💡 Pro Tip

Use -sn for quick network sweeps without triggering port scan detection. Combine with -PR on local networks for fastest ARP-based discovery.

📋 Example: Full Service Detection

nmap -sV --version-all -p 22,80,443,3306,8080 <target>

📋 Example: OS Detection with Aggressive Guessing

sudo nmap -O --osscan-guess <target>

# Vulnerability scan
nmap --script vuln <target>

# HTTP enumeration
nmap --script http-enum -p 80,443 <target>

# SMB vulnerability check
nmap --script smb-vuln* -p 445 <target>

# DNS zone transfer
nmap --script dns-zone-transfer -p 53 <target>

# SSH brute force
nmap --script ssh-brute -p 22 <target>

# SSL/TLS analysis
nmap --script ssl-enum-ciphers -p 443 <target>

# FTP anonymous login check
nmap --script ftp-anon -p 21 <target>

# MySQL enumeration
nmap --script mysql-info -p 3306 <target>

💡 Pro Tip

Always use -oA to save results in all formats. This gives you flexibility for reporting (normal), automation (XML), and quick searches (grepable).

📋 Example: Evasion Scan

nmap -f -D RND:5 --source-port 53 --data-length 50 -T2 <target>

# Quick network sweep
nmap -sn 192.168.1.0/24

# Standard service scan
nmap -sV -sC -p- <target>

# Comprehensive scan (services + OS + scripts)
nmap -A -T4 <target>

# Fast scan top ports
nmap -F -T4 <target>

# Stealth scan with service detection
nmap -sS -sV -O -T4 <target>

# UDP scan common ports
sudo nmap -sU --top-ports 20 <target>

# Vulnerability scan
nmap --script vuln -sV <target>

# Web server enumeration
nmap -sV --script=http-enum,http-headers,http-methods -p 80,443,8080 <target>

# Full TCP + UDP scan with all info (slow but thorough)
sudo nmap -sS -sU -sV -O -sC -p- -T4 -oA fullscan <target>

# Firewall evasion scan
nmap -sS -T2 -f -D RND:5 --source-port 53 <target>

# Find live hosts and save to file
nmap -sn 192.168.1.0/24 -oG - | grep "Up" | cut -d " " -f 2 > live_hosts.txt

# Extract open ports from grepable output
grep "open" scan.gnmap | cut -d "/" -f 1 | sort -u

# Scan list of hosts for specific port
nmap -iL hosts.txt -p 22 --open -oG - | grep "open"

# Find web servers on network
nmap -p 80,443,8080,8443 --open 192.168.1.0/24

# Quick port knock (check if ports are open)
nmap -Pn -p 22,80,443 --open <target>

# Find hosts with specific service
nmap -sV -p 3306 192.168.1.0/24 --open