Nmap Cheat Sheet 2026: Every Command You Need

Quick Navigation

What is Nmap?

Nmap is a free, open-source network scanner used for host discovery, port scanning, service detection, and security auditing. It sends specially crafted packets to target hosts and analyzes responses to determine what ports are open, what services are running, and what operating systems are in use.

Every penetration test starts with reconnaissance, and Nmap is the go-to tool for that phase. Security professionals use it to map network topology, identify potential attack vectors, and gather intelligence before attempting exploitation. System administrators rely on it for network inventory and monitoring unauthorized services.

Nmap is essential for the reconnaissance phase of penetration testing. Learn the complete methodology in our Reconnaissance Course.

Installation Commands

Nmap is available on all major platforms. Install it with your package manager:

Verify installation with nmap --version. You should see version 7.98 or higher for all features in this cheat sheet.

Basic Nmap Scanning Commands

These fundamental nmap commands form the foundation of network reconnaissance. Start here if you're learning how to use nmap.

Host Discovery and Ping Scanning

Before scanning ports, determine which hosts are alive. The nmap ping sweep identifies live systems without generating excessive traffic.

Practical Examples

# Quick network sweep to find live hosts
nmap -sn 192.168.1.0/24

# For hosts that block ICMP
nmap -Pn -PS22,80,443 192.168.1.0/24

# ARP scan on local network (requires root)
sudo nmap -PR -sn 192.168.1.0/24

Practice host discovery techniques in our Nmap Lab, a beginner-friendly environment to master network scanning.

Port Scanning Techniques

Port scanning is the core of Nmap functionality. Different scan types have different use cases, stealth levels, and accuracy tradeoffs.

Scan Types

Port Specification - Nmap Scan All Ports

Master port scanning techniques in our Scanning Course with hands-on exercises.

Service and Version Detection

Identifying what services run on open ports is crucial for vulnerability assessment. Nmap probes services to determine software names and versions.

Examples

# Standard service detection
nmap -sV -p 22,80,443,3306,8080 target.example

# Aggressive full scan
nmap -A -T4 target.example

# Light version scan for speed
nmap -sV --version-light -p- target.example

OS Detection

Nmap fingerprints TCP/IP stack implementations to identify operating systems. This requires root/admin privileges and works best with at least one open and one closed port.

# OS detection with aggressive guessing
sudo nmap -O --osscan-guess target.example

# Combined OS and version detection
sudo nmap -O -sV target.example

Nmap Scripting Engine (NSE) - Vulnerability Scanning

The Nmap Scripting Engine transforms Nmap from a simple scanner into a full vulnerability assessment tool. NSE scripts automate discovery, enumeration, and nmap vulnerability scan tasks that would otherwise require multiple specialized tools.

NSE contains over 600 scripts written in Lua, covering everything from basic banner grabbing to complex vulnerability detection. Scripts are organized into categories based on their purpose and intrusiveness level.

Script Categories

Most Useful NSE Scripts

# Comprehensive vulnerability scanning
nmap --script vuln target.example

# HTTP enumeration (directories, methods, headers)
nmap --script http-enum -p 80,443 target.example

# SMB vulnerabilities (EternalBlue, etc.)
nmap --script smb-vuln* -p 445 target.example

# SSL/TLS analysis (weak ciphers, expired certs)
nmap --script ssl-enum-ciphers -p 443 target.example

# DNS zone transfer check
nmap --script dns-zone-transfer -p 53 target.example

# FTP anonymous login
nmap --script ftp-anon -p 21 target.example

# MySQL info gathering
nmap --script mysql-info -p 3306 target.example

# SSH brute force (use responsibly on authorized targets)
nmap --script ssh-brute -p 22 target.example

# HTTP vulnerability scan
nmap --script http-vuln* -p 80,443 target.example

After discovering vulnerabilities with Nmap, practice exploiting them safely in HackerDNA's SQL Injection Lab or NoSQL Injection Lab.

Timing and Performance

Nmap's timing templates balance speed against accuracy and stealth. Choose based on your environment and goals.

Timing Templates

Fine-Grained Controls

Output Formats

Save scan results for later analysis, reporting, and tool integration.

Additional Output Flags

Firewall and IDS Evasion

These techniques help bypass security controls during authorized penetration tests. Use responsibly and only on systems you have permission to test.

Evasion Example

# Stealthy scan with multiple evasion techniques
sudo nmap -sS -T2 -f -D RND:5 --source-port 53 --data-length 50 target.example

Common Scan Combinations

Copy-paste ready commands for common scanning scenarios. These combine multiple flags for practical use cases. Each command is tested and optimized for its specific purpose.

Host Discovery

# Quick host discovery on a subnet
nmap -sn 192.168.1.0/24

# ARP discovery on local network (fastest, requires root)
sudo nmap -PR -sn 192.168.1.0/24

# Discovery when ICMP is blocked
nmap -Pn -PS22,80,443 192.168.1.0/24

Standard Reconnaissance

# Quick scan for CTF initial foothold
nmap -sC -sV -T4 -oA initial target.example

# Standard service scan with all ports
nmap -sV -sC -p- target.example -oA standard_scan

# Fast top ports scan for quick overview
nmap -F -T4 target.example

Comprehensive Scanning

# Comprehensive scan (great for CTFs and labs)
nmap -A -T4 -p- target.example -oA comprehensive

# Stealth scan with service and OS detection
sudo nmap -sS -sV -O -T4 target.example

# Full TCP + UDP (thorough but slow)
sudo nmap -sS -sU -sV -O -sC -p- -T4 -oA fullscan target.example

Specialized Scans

# UDP scan (common services only - UDP is slow)
sudo nmap -sU --top-ports 20 target.example

# Vulnerability assessment
nmap --script vuln -sV target.example -oA vuln_scan

# Web server enumeration
nmap -sV --script=http-enum,http-headers,http-methods -p 80,443,8080 target.example

# SMB enumeration and vulnerability check
nmap --script smb-enum-shares,smb-vuln* -p 445 target.example

# Database service enumeration
nmap -sV --script=mysql-info,ms-sql-info -p 3306,1433 target.example

Ready to put these commands into practice? Try our Hack the Box Lab where you'll use Nmap for real reconnaissance against a hardened target.

Understanding Port States

Nmap reports ports in six possible states. Understanding these helps interpret scan results accurately and avoid false conclusions about target security posture.

The filtered state often indicates a firewall is present. Try different scan types (-sA, -sN, -sF) to gather more information about firewall rules. The open|filtered state is common with nmap udp scan results because UDP doesn't require acknowledgment, making it harder to determine if a port is truly open or if packets are being silently dropped.

Quick Reference Card

The most essential Nmap commands in one place. Perfect for quick reference during assessments. Download the printable PDF version to keep at your desk.

Practice Your Nmap Skills

Knowing nmap commands is one thing. Using them effectively against real targets is another. Reading cheat sheets builds knowledge, but hands-on practice builds expertise. The difference between a competent penetration tester and a beginner often comes down to hours spent practicing reconnaissance against diverse targets.

HackerDNA Labs provides dedicated vulnerable machines to practice reconnaissance, scanning, and exploitation in a safe, legal environment. Each lab simulates real-world scenarios where you'll apply the commands from this nmap cheat sheet to discover services, identify vulnerabilities, and practice your methodology.

Recommended Labs for Nmap Practice

• Nmap Lab 102 Master the basics of network scanning in a guided environment
• Hack the Box Lab Full penetration test from reconnaissance to root access
• Secrets in Source Combine scanning with web exploitation techniques

Structured Learning Path

For comprehensive training, our Nmap Mastery Course covers everything from basics to advanced techniques with interactive exercises. For a quick interactive reference, try our Nmap Cheat Sheet Course with knowledge validation exercises.

Frequently Asked Questions

Related Resources

Expand your penetration testing toolkit with these related guides and courses:

• CTF for Beginners Guide - Learn how to apply Nmap in CTF competitions
• Network Penetration Testing Course - Complete network pentest methodology
• Nmap Mastery Course - In-depth Nmap training with hands-on exercises
• Nmap Cheat Sheet Course - Interactive cheat sheet with knowledge validation
• Official Nmap Documentation - Reference manual from the creators