Nmap Cheat Sheet | Security+ QuickCheat Pro

Basic Scans

                        # Basic TCP connect scan (no root required)

                        nmap -sT <target>

                        # Quick scan (top 100 ports)

                        nmap -F <target>

                        # Standard scan (top 1000 ports)

                        nmap <target>

                        # Ping scan (host discovery only)

                        nmap -sn <target>

                        # SYN scan (stealth scan, default for root)

                        nmap -sS <target>

                        # UDP scan (often missed in assessments)

                        nmap -sU <target>

                        # Comprehensive scan (all ports, OS/service detection)

                        nmap -p- -A <target>

                        # Aggressive scan (OS/service detection, scripts, traceroute)

                        nmap -A <target>

                        # Scan specific ports

                        nmap -p 22,80,443 <target>

                        # Scan port range

                        nmap -p 1-1024 <target>

                        # Scan top ports

                        nmap --top-ports 50 <target>

                        # Scan all ports (slow)

                        nmap -p- <target>

                        # Save to normal format

                        nmap -oN output.txt <target>

                        # Save to XML format

                        nmap -oX output.xml <target>

                        # Save to all formats

                        nmap -oA output <target>

                        # Verbose output

                        nmap -v <target>

                        # Run default scripts

                        nmap -sC <target>

                        # Run specific script

                        nmap --script=http-vuln-cve2017-5638 <target>

                        # Run script category

                        nmap --script=vuln <target>

                        # Run multiple scripts

                        nmap --script=smb-enum*,http-title <target>

auth - Authentication related
default - Default scripts
discovery - Service discovery
dos - Denial of service checks

exploit - Exploit checks
intrusive - Potentially intrusive
safe - Safe scripts
vuln - Vulnerability checks