NMAP Switches Flashcards
What is this NMAP switch: -sV
Detect version of service running on port –> scans every open port.
-Pn
nmap 192.168.1.1-5 -Pn
No ping.
This option skips the host discovery stage altogether.
Disabling host discovery with -Pn causes Nmap to attempt the requested scanning functions against every target IP address specified
What is this NMAP switch: -T0 -T1 -T2 -T3…T5
timing & performance. T0 = paranoid, T1 = sneeky (slow), T2 = polite, T3 = normal, T4 = aggressive, T5 = insane
-T0
nmap 192.168.1.1 -T0
Paranoid (0) Intrusion Detection
System evasion
-T1
nmap 192.168.1.1 -T1
Sneaky (1) Intrusion Detection System
evasion
-T2
nmap 192.168.1.1 -T2
Polite (2) slows down the scan to use
less bandwidth and use less target
machine resources
-T3
nmap 192.168.1.1 -T3
Normal (3) which is default speed
-T4
nmap 192.168.1.1 -T4
Aggressive (4) speeds scans; assumes
you are on a reasonably fast and
reliable network
-T5
nmap 192.168.1.1 -T5
Insane (5) speeds scan; assumes you
are on an extraordinarily fast network
What is this NMAP switch: -sU
scan UDP
What is this NMAP switch: -O
Remote OS detection using TCP/IP
stack fingerprinting
What is this NMAP switch: -sS
TCP Syn port scan (aka stealth scan)
What is this NMAP switch: -sn
ping scan only
-sn tells Nmap not to do a port scan after host discovery, and only print out the available hosts that responded to the host discovery probes. This is often known as a “ping scan”
What is this NMAP switch: -Pn
nmap 192.168.1.1-5 -Pn
port scan only - no ping
What is this NMAP switch: -O
O/S scan
What is this NMAP switch: -iL
scan each server in file
What is this NMAP switch: -sL
list servers, but does not scan them
What is this NMAP switch: -oX
save output in XML file
What is this NMAP switch: -oG
save scan in greppable format
What is this NMAP switch: -sn
PING only
nmap 192.168.1.1/24 -sn
Disable port scanning. Host discovery only (ping).
What is this NMAP switch: -sT
-sT
nmap 192.168.1.1 -sT
Full 3-way TCP connect port scan
-sx
xmas tree
Sets the FIN, PSH, and URG flags, lighting the packet up like a Christmas tree.
-sF
Sets just the TCP FIN bit.
sneaky through firewalls
-PS
This option sends an empty TCP packet with the SYN flag set. The default destination port is 80
-PA
The TCP ACK ping is quite similar to the -PS.
The difference, as you could likely guess, is that the TCP ACK flag is set instead of the SYN flag.
Port 80 by default
-PU
UDP discovery on port x.
Port 40125 by default
-PR
ARP discovery on local network
-n
Never do DNS resolution
-D
send scans from spoofed IPs
Full Open Scanning
ensures the response that the targeted host is live and the connection is complete
Discovery Scan
identifies the operating systems that are running on a network, maps those systems to IP addresses, and enumerates the open ports and services on those systems.
-A
Enables OS detection, version detection, script scanning, and traceroute
-p
specific ports to be used
-p22,25
-p
specific ports to be used
-p22,25
-p
specific ports to be used
- p22,25
- p U:53,T:22
