state could not be established.
- Open/Filtered: This indicates that the port was filtered or open but Nmap couldn’t establish the state.
- Closed/Filtered: This indicates that the port was filtered or closed but Nmap couldn’t establish the state.

## Scan Types

-sn: Probe only (host discovery, not port scan)
-sS: SYN Scan
-sT: TCP Connect Scan
-sU: UDP Scan
-sV: Version Scan
-O: Used for OS Detection/fingerprinting
--scanflags: Sets custom list of TCP using URG ACK PSH RST SYN FIN in any order

## Probing Options

-Pn: Don't probe (assume all hosts are up)
-PB: Default probe (TCP 80, 445 & ICMP)
-PS : Checks if ssytems are online by probing TCP ports
-PE: Using ICMP Echo Request
-PP: Using ICMP Timestamp Request
-PM: Using ICMP Netmask Request

## Timing Options
-T0 (Paranoid): Very slow, used for IDS evasion
-T1 (Sneaky): Quite slow, used for IDS evasion
-T2 (Polite): Slows down to consume less bandwidth, runs ~10 times slower than default
-T3 (Normal): Default, a dynamic timing model based on target responsiveness
-T4 (Aggressive): Assumes a fast and reliable network and may overwhelm targets
-T5 (Insane): Very aggressive; will likely overwhelm targets or miss open ports

## Fine-Grained Timing Options

--min-hostgroup/max-hostgroup  : Parallel host scan group sizes
--min-parallelism/max-parallelism : Probes parallelization
--min-rtt-timeout/max-rtttimeout/initial-rtt-timeout : Specifies probe round trip time.
--max-retries : Caps number of port scan probe retransmissions.
--host-timeout : Gives up on target after this long
--scan-delay/--max-scan-delay : Adjusts delay between probes
--min-rate : Send packets no slower than  per second
--max-rate : Send packets no faster than  per second

## Nmap Scripting Engine

The full list of Nmap Scripting Engine scripts: http://nmap.org/nsedoc/

nmap -sC runs default scripts...

Running individual or groups of scripts:
nmap --script=| |
  
Using the list of script arguments:
nmap --script-args=

Updating the script database:
nmap --script-updatedb


Some particularly useful scripts include:

- dns-zone-transfer: Attempts to pull a zone file (AXFR) from a DNS server.

$ nmap --script dns-zonetransfer.nse --script-args dns-zonetransfer.domain= -p53 


- http-robots.txt: Harvests robots.txt files from discovered web servers.

$ nmap --script http-robots.txt 


- smb-brute: Attempts to determine valid username and password combinations via automated guessing.

$ nmap --script smb-brute.nse -p445 


- smb-psexec: Attempts to run a series of programs on the target machine, using credentials provided as scriptargs.

$ nmap --script smb-psexec.nse –script-args=smbuser=,smbpass=[,config=] -p445 


### Nmap Scripting Engine Categories
The most common Nmap scripting engine categories:
- auth: Utilize credentials or bypass authentication on target hosts.
- broadcast: Discover hosts not included on command line by broadcasting on local network.
- brute: Attempt to guess passwords on target systems, for a variety of protocols, including http, SNMP, IAX, MySQL, VNC, etc.
- default: Scripts run automatically when -sC or -A are used.
- discovery: Try to learn more information about target hosts through public sources of information, SNMP, directory services, and more.
- dos: May cause denial of service conditions in target hosts.
- exploit: Attempt to exploit target systems.
- external: Interact with third-party systems not included in target list.
- fuzzer: Send unexpected input in network protocol fields.
- intrusive: May crash target, consume excessive resources, or otherwise impact target machines in a malicious fashion.
- malware: Look for signs of malware infection on the target hosts.
- safe: Designed not to impact target in a negative fashion.
- version: Measure the version of software or protocols on the target hosts.
- vul: Measure whether target systems have a known vulnerability.

## Output Options

-oN: Standard Nmap output
-oG: Greppable format
-oX: XML format
-oA:  Generate Nmap, Greppable, and XML output files using basename for files
  
 ## Additional Options
 
-n: Disables reverse IP address lookups
-6: Uses IPv6 only
-A: Uses several features, including OS Detection, Version Detection, Script Scanning (default), and traceroute
--reason: Displays the reason Nmap thinks that the port is open, closed, or filtered