Ctrlk
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Scanning

Scanning tools Cheatsheat

Nmap

Scan all ports

nmap 192.168.1.1 -p-
┌──(root㉿INE)-[~]
└─# nmap demo.ine.local -p-
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-11-04 19:08 IST
Nmap scan report for demo.ine.local (192.233.140.3)
Host is up (0.000028s latency).
Not shown: 65532 closed tcp ports (reset)
PORT      STATE SERVICE
6421/tcp  open  nim-wan
41288/tcp open  unknown
55413/tcp open  unknown
MAC Address: 02:42:C0:E9:8C:03 (Unknown)

Nmap done: 1 IP address (1 host up) scanned in 3.08 seconds

Service detection

nmap 192.168.1.1 -sV

Faster scan with aggressive scan and on all ports (best of CTFs)

Useful Flags

  • -v to show the current results with scan

  • -A Enables OS detection, version detection, script scanning, and traceroute

  • -sV Probe open ports to determine service/version info

  • -sC Default script sets

  • --script vuln To test for vulnerabilities

  • -sU UDP scan

Scan if Ping/ ICMP is blocked

UDP Scan

Nmap scripts

scripts can be found at fol location

Getting Help about the scripts

Running complete category of scripts

Running all scripts belonging to a name

Enumerating OS details with nmap script over smb

Enumerate NetBios

DNS service discovery

DNS brute force

common services DNS records

Http enumeration

Avoiding Firewall

Fraqmentation

  • -Pn: (Firewall Bypass) Tells nmap to skip the ping test. It assumes the host is online. This is crucial for scanning hosts that are configured to block pings (which is very common).

  • -sS: (Stealth Scan) This is a "TCP SYN Scan." It's called "stealthy" because it doesn't complete the full TCP connection, which makes it less likely to be logged by applications. It's the default (and most popular) scan type when running nmap as root.

  • -sV: (Service & Version Scan) This is the enumeration part. Instead of just reporting a port as "open," it probes that port to determine the exact service and software version (e.g., Microsoft Windows RDP or Apache httpd 2.4.41).

  • -p80,445,3389: (Targeted Ports) This is what makes the scan focused. You are only checking these three specific ports, which are strong indicators of a Windows machine:

    • 80: Standard port for HTTP (Web Server).

    • 445: The modern port for SMB (Windows File Sharing).

    • 3389: The standard port for RDP (Remote Desktop Protocol).

  • -f: (Firewall Evasion) This tells nmap to fragment its packets. It splits the scan probes into smaller pieces, which can sometimes confuse or bypass simple firewalls and Intrusion Detection Systems (IDS).

mtu (Maximum transmitted Unit)

  • nmap: The tool.

  • -Pn: Assumes the host is online (skips the ping test).

  • -sS: Uses a stealthy TCP SYN scan.

  • -sV: Performs a service and version scan.

  • -p80,445,3389: Scans only these three common Windows ports.

  • --mtu 24: This is the new flag.

    • It sets the Maximum Transmission Unit (MTU) for the packets to 24 bytes.

    • This forces nmap to break its scan probes (which are larger than 24 bytes) into multiple, tiny fragments.

    • Important: The value (like 24) must be a multiple of 8. So, 8, 16, 24, 32, etc., are all valid.

  • 10.4.27.83: Your target IP address.

example evasion

  • -Pn -sS -sV -p445,3389 -f: This is the base of your previous scan: a fragmented stealth scan for Windows services (SMB and RDP) that bypasses ping-blocking firewalls.

The New Evasion Techniques:

  • --data-length 200: (Evade Packet Inspection)

    • This is a clever technique. It tells nmap to add 200 bytes of random data to the end of its scan packets.

    • Why? Simple firewalls and IDS often have "signatures" to detect scans. They might be looking for a default nmap SYN packet, which has a specific, small size. By adding 200 bytes of junk data, you make your packet a non-standard length, which can cause it to "slip by" simple filters that are not advanced enough to look deeper.

  • -D 10.10.23.1,10.10.23.2: (Evade Source IP-Blocking)

    • This is a Decoy Scan, one of nmap's most powerful evasion features.

    • It makes the target think it is being scanned by multiple IP addresses at once.

    • nmap will send scan packets where the "source" IP is spoofed to be 10.10.23.1 or 10.10.23.2. It also sends packets from your real IP (which is hidden in this "crowd" of decoys).

    • Why? If the target's security admin sees alerts, they will see scan traffic from 3 different IPs (the 2 decoys + you). This makes it much harder for them to determine which IP is the real attacker and which ones are just noise.

  • 10.4.27.83: This is your actual target.

PreviousHost DiscoveryNextNmap Alternatives

Last updated