NMAP CHEATSHEET - Penetration Testing Reference

HOST DISCOVERY:
-sn : Ping scan, no port scan (host discovery only)
-Pn : Skip host discovery, treat all hosts as online
-PS : TCP SYN ping
-PA : TCP ACK ping

PORT SCANNING TYPES:
-sT : TCP connect scan (no root required, slower)
-sS : TCP SYN scan (requires root, faster, stealthier)
-sU : UDP scan
-sV : Service/version detection
-sC : Default script scan
-A  : Aggressive scan (OS detection, version, scripts, traceroute)

PORT SELECTION:
-p 80,443        : Scan specific ports
-p 1-1000        : Scan port range
-p-              : Scan all 65535 ports
--top-ports 100  : Scan top 100 most common ports

SPEED/TIMING:
-T1 : Slow, stealthy
-T3 : Default
-T4 : Fast (recommended for labs)
-T5 : Insane speed

OUTPUT:
-oN output.txt   : Normal output
-oX output.xml   : XML output
-oG output.gnmap : Grepable output

COMMON COMBINATIONS:
Quick scan        : nmap -T4 --top-ports 100 <target>
Full TCP scan     : nmap -sT -sV -p- -T4 <target>
Stealth scan      : nmap -sS -T2 -p- <target>
Service detection : nmap -sV -sC <target>
Web focused       : nmap -sT -p 80,443,8080,8443 -sV <target>

PENTEST PHASES:
Recon phase      → use -sT --top-ports 1000 -T4
Service enum     → use -sV -sC on discovered ports
Full audit       → use -A on confirmed live hosts


NSE SCRIPTS (correct syntax):
--script vuln              : run all vulnerability scripts
--script default           : same as -sC
--script smb-vuln-ms17-010 : check EternalBlue
--script http-enum         : enumerate web paths
--script banner            : grab service banners
--script ssl-cert          : check SSL certificate

NEVER use: --script=service/version (does not exist)
CORRECT version detection flag: -sV (not a script)