Search everything Ctrl K

Nmap

Nmap finds which ports are open, which service and version runs behind each one and, with its NSE scripts, runs vulnerability and enumeration checks. On HTB the workflow is always the same: a fast sweep of all 65535 TCP ports and then a version and script scan on the open ones only.

Platform
Linux · Windows · macOS
Official site
nmap.org
On HTB
9 machines
Install 
sudo apt install nmap

Nmap cheat sheet

Your values Saved in this browser and applied to every cheatsheet.
15 commands

Beyond the basics

All in one, saving in all three formats 
nmap -sCV -p- -T4 10.10.11.20 -oA nmap/completo
Discover live hosts on a network (no port scan) 
nmap -sn 10.10.10.0/24
SMB scripts 
nmap --script "smb-enum-shares,smb-os-discovery,smb2-security-mode" -p445 10.10.11.20
Show the help of an NSE script 
nmap --script-help http-enum

In our cheatsheets

Port forwarding and pivoting › Others

Scan through the proxy Attacker 
proxychains -q nmap -sT -Pn --top-ports 100 172.16.1.10

Only TCP connect (-sT) works through proxychains, without ping (-Pn).

Nmap and service enumeration › Nmap

Linux or Windows? (TTL) 
ping -c 1 10.10.11.20

A TTL close to 64 is usually Linux and close to 128, Windows.

All TCP ports (fast) 
sudo nmap -p- --open -sS --min-rate 5000 -n -Pn 10.10.11.20 -oG puertos
Extract the port list 
grep -oP '\d+(?=/open)' puertos | paste -sd, -
Versions and default scripts 
nmap -sCV -p22,80 10.10.11.20 -oN objetivo

Replace 22,80 with the ports from the previous step.

UDP (most common) 
sudo nmap -sU --top-ports 100 --open -n -Pn 10.10.11.20
Known vulnerabilities 
nmap --script vuln -p445 10.10.11.20
Search scripts by name 
ls /usr/share/nmap/scripts/ | grep -i smb
Web path fuzzing with nmap 
nmap --script http-enum -p80 10.10.11.20
Ports with bash Target 
for p in $(seq 1 65535); do (echo > /dev/tcp/172.16.1.10/$p) 2>/dev/null && echo "$p abierto"; done
Ports with nc Target 
nc -zv -w1 172.16.1.10 1-10000 2>&1 | grep -i succeeded

HTB machines where Nmap is used

Taken from the chapters of IppSec videos where Nmap shows up. The ▶ link jumps to the minute of that part.

Guides that use Nmap