> For the complete documentation index, see [llms.txt](https://d3ndr1t30x.gitbook.io/breaking-things-a-junior-pentesters-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://d3ndr1t30x.gitbook.io/breaking-things-a-junior-pentesters-guide/nmap-cheat-sheet.md). # Nmap cheat sheet Credit to 0x0SojalSec for the original twitter post. You can find it here: {% embed url="" %} The commands are laid out below for convenience {% endembed %} **Fragmented scan** ``` nmap -f ``` **change default MTU size number must be a multiple of 8 (8,16,24,32 etc)** ``` nmap-mtu 24 ``` **Generates a random number of decoys** ``` nmap -D RND:10 [target] ``` **Manually specify the IP addresses of the decoys** ``` nmap -D decoy1, decoy2, decoy3 etc ``` **Idle Zombie Scan, first t need to find zombie ip** ``` nmap -SI [Zombie IP] [Target IP] ``` **Source port number specification** ``` nmap -source-port 80 IP ``` **Append Random Data to scan packages** ``` nmap -data-length 25 IP ``` **MAC Address Spoofing, generate different mac for host pc** ``` nmap --spoof-mac Dell/Apple/3Com IP ``` **My Default** ``` mkdir nmap && sudo nmap -sC -sV -oA nmap/scan ``` **All ports** ``` sudo nmap -p- -oA nmap/all-ports ``` **0xdf nmap configuration** ``` nmap -p- --min-rate 10000 -oA scans/nmap-alltcp ``` **0xdf in depth scan** ``` nmap -p [PORTS] -sCV -oA [OUTPUT_FILE] [TARGET_IP] ``` ``` nmap -sC -sV -p- -oA full ``` **disables the ping scan** ``` nmap -Pn 10.4.19.218 ``` **no ping scan and fast scan option** ``` nmap -Pn -F 10.4.19.218 ``` **disable ping scan, fast scan, service version detection, operating system detection, default script scan, specifying a scan speed option, verbose option** ``` nmap -Pn -F -sV -O -sC -T5 10.4.19.218 -v ``` **disable ping scan, fast scan, outputting results to a text file** ``` nmap -Pn -F 10.4.19.218 -oN test.txt ``` **scanning a subnet for open ports with the T4 scan setting** ``` nmap -T4 10.4.20.0/20 --open ``` conducting a vulnerability scan ``` sudo nmap --script vuln -oA nmap/vuln 10.10.10.79 ```