Nmap Cheat Sheet & Commands (Beginners Guide)
🖥️ What is Nmap?
Nmap (Network Mapper) is an open-source network scanning tool used by ethical hackers to:
- 🔍 Discover live hosts
- 📡 Detect open ports & services
- 🖥️ Identify operating systems
- 🧪 Test network defenses
🚀 Why Nmap Matters in Ethical Hacking
- ✅ Maps entire networks quickly
- ✅ Reveals potential entry points
- ✅ Essential in CEH v13 exam prep
- ✅ Used in real-world pentesting labs (TryHackMe, HackTheBox)
🔑 Top 10 Nmap Commands for Beginners
| ⚡ Command | 📌 Purpose | 🛠️ Example |
|---|---|---|
nmap -sn 192.168.1.0/24 | Ping sweep → find active hosts | Scan WiFi devices |
nmap -sS target.com | SYN scan → stealthy check | Evade detection |
nmap -sT target.com | TCP connect → non-root use | Beginner-friendly |
nmap -sV target.com | Version detection | Spot software version |
nmap -O target.com | OS detection | Learn target system |
nmap -A target.com | Aggressive scan | Deep fingerprinting |
nmap -p1-1000 target.com | Ports 1-1000 | Fast audit |
nmap -p- target.com | All ports (1-65535) | Complete sweep |
nmap -Pn target.com | Treat host as “up” | Bypass firewall block |
nmap -sU target.com | UDP scan | Find DNS, SNMP, DHCP |
🧭 Scan Types Made Simple
- 🔦 Ping Sweep (
-sn) → Find live hosts - 🕵️ SYN Scan (
-sS) → Stealthy & fast - 🔐 TCP Connect (
-sT) → For non-root users - 🌐 UDP Scan (
-sU) → Detect hidden UDP services - 🖥️ OS Detection (
-O) → Profile the system - 🧩 Aggressive Mode (
-A) → Collect everything
📋 Quick Nmap Cheat Sheet
| 🏷️ Flag | 🎯 Category | 🔑 Function |
|---|---|---|
-sn | Host Discovery | List active devices |
-sS / -sT | Scan Types | SYN stealth / TCP connect |
-sU | Scan Type | UDP scan |
-O | OS Detection | Guess system type |
-sV | Version | Detect software version |
-p / -p- | Ports | Specify ranges or all |
-Pn | Discovery | Skip ping, assume host up |
-A | Aggressive | Deep scan + traceroute |
-T<0-5> | Timing | Speed vs stealth |
⚖️ Safe & Legal Use of Nmap
- 📝 Always get permission before scanning
- 🛡️ Use test labs (TryHackMe, HackTheBox)
- ⏱️ Avoid disruptive scans in production
- 📑 Document findings for reports
🎯 CEH v13 Strategy Checklist
📝 Knowledge Exam
- Know scan types: SYN = stealth, TCP connect = simple, UDP = hidden services
- Map switch to purpose:
-O= OS detection,-sV= version detection,-A= aggressive - Red flag terms: “filtered” vs “closed” vs “open” → know the difference
🛠️ Practical Exam
- Start with host discovery:
nmap -sn 192.168.1.0/24 - Move to stealth:
nmap -sS -p- target - Add details:
nmap -sV -O target - Export results:
nmap -oN results.txt target
✅ Key Takeaways
- 🔍 Nmap is the #1 recon tool for ethical hackers
- 🧩 Learn 10 core commands before diving deeper
- 🛡️ Practice in labs to avoid legal risks
- 🎓 Nmap mastery is critical for CEH v13 success
📌 Final Note
Mastering Nmap builds the foundation for all ethical hacking skills. Start with the basics, practice safely, and build muscle memory with real-world labs.