Nmap-Cheat-Sheet

• Selección de objetivos en Nmap

Scan a single IP	               nmap 192.168.1.1
Scan a host	                     nmap www.testhostname.com
Scan a range of IPs	             nmap 192.168.1.1-20
Scan a subnet	                   nmap 192.168.1.0/24
Scan targets from a text file	   nmap -iL list-of-ips.txt

• Selección de puertos en Nmap

Scan a single Port	                    nmap -p 22 192.168.1.1
Scan a range of ports                   nmap -p 1-100 192.168.1.1
Scan 100 most common ports (Fast)	      nmap -F 192.168.1.1
Scan all 65535 ports	                  nmap -p- 192.168.1.1

• Tipos de escaneo de puertos en Nmap

Scan using TCP connect	                  nmap -sT 192.168.1.1
Scan using TCP SYN scan (default)	        nmap -sS 192.168.1.1
Scan UDP ports	                          nmap -sU -p 123,161,162 192.168.1.1
Scan selected ports - ignore discovery	  nmap -Pn -F 192.168.1.1

• Detección de servicios y sistema operativo

Detect OS and Services	           nmap -A 192.168.1.1
Standard service detection	       nmap -sV 192.168.1.1
More aggressive Service Detection	 nmap -sV --version-intensity 5 192.168.1.1
Lighter banner grabbing detection	 nmap -sV --version-intensity 0 192.168.1.1

• Formatos de salida de Nmap

Save default output to file	       nmap -oN outputfile.txt 192.168.1.1
Save results as XML	               nmap -oX outputfile.xml 192.168.1.1
Save results in a format for grep	 nmap -oG outputfile.txt 192.168.1.1
Save in all formats	               nmap -oA outputfile 192.168.1.1

• Profundizando con los scripts NSE

Scan using default safe scripts	   nmap -sV -sC 192.168.1.1
Get help for a script	             nmap --script-help=ssl-heartbleed
Scan using a specific NSE script	 nmap -sV -p 443 –script=ssl-heartbleed.nse 192.168.1.1
Scan with a set of scripts	       nmap -sV --script=smb* 192.168.1.1

• Un escaneo para buscar servicios UDP de reflexión para DDOS

Scan for UDP DDOS reflectors	    nmap –sU –A –PN –n –pU:19,53,123,161 –script=ntp-monlist,dns-recursion,snmp-sysdescr 192.168.1.0/24

• Información de servicios HTTP

Gather page titles from HTTP services	   nmap --script=http-title 192.168.1.0/24
Get HTTP headers of web services	       nmap --script=http-headers 192.168.1.0/24
Find web apps from known paths	         nmap --script=http-enum 192.168.1.0/24

• Detectar la vulnerabilidad Heartbleed en SSL

Heartbleed Testing	      nmap -sV -p 443 --script=ssl-heartbleed 192.168.1.0/24

• Información de direcciones IP

Find Information about IP address	nmap --script=asn-query,whois,ip-geolocation-maxmind 192.168.1.0/24

• Escanear servicios de puertos del 1 al 65535

nmap -sV -p 1-65535 192.168.1.1/24

• Todos los puertos, todas las versiones de servicios, scripts simples = solo los abiertos

nmap -p- -sV -sC $IP --open