Nmap Scanning



Initial scan TCP

nmap -sC -sV -O -oA nmap/initial

Full scan TCP

Comprehensive nmap scans in the background to make sure we cover all bases.

nmap -sC -sV -O -p- -oA nmap/full

Full scan UDP

nmap -sU -O -p- -oA nmap/udp


SPARTA is a python GUI application which simplifies network infrastructure penetration testing by aiding the penetration tester in the scanning and enumeration phase.

Normal Scan

nmap -A $ip

Scan for alive hosts

$ nmap -sn $ip/24
$ nmap -vvv -sn $ip/24

If you want a little faster,

$ nmap -sn -n $ip/24 > ip-range.txt

Scan specific IP range

$ nmap -sP

Sort out the machines that are up

$ cat ip-range.txt | grep -B 1 "Host is up"

and now filter all the IPs and create a file.

grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}' ip-range.txt > only-ip.txt

Scan a host

nmap www.testhostname.com

Scan specific machine

Scan common port

$ nmap -A -oA filename $ip/24

The command:

  • Scan 1024 most common ports

  • Run OS detection

  • Run default nmap scripts

  • Save the result into .nmap, .gnmap and .xml

  • Faster

Fast scanning

Scan 100 most common ports

nmap -F $ip

Quick TCP Scan

nmap -sC -sV -vv -oA quick $ip

Quick UDP Scan

nmap -sU -sV -vv -oA quick_udp $ip

Full TCP Scan

nmap -sC -sV -p- -vv -oA full

Port knock

for x in 7000 8000 9000; do nmap -Pn --host_timeout 201 --max-retries 0 -p $x $ip; done

Scan deeply

Scanning more deeply:

$ nmap -v -p- -sT $ip
$ nmap -v -p- -sT

This command:

  • Scan all 65535 ports with full connect scan

  • Take very long time

  • Print out straigt away instead of having to wait until end of the scan


Scanning this takes a long time, suggest to leave the scan running overnight, when you're sleep or move on to different box in the meantime.

Scan for specific port

$ nmap -p T:80,443,8080 $ip/24

Use -T: specifies TCP ports. Use -U: for UDP ports.

Scan for unused IP addresses and store in text file

$ nmap -v -sn $ip/24 | grep down | awk '{print $5}' > filename.txt

Other option

nmap -sV -sC -v -oA output $ip

UDP scan

Scanning this might slow and unreliadble

$ nmap $ip -sU
$ nmap 10.11.1.X -sU

Scan targets from a text file

Create a text file contains of our targets machine (like in method Scan for unused IP addresses and store in text file):

Run this nmap command with -iL

nmap -iL list-of-ips.txt


Grab the latest bash script

git clone https://github.com/superkojiman/onetwopunch.git
cd onetwopunch

Create a text file contains of our targets machine (like in method Scan for unused IP addresses and store in text file):

Then, run the script and tell it to read our txt file and perform TCP scan against each target.

./onetwopunch.sh -t ip-range.txt -p tcp

So, the idea behind the script to generate a scan of 65,535 ports on the targets. The script use unicornscan to scan all ports, and make a list of those ports that are open. The script then take the open ports and pass them to nmap for service detection.


GitHub - Tib3rius/AutoRecon: AutoRecon is a multi-threaded network reconnaissance tool which performs automated enumeration of services.