Apr 5, 2020
Nmap flags cheatsheet
ps: I'm using 127.0.0.1 as the IP, switch with the target.
Host Discovery only
nmap -sn 127.0.0.1
Port Scanning only
nmap -Pn 127.0.0.1
List only targets.
nmap -sL 127.0.0.1
TCP SYN port scanning.
nmap -sS 127.0.0.1
UDP port scanning.
nmap -sU 127.0.0.1
With -sV, nmap checks for the version of the process running in the open TCP ports it finds.
nmap -sV 127.0.0.1
With -O, nmap performs OS detection of the target, through its TCP/IP stack.
nmap -O 127.0.0.1
NSE is Nmap's Scripting Engine, that provides scripts (LUA) that execute logic on Nmap's results. Some interesting categories I usually use is vuln and malware.
nmap --script vuln 127.0.0.1
For default scripts, but not intrusive ones:
nmap --script "not intrusive" 127.0.0.1
