decrypting…# Nmap 🛰️🔍 #Tool #RED #TTNet Nmap (Network Mapper) is the go-to tool for network discovery, security scanning, and vulnerability assessment. This guide will help you unleash the full potential of Nmap. 🚀 **LINK TO TOOL DOCUMENTATION[ HERE](https://www.kali.org/tools/nmap/)** **Nmap** is an open-source network scanner used to discover hosts, services, and vulnerabilities on a network. It’s widely used by system administrators, penetration testers, and ethical hackers. --- <div style="text-align: center;"> <img src="https://nmap.org/images/nmap-logo-256x256.png" alt="nmap"> </div> --- ### Installing Nmap #### **Linux (Debian-based: Ubuntu, Kali, etc.)** ```sh sudo apt update && sudo apt install nmap -y ``` #### **Windows** 1. Download the installer from the [official website](https://nmap.org/download.html). 2. Run the installer and follow the setup instructions. --- ## 🧰 Common Commands ### 🔍 Basic Host Discovery ```bash nmap -sn 192.168.1.0/24 ``` Ping scan to discover live hosts on a subnet. ### 📜 Scan Specific Ports ```bash nmap -p 22,80,443 192.168.1.1 ``` Scan specific ports on a target. ### 🔑 Detect Services and Versions ```bash nmap -sV 192.168.1.1 ``` Perform service version detection. ### 🕵️ OS Detection ```bash nmap -O 192.168.1.1 ``` Detect the operating system running on a target. ### 📂 Save Output to File ```bash nmap -oN output.txt 192.168.1.1 ``` Save scan results in a readable format. --- ## ⚙️ Advanced Usage ### 🌐 Scan a Range of IPs ```bash nmap 192.168.1.1-254 ``` Scan all IPs in a specified range. ### 🛠 Full Port Scan ```bash nmap -p- 192.168.1.1 ``` Scan all 65,535 ports. ### 🌐 Aggressive Scan ```bash nmap -A 192.168.1.1 ``` Enable OS detection, version detection, script scanning, and traceroute. ### 🛡️ Detect Vulnerabilities ```bash nmap --script vuln 192.168.1.1 ``` Run vulnerability detection scripts. ### 📊 Output in Multiple Formats ```bash nmap -oA scan_results 192.168.1.1 ``` Save results in Nmap, XML, and Grepable formats. --- ## 📋 Handy Options |Option|Description| |----------|---| |`-sS` |Perform a TCP SYN scan| |`-sU`|UDP scan| |`-sV`|Service version detection| |`-O`|OS detection| |`-A`|Aggressive scan (OS, services, scripts)| |`-p`|Specify ports to scan| |`-p-`|scans all ports (65,535)| |`-oA`|Save output in all formats| |`--script`|Run specific NSE scripts| |`-T<0-5>`|Set scan timing template (0=slow, 5=fast)| |`-Pn`|Treat all hosts as online (skip ping scan)| |`-n`|Disable DNS resolution| |`-v`|Increase verbosity| --- ## 🌐 Example Scenarios ### Scenario 1: Quick Network Sweep ```bash nmap -sn 10.0.0.0/24 ``` Discover live hosts on a subnet. ### Scenario 2: Scan Common Ports ```bash nmap -p 21,22,80,443 10.0.0.1 ``` Scan a host for common ports. ### Scenario 3: Full Vulnerability Scan ```bash nmap -A --script vuln 10.0.0.1 ``` Detect services, OS, and vulnerabilities on a target. --- ## 🚀 Pro Tips ### 1️⃣ Use Timing Templates ```bash nmap -T4 192.168.1.1 ``` Use `-T4` for faster scans, but beware of potential detection. ### 2️⃣ Combine with Other Tools Export results and use tools like **Metasploit** or **Nessus** for advanced exploitation. ### 3️⃣ Automate with Scripts Leverage the **Nmap Scripting Engine (NSE)** to automate tasks and detect vulnerabilities. --- ## 📚 References - [Nmap Official Documentation](https://nmap.org/docs.html) - [Nmap Scripting Engine (NSE)](https://nmap.org/book/nse.html) - [SecLists Wordlists for Nmap](https://github.com/danielmiessler/SecLists) ---