> For the complete documentation index, see [llms.txt](https://hexisanoob.gitbook.io/hexisanoob/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hexisanoob.gitbook.io/hexisanoob/enum-and-initial-compromise/network-pentest/nmap-quick-cheatsheet.md). # nmap quick cheatsheet 1. Checking and storing active devices in a range and store in a file "tnet" ```shell-session sudo nmap 10.129.2.0/24 -sn -oA tnet | grep for | cut -d" " -f5 ``` 2. Scanning a list of hosts ``` sudo nmap -iL tnet ``` 3. Show all packets sent and received by --packet-trace\ \ -PE : Performs the ping scan by using 'ICMP Echo requests' against the target. ```shell-session sudo nmap 10.129.2.18 -sn -oA host -PE --packet-trace ``` 4. Display reason for a specific result\ \ \--reason 5. We see here that `Nmap` does indeed detect whether the host is alive or not through the `ARP request` and `ARP reply` alone. To disable ARP requests and scan our target with the desired `ICMP echo requests`, we can disable ARP pings by setting the "`--disable-arp-ping`" option. Then we can scan our target again and look at the packets sent and received. 6. We can check TTL when we do a --disable-arp-ping and based on TTL know which OS it is.\ \ 128 - windows\ 64 - Linux/Mac\ 255 - network devices 7. To scan the "x" number of top ports (--top-ports=\) 8. -n: disables DNS resolution. Since DNS can be slow even with Nmap's built-in parallel stub resolver, this option reduces scanning times. 9. TCP Connect scan - The `Connect` scan (also known as a full TCP connect scan) is highly accurate because it completes the three-way TCP handshake, allowing us to determine the exact state of a port (open, closed, or filtered). However, it is not the most stealthy. In fact, the Connect scan is one of the least stealthy techniques, as it fully establishes a connection, which creates logs on most systems and is easily detected by modern IDS/IPS solutions.\ Eg:
**Connect Scan on TCP Port 443** ```shell-session $ sudo nmap 10.129.2.28 -p 443 --packet-trace --disable-arp-ping -Pn -n --reason -sT Starting Nmap 7.80 ( https://nmap.org ) at 2020-06-15 16:26 CET CONN (0.0385s) TCP localhost > 10.129.2.28:443 => Operation now in progress CONN (0.0396s) TCP localhost > 10.129.2.28:443 => Connected Nmap scan report for 10.129.2.28 Host is up, received user-set (0.013s latency). PORT STATE SERVICE REASON 443/tcp open https syn-ack Nmap done: 1 IP address (1 host up) scanned in 0.04 seconds ``` 10. Version scan = -sV 11. Script scan = -sC 12. Aggressive scan = -A 13. Nmap XML to GUI HTML report\ nmap \ -oA target\ xsltproc target.xml -o target.html 14. Firewall bypass - Decoy scan! -D RND:5 ## Firewall bypass 1. HTB Academy hard lab Firewall and IDS/IPS Evasion - Hard Lab > Now our client wants to know if it is possible to find out the version of the running services on unknown port behind Firewall IDS/IPS. Identify the version of service our client was talking about and submit the flag as the answer. [Firewall and IDS/IPS Evasion - Hard Lab](https://academy.hackthebox.com/module/19/section/119) > Scanning Options and Description * 10.129.2.28 Scans the specified target. * -p 21,22,25 Scans only the specified ports. * -sS Performs SYN scan on specified ports. * -sA Performs ACK scan on specified ports. * -Pn Disables ICMP Echo requests. * -n Disables DNS resolution. * \--disable-arp-ping Disables ARP ping. * \--packet-trace Shows all packets sent and received. > Scan by Using Decoys ``` sudo nmap 10.129.2.47 -p 22,80,50000 -sV -sS -Pn -n --disable-arp-ping --packet-trace --source-port 53 -e tun0 -D RND:10 ``` > Connect To The Filtered Port `50000` discovered, from a different source port of `53` to evade detection. ``` ncat -nv --source-port 53 10.129.2.47 50000 ``` > Additional techniques by targeting [Firewall and IDS/IPS Evasion](https://academy.hackthebox.com/module/19/section/106) > Testing Firewall Rule ``` sudo nmap 10.129.2.28 -n -Pn -p445 -O ``` > Scan by Using Different Source IP ``` sudo nmap 10.129.2.28 -n -Pn -p 445 -O -S 10.129.2.200 -e tun0 ``` > SYN-Scan From DNS Port ``` sudo nmap 10.129.2.28 -p50000 -sS -Pn -n --disable-arp-ping --packet-trace --source-port 53 ``` 2. Medium lab nmap -Pn -T4 -A -v -sV 10.129.57.157 -p 53 -D RND:5 --stats-every=5s