oscp/Tools/nmap.md

nmap -p- -T5 <ip>
nmap -p 22,25,80 -A <ip>

nmap -p- --min-rate 5000 <ip>

nmap -sn 192.168.102.0/24 -T4 -oN discovery.nmap
nmap -iL output.txt -T4 -sV -sC -p- -Pn -n --open -A -oN version.nmap

nmap -sU -p- --min-rate 5000 <ip>

• Conduct a full UDP port scan (may be all open|filtered) because open ports rarely respond to empty probes. No response --> open port or dropped by firewall.

nmap -A -sV -sC -sU 10.11.1.111 --script=*enum --top-ports 20

• When version scanning is enabled with -sV (or -A), it will send UDP probes to every open|filtered port. If any of the probes elicit a response from an open|filteredport, the state is changed to open.

nmap script=vuln 192.168.193.211

• Nmap scripts location /usr/share/nmap/scripts/

proxychains nmap --top-ports=20 -sT -Pn 10.5.5.20

• SOCKS proxies require a TCP connection to be made and thus a half-open or SYN scan cannot be used with ProxyChains

Scans thru Socks proxy

nmap --proxies socks4://proxy-ip:8080 target-ip

SYN-Scan of a Filtered Port

sudo nmap 10.129.2.28 -p50000 -sS -Pn -n --disable-arp-ping --packet-trace

SYN-Scan From DNS Port

sudo nmap 10.129.2.28 -p50000 -sS -Pn -n --disable-arp-ping --packet-trace --source-port 53

See also: Tools/autorecon for automated port discovery, Linux/portscanning for quick Bash loops, and Windows/Active Directory for OSCP/Initial Access/Scan Network when nmap has to run through proxychains in AD-heavy networks.