# Nmap Scanner > How to use Nmap for network scanning, port discovery, service detection, and vulnerability assessment. Use this skill whenever the user needs to scan networks, discover hosts, enumerate ports, detect services, identify vulnerabilities, build static Nmap binaries for restricted environments, or optimize Nmap scan performance. Make sure to use this skill for any network reconnaissance, penetration testing, security auditing, or infrastructure discovery tasks involving Nmap, even if the user doesn't explicitly mention 'Nmap' or 'network scanning'. - Skill: `abelrguezr/nmap-scanner` (Agent Skill, multi-file: 4 files) - Install (CLI): `npx skillmds@latest add abelrguezr/nmap-scanner` - Raw SKILL.md: https://api.skillmd.com/api/skills/abelrguezr/nmap-scanner/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Product & Planning - Author: abelrguezr (https://skillmd.com/u/abelrguezr) - Updated: 2026-09-10 - Page: https://skillmd.com/skills/abelrguezr/nmap-scanner --- # Nmap Scanner Skill A comprehensive guide to using Nmap for network reconnaissance, port scanning, service detection, and vulnerability assessment. ## Quick Start ### Basic Scan Command ```bash nmap -sV -sC -O -n -oA nmapscan ``` **What this does:** - `-sV`: Detect service versions - `-sC`: Run default scripts - `-O`: Enable OS detection - `-n`: Skip DNS resolution - `-oA`: Output in all formats (normal, XML, grepable) ### Common Scan Patterns | Use Case | Command | |----------|---------| | Quick port scan | `nmap -F ` | | Full port scan | `nmap -p- ` | | Stealth scan | `nmap -sS ` | | UDP scan | `nmap -sU ` | | Aggressive scan | `nmap -A ` | | No ping scan | `nmap -Pn ` | ## Target Specification ### Specify Targets ```bash # Single IP nmap 192.168.1.1 # IP range nmap 192.168.1.1-100 # CIDR notation nmap 192.168.1.0/24 # Multiple targets nmap 192.168.1.1 192.168.1.2 192.168.1.3 # From file nmap -iL targets.txt # Random IPs nmap -iR 10 # Exclude specific IPs nmap --exclude 192.168.1.1,192.168.1.2 192.168.1.0/24 ``` ## Host Discovery ### Discovery Options | Option | Description | Use When | |--------|-------------|----------| | `-sL` | List scan (DNS only) | Quick target enumeration | | `-sn` | Ping scan (no port scan) | Find live hosts | | `-Pn` | No ping (assume hosts up) | Hosts block ICMP | | `-PR` | ARP ping | Local network scanning | | `-PS ` | TCP SYN ping | Check specific ports | | `-PA ` | TCP ACK ping | Firewall detection | | `-PU ` | UDP ping | UDP service discovery | ### Discovery Examples ```bash # ARP scan on local network nmap -sn -PR 192.168.1.0/24 # TCP SYN ping on port 80 nmap -sn -PS80 192.168.1.0/24 # Assume all hosts are up (skip discovery) nmap -Pn 192.168.1.0/24 ``` ## Port Scanning Techniques ### Scan Types | Option | Name | Privileges | Description | |--------|------|------------|-------------| | `-sS` | SYN scan | Yes | Stealthy, default with root | | `-sT` | TCP connect | No | Complete connection, works without root | | `-sU` | UDP scan | Yes | Slower, for UDP services | | `-sN` | NULL scan | Yes | No flags set | | `-sF` | FIN scan | Yes | FIN flag only | | `-sX` | Xmas scan | Yes | FIN+PSH+URG flags | | `-sA` | ACK scan | Yes | Firewall mapping | | `-sW` | Window scan | Yes | Distinguish open/closed | | `-sY` | SCTP scan | Yes | SCTP protocol | | `-sO` | IP protocol | Yes | Protocol scan | ### Port Selection ```bash # Top 100 ports (fast) nmap -F # Top 1000 ports (default) nmap # All 65535 ports nmap -p- # Specific ports nmap -p 22,80,443 # Port range nmap -p 1-1024 # Multiple protocols nmap -p U:53,T:21-25,80,139,S:9 # Top N ports nmap --top-ports 100 # Randomize port order nmap -p- --randomize-hosts # Sequential port order nmap -p- -r ``` ## Service and Version Detection ### Version Detection ```bash # Basic version detection nmap -sV # Version detection with intensity (0-9, default 7) nmap -sV --version-intensity 5 # Aggressive version detection nmap -sV --version-intensity 9 ``` ### Version Detection Intensity Levels | Level | Description | |-------|-------------| | 0 | Only most probable probes | | 1-3 | Increasing probe count | | 7 | Default intensity | | 9 | Maximum probes, longest time | ## Nmap Scripting Engine (NSE) ### Script Categories | Category | Purpose | Safety | |----------|---------|--------| | `default` | Basic discovery | Safe | | `safe` | Non-intrusive | Safe | | `discovery` | Information gathering | Safe | | `version` | Version detection | Safe | | `auth` | Authentication testing | May be intrusive | | `vuln` | Vulnerability detection | Safe | | `exploit` | Exploitation | Intrusive | | `dos` | Denial of service | Intrusive | | `fuzzer` | Input fuzzing | Intrusive | | `malware` | Malware detection | Safe | ### Using Scripts ```bash # Run default scripts nmap -sC # Run specific script nmap --script http-title # Run script category nmap --script=vuln # Run multiple scripts nmap --script=http-title,http-server-header # Run all safe scripts nmap --script=safe # Exclude intrusive scripts nmap --script="not intrusive" # Complex script selection nmap --script="(default or safe) and not http-*" ``` ### Script Arguments ```bash # Pass arguments to scripts nmap --script=http-headers --script-args http.useragent="Mozilla/5.0" # Load arguments from file nmap --script=vulscan --script-args-file vuln-args.txt # Trace script execution nmap --script-trace --script=http-title ``` ### Finding Scripts ```bash # List all scripts nmap --script-help=all # Search by pattern nmap --script-help="http-*" # Get help for specific script nmap --script-help=http-title # List scripts by category nmap --script-help=vuln ``` ## OS Detection ### OS Detection Options ```bash # Basic OS detection nmap -O # Aggressive OS detection nmap -O --osscan-guess # Limit OS detection (requires open + closed port) nmap -O --osscan-limit ``` ### OS Detection Requirements - At least one open TCP port - At least one closed TCP port - Root privileges for best results - Works best on non-Windows systems ## Timing and Performance ### Timing Templates | Template | Description | Use Case | |----------|-------------|----------| | `-T0` | Paranoid | Maximum stealth | | `-T1` | Sneaky | Very slow, stealthy | | `-T2` | Polite | Slower than normal | | `-T3` | Normal | Default | | `-T4` | Aggressive | Faster, may trigger IDS | | `-T5` | Insane | Maximum speed, unreliable | ### Timing Control ```bash # Set timing template nmap -T4 # Host timeout (per host) nmap --host-timeout 30m # Scan delay between probes nmap --scan-delay 1s # Maximum scan delay nmap --max-scan-delay 10s # Minimum/maximum packets per second nmap --min-rate 100 --max-rate 1000 # Retry settings nmap --max-retries 3 # RTT timeout settings nmap --min-rtt-timeout 100ms --max-rtt-timeout 10s ``` ### Speed Optimization ```bash # Defeat RST rate limiting (faster for filtered ports) nmap --defeat-rst-ratelimit # Adjust host group size nmap --min-hostgroup 256 --max-hostgroup 1024 # Adjust parallelism nmap --min-parallelism 10 --max-parallelism 100 ``` ## Firewall and IDS Evasion ### Evasion Techniques ```bash # Fragment packets nmap -f # Fragment with specific MTU nmap --mtu 16 # Use decoys nmap -D 192.168.1.1,192.168.1.2,ME # Random decoys nmap -D RND:10 # Spoof source IP nmap -S 192.168.1.100 # Use specific interface nmap -e eth0 # Spoof source port nmap --source-port 53 # Spoof MAC address nmap --spoof-mac Apple # Randomize host order nmap --randomize-hosts # Set TTL nmap --ttl 10 ``` ### Data Manipulation ```bash # Send custom data (hex) nmap --data "0xdeadbeef" # Send custom data (string) nmap --data-string "Scan by Security Team" # Add random data length nmap --data-length 100 # Set IP options nmap --ip-options "S:192.168.1.1" ``` ## Output Formats ### Output Options | Option | Format | Description | |--------|--------|-------------| | `-oN` | Normal | Human-readable | | `-oX` | XML | Machine-readable | | `-oG` | Greppable | Easy to parse | | `-oA` | All | All formats (except -oS) | ### Output Examples ```bash # All formats with same prefix nmap -oA scan_results # Specific format nmap -oX scan_results.xml # Append to existing file nmap -oA - append_scan ``` ### Verbosity and Debugging ```bash # Increase verbosity nmap -v nmap -vv nmap -vvv # Enable debugging nmap -d nmap -dd # Show reasons for state nmap --reason # Show packet trace nmap --packet-trace # Show version trace nmap --version-trace # Show script trace nmap --script-trace # Show progress stats nmap --stats-every 1m ``` ## Vulscan (Vulnerability Scanning) ### Vulscan Usage ```bash # Run vulscan with all databases sudo nmap -sV --script=vulscan # Run vulscan with specific database sudo nmap -sV --script=vulscan --script-args vulscandb=cve.csv # Run vulscan with multiple databases sudo nmap -sV --script=vulscan --script-args vulscandb=cve.csv,scipvuldb.csv ``` ### Vulscan Databases | Database | Source | |----------|--------| | `cve.csv` | MITRE CVE | | `scipvuldb.csv` | SCIP Vulnerability DB | | `osvdb.csv` | OSVDB | | `securityfocus.csv` | SecurityFocus BID | | `securitytracker.csv` | SecurityTracker | | `xforce.csv` | IBM X-Force | | `exploitdb.csv` | Exploit-DB | | `openvas.csv` | OpenVAS | ## Advanced Features ### Traceroute ```bash # Enable traceroute nmap --traceroute # Traceroute with specific protocol nmap --traceroute --traceroute-port 80 ``` ### IPv6 ```bash # Enable IPv6 scanning nmap -6 # IPv6 with version detection nmap -6 -sV ``` ### Resume Interrupted Scan ```bash # Resume from previous scan nmap --resume scan_results.xml ``` ### Runtime Interaction While Nmap is running, press: | Key | Action | |-----|--------| | `v` | Increase verbosity | | `V` | Decrease verbosity | | `d` | Increase debugging | | `D` | Decrease debugging | | `p` | Toggle packet trace | | `?` | Show help | ## Common Scan Recipes ### Quick Reconnaissance ```bash nmap -sV -sC -O -n -oA quick_scan ``` ### Full Port Scan ```bash nmap -p- -sV -sC -oA full_scan ``` ### Stealth Scan ```bash nmap -sS -T2 -f -D RND:5 ``` ### Vulnerability Assessment ```bash sudo nmap -sV -sC --script=vuln -oA vuln_scan ``` ### Web Service Scan ```bash nmap -p 80,443,8080,8443 --script=http-* -sV ``` ### Database Scan ```bash nmap -p 3306,5432,1433,27017,6379 --script=mysql-info,postgres-version,ms-sql-info,redis-info -sV ``` ### Network Discovery ```bash nmap -sn -PR 192.168.1.0/24 ``` ### Aggressive Full Scan ```bash nmap -A -T4 -oA aggressive_scan ``` ## Building Static Nmap for Restricted Environments For hardened or minimal Linux environments (containers, appliances), use the bundled script to build a statically linked Nmap binary. ```bash # Run the build script ./scripts/build-static-nmap.sh # Output: nmap-linux-amd64-static-bundle.tar.gz ``` The bundle includes: - Statically linked Nmap binary - NSE scripts directory - NSE data files (services, protocols, OS database, etc.) ## Troubleshooting ### Common Issues | Problem | Solution | |---------|----------| | Permission denied | Run with `sudo` | | No route to host | Check network connectivity | | Scan too slow | Use `-T4` or `-T5` | | False negatives | Use `-Pn` to skip ping | | Firewall blocking | Use `-f` or `-D` options | | Missing scripts | Check NSE installation | | Version detection fails | Increase `--version-intensity` | ### Debugging Tips ```bash # Enable verbose output nmap -vvv # Enable debugging nmap -ddd # Trace packets nmap --packet-trace # Show reasons nmap --reason ``` ## Best Practices 1. **Always specify output format** - Use `-oA` to save results 2. **Use appropriate timing** - `-T3` for normal, `-T4` for faster 3. **Skip DNS when not needed** - Use `-n` for speed 4. **Test on authorized targets only** - Ensure you have permission 5. **Document your scans** - Include date, purpose, and scope 6. **Use scripts selectively** - Default scripts are usually sufficient 7. **Verify results** - Cross-check with manual testing 8. **Keep Nmap updated** - New scripts and features regularly added ## References - [Nmap Official Documentation](https://nmap.org/book/) - [Nmap Scripting Engine](https://nmap.org/book/nse.html) - [Nmap Service Probes](https://nmap.org/book/nmap-service-probes.html) - [Nmap Output Formats](https://nmap.org/book/output-formats.html) ## See Also - `scripts/build-static-nmap.sh` - Build static Nmap binary - `scripts/nmap-command-builder.sh` - Generate Nmap commands from requirements