Nmap (
https://nmap.org/) is one of the most popular network mappers in the infosec world. It’s utilized by cybersecurity professionals and newbies alike to audit and discover local and remote open ports, as well as hosts and network information
Some of this tool’s best features are that it’s open-source, free, multi-platform and receives constant updates each year. It also has a big plus: it’s one of the most complete host and network scanners available. It includes a large set of options to enhance your scanning and mapping tasks, and brings with it an incredible community and comprehensive documentation to help you understand this tool from the very start. Nmap can be used to:Create a complete computer network map.Find remote IP addresses of any hosts.Get the OS system and software details.Detect open ports on local and remote systems.Audit server security standards.Find vulnerabilities on remote and local hosts.
Tips:--1,2,3... Numerates command name or type--nmap ... stands for command to lunch
1. Basic Nmap Scan against IP or host
nmap
1.1.1.1
Now, if you want to scan a hostname, simply replace the IP for the host, as you see below:
nmap
cloudflare.com
These kinds of basic scans are perfect for your first steps when starting with Nmap.
2. Scan specific ports or scan entire port ranges on a local or remote server
nmap -p 1-65535 localhost
In this example, we scanned all 65535 ports for our localhost computer.
Nmap is able to scan all possible ports, but you can also scan specific ports, which will report faster results. See below:
nmap -p 80,443
8.8.8.8
3. Scan multiple IP addressesLet’s try to scan multiple IP addresses. For this you need to use this syntax:
nmap
1.1.1.1 8.8.8.8
You can also scan consecutive IP addresses:
nmap -p
1.1.1.1,2,3,4
This will scan
1.1.1.1,
1.1.1.2,
1.1.1.3 and
1.1.1.4.
4. Scan IP rangesYou can also use Nmap to scan entire CIDR IP ranges, for example
nmap -p
8.8.8.0/28
This will scan 14 consecutive IP ranges, from
8.8.8.1 to
8.8.8.14.
An alternative is to simply use this kind of range:
nmap 8.8.8.1-14
You can even use wildcards to scan the entire C class IP range, for example:
nmap 8.8.8.*
---This will scan 256 IP addresses from
8.8.8.1 to 8.8.8.256.
If you ever need to exclude certain IPs from the IP range scan, you can use the “–exclude” option, as you see below:
nmap -p 8.8.8.* --exclude
8.8.8.1
5. Scan the most popular portsUsing “–top-ports” parameter along with a specific number lets you scan the top X most common ports for that host, as we can see:
nmap --top-ports 20
192.168.1.106
Replace “20” with the desired number. Output example:
[root@securitytrails:~]nmap --top-ports 20 localhost Starting Nmap 6.40 (
http://nmap.org ) at 2018-10-01 10:02 EDT Nmap scan report for localhost (
127.0.0.1) Host is up (0.000016s latency). Other addresses for localhost (not scanned):
127.0.0.1 PORT STATE SERVICE 21/tcp closed ftp 22/tcp closed ssh 23/tcp closed telnet 25/tcp closed smtp 53/tcp closed domain 80/tcp filtered http 110/tcp closed pop3 111/tcp closed rpcbind 135/tcp closed msrpc 139/tcp closed netbios-ssn 143/tcp closed imap 443/tcp filtered https 445/tcp closed microsoft-ds 993/tcp closed imaps 995/tcp closed pop3s 1723/tcp closed pptp 3306/tcp closed mysql 3389/tcp closed ms-wbt-server 5900/tcp closed vnc 8080/tcp closed http-proxy
6. Scan hosts and IP addresses reading from a text fileIn this case, Nmap is also useful to read files that contain hosts and IPs inside.
Let’s suppose you create a list.txt file that contains these lines inside:
192.168.1.106 cloudflare.com microsoft.com securitytrails.comThe “-iL” parameter lets you read from that file, and scan all those hosts for you:
nmap -iL list.txt
7. Save your Nmap scan results to a fileOn the other hand, in the following example we will not be reading from a file, but exporting/saving our results into a text file: