nmap -sn -PR [Target IP Address/Range of IP addresses]
A UDP response means that the host is active. If the target host is offline or unreachable, various error messages such as “host/network unreachable” or “TTL exceeded” could be returned.
nmap -sn -PU [Target IP Address/Range of IP addresses]
The ICMP ECHO ping scan involves sending ICMP ECHO requests to a host. If the target host is alive, it will return an ICMP ECHO reply. This scan is useful for locating active devices or determining if the ICMP is passing through a firewall.
nmap -sn -PE [Target IP Address/Range of IP addresses]
nmap -sn -PP [Target IP Address/Range of IP addresses]
nmap -sn -PM [Target IP Address/Range of IP addresses]
This technique sends empty TCP ACK packets to the target host; an RST response means that the host is active.
nmap -sn -PA [Target IP Address/Range of IP addresses]
This technique sends different probe packets of different IP protocols to the target host, any response from any probe indicates that a host is active.
nmap -sn -PO [Target IP Address/Range of IP addresses]
nmap -sT -v [Target IP Address/Range of IP addresses]
This scanning technique can be used to bypass firewall rules, logging mechanisms, and hide under network traffic.
nmap -sS -v [Target IP Address/Range of IP addresses]
Sends a TCP frame to a target system with FIN, URG, and PUSH flags set. If the target has opened the port, then you will receive no response from the target system. If the target has closed the port, then you will receive a target system reply with an RST.
nmap -sX -v [Target IP Address/Range of IP addresses]
FIN/ACK probe is sent to the target; if there is no response, then the port is Open|Filtered, but if the RST packet is sent as a response, then the port is closed.
nmap -sM -v [Target IP Address/Range of IP addresses]
Sends an ACK probe packet with a random sequence number; no response implies that the port is filtered (stateful firewall is present), and an RST response means that the port is not filtered.
nmap -sA -v [Target IP Address/Range of IP addresses]
Uses UDP protocol instead of the TCP. There is no three-way handshake for the UDP scan. It sends UDP packets to the target host; no response means that the port is open. If the port is closed, an ICMP port unreachable message is received.
nmap -sU -v [Target IP Address/Range of IP addresses]
A TCP port scan method that can be used to send a spoofed source address to a computer to discover what services are available.
nmap -sI -v [Target IP Address/Range of IP addresses]
Reference: https://nmap.org/book/idlescan.html
A COOKIE ECHO chunk is sent to the target host; no response implies that the port is open and ABORT Chunk response means that the port is closed.
nmap -sZ -v [Target IP Address/Range of IP addresses]
Discover the available hosts and their IP and MAC addresses, but no information about the ports.
nmap -sP [Target IP Address/Range of IP addresses]
nmap -T4 -A -v [Target IP Address/Range of IP addresses]
-T4: Specifies setting time template (0-5). -A: Specifies setting ACK flag.
Attempts to determine the OS, computer name, domain, workgroup, and current time over the SMB protocol
nmap --script smb-os-discovery.nse [Target IP Address/Range of IP addresses]
nmap -sV -v --script nbstat.nse [Target IP Address/Range of IP addresses]
nmap -sV --script http-enum [Target IP Address/Range of IP addresses]
nmap --script hostmap-bfk -script-args hostmap-bfk.prefix=hostmap- [Target IP Address/Range of IP addresses]
Uses the TRACE method by sending an HTTP TRACE request that shows if the method is enabled or not
nmap --script http-trace -d [Target IP Address/Range of IP addresses]
nmap [Target IP Address/Range of IP addresses] -p 80 --script = http-frontpage-login
nmap --script http-passwd --script-args http-passwd.root =/ [Target IP Address/Range of IP addresses]
nmap -p80 --script http-waf-detect [Target IP Address/Range of IP addresses]
Send fragmented probe packets to the intended target, which re-assembles it after receiving all the fragments.
nmap -f [Target IP Address/Range of IP addresses]
Manipulating actual port numbers with common port numbers to evade IDS/firewall (sometimes, firewall is configured to allow packets from well-known ports like HTTP, DNS, FTP, etc.).
nmap -g 80 [Target IP Address/Range of IP addresses]
This technique evades the filtering and detection mechanism enabled in the target machine.
nmap -mtu 8 [Target IP Address/Range of IP addresses]
Generating or manually specifying IP addresses of the decoys to evade IDS/firewall. Nmap automatically generates a random number of decoys for the scan and randomly positions the real IP address between the decoy IP addresses.
-D: performs a decoy scan. RND: generates a random and non-reserved IP addresses.
nmap -D RND:10 [Target IP Address/Range of IP addresses]
nmap [Target IP Address/Range of IP addresses] --data 0xdeadbeef
nmap [Target IP Address/Range of IP addresses] --data-string "dummy string"
nmap --data-length 5 [Target IP Address/Range of IP addresses]
nmap --randomize-hosts [Target IP Address/Range of IP addresses]
nmap --badsum [Target IP Address/Range of IP addresses]
nmap --badsum [Target IP Address/Range of IP addresses]
nmap -6 -n -Pn -sSU -pT:0-65535,U:0-65535 -v -A -oX [NAME] [Target IP Address/Range of IP addresses]
nmap -n -Pn -sSU -pT:0-65535,U:0-65535 -v -A -oX [NAME] [Target IP Address/Range of IP addresses]
nmap -n -Pn -sS -pT:0-65535 -v -A -oX [Target IP Address/Range of IP addresses]
nmap -Pn -sT -p 46824 [Target IP address/Range of IP addresses]
nmap -Pn -sT --scan-delay 1d --mac-parallelism 1 -p [port list] [Target IP address/Range of IP addresses]
nmap -Pn -sT -p 102 --script s7-info [Target IP address/Range of IP addresses]
nmap -Pn -sU -p 44818 --script enip-info [Target IP address/Range of IP addresses]
nmap -Pn -sT -p 502 --script modbus-discover [Target IP address/Range of IP addresses]
nmap -Pn -sU -p 47808 --script bacnet-info [Target IP address/Range of IP addresses]
nmap -Pn -sT -p 1911,4911 --script fox-info [Target IP address/Range of IP addresses]
nmap -Pn -sT -p 9600 --script omron-info [Target IP address/Range of IP addresses]
nmap -Pn -sT -p 1962 --script pcworx-info [Target IP address/Range of IP addresses]
nmap -Pn -sT -p 20547 --script proconos-info [Target IP address/Range of IP addresses]
nmap --script=sniffer-detect [Target IP Address/Range of IP addresses]
Source: https://github.com
#nmap #security #hacking