Nmap Cheat Sheet

Covers essential Nmap scan types, timing options, script engine usage, and output formats for network discovery and enumeration.

2 PagesBeginnerFeb 18, 2026

Basic Scan Types

Core Nmap scan techniques for host and port discovery.

bash

nmap 192.168.1.1              # Basic scan, top 1000 portsnmap -sn 192.168.1.0/24       # Ping sweep, no port scannmap -sS target.com           # TCP SYN scan (stealth, needs root)nmap -sT target.com           # TCP connect scan (no root needed)nmap -sU target.com           # UDP scannmap -p 22,80,443 target.com  # Scan specific portsnmap -p- target.com           # Scan all 65535 ports

Detection & Scripting

Service/version detection and the Nmap Scripting Engine (NSE).

bash

nmap -sV target.com            # Detect service versionsnmap -O target.com             # OS detection (needs root)nmap -A target.com             # Aggressive: OS, version, scripts, traceroutenmap -sC target.com            # Run default NSE scriptsnmap --script vuln target.com  # Run vulnerability-category scriptsnmap --script=http-title target.com  # Run a specific script

Timing & Performance Flags

Options to control scan speed and stealth.

-T0 to -T5- Timing templates from paranoid (0) to insane (5); -T4 is common for fast, reliable scans
--min-rate <n>- Send packets no slower than n per second
-Pn- Skip host discovery, treat all hosts as online
-n- Skip DNS resolution to speed up scans
-v / -vv- Increase output verbosity

Output Options

Ways to save and format scan results.

-oN file.txt- Normal output format
-oX file.xml- XML output, useful for parsing/tools like Metasploit
-oG file.gnmap- Grepable output format
-oA basename- Output in all three formats at once with a shared basename

Pro Tip

Combine -sV with --version-intensity 0 on production networks to keep version probing lightweight and avoid tripping IDS alerts or destabilizing fragile services.

Was this cheat sheet helpful?

Penetration Testing Basics Cheat Sheet

Metasploit Cheat Sheet