search

Scanning

Scanning tools Cheatsheat

hashtag
Nmap

hashtag
Scan all ports

nmap 192.168.1.1 -p-
┌──(root㉿INE)-[~]
└─# nmap demo.ine.local -p-
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-11-04 19:08 IST
Nmap scan report for demo.ine.local (192.233.140.3)
Host is up (0.000028s latency).
Not shown: 65532 closed tcp ports (reset)
PORT      STATE SERVICE
6421/tcp  open  nim-wan
41288/tcp open  unknown
55413/tcp open  unknown
MAC Address: 02:42:C0:E9:8C:03 (Unknown)

Nmap done: 1 IP address (1 host up) scanned in 3.08 seconds

hashtag
Service detection

nmap 192.168.1.1 -sV

hashtag
Faster scan with aggressive scan and on all ports (best of CTFs)

Useful Flags

  • -v to show the current results with scan

  • -A Enables OS detection, version detection, script scanning, and traceroute

  • -sV Probe open ports to determine service/version info

  • -sC Default script sets

  • --script vuln To test for vulnerabilities

  • -sU UDP scan

hashtag
Scan if Ping/ ICMP is blocked

hashtag
UDP Scan

hashtag
Nmap scripts

scripts can be found at fol location

hashtag
Getting Help about the scripts

hashtag
Running complete category of scripts

hashtag
Running all scripts belonging to a name

hashtag
Enumerating OS details with nmap script over smb

hashtag
Enumerate NetBios

hashtag
DNS service discovery

hashtag
DNS brute force

hashtag
common services DNS records

hashtag
Http enumeration

hashtag
Avoiding Firewall

hashtag
Fraqmentation

  • -Pn: (Firewall Bypass) Tells nmap to skip the ping test. It assumes the host is online. This is crucial for scanning hosts that are configured to block pings (which is very common).

  • -sS: (Stealth Scan) This is a "TCP SYN Scan." It's called "stealthy" because it doesn't complete the full TCP connection, which makes it less likely to be logged by applications. It's the default (and most popular) scan type when running nmap as root.

  • -sV: (Service & Version Scan) This is the enumeration part. Instead of just reporting a port as "open," it probes that port to determine the exact service and software version (e.g., Microsoft Windows RDP or Apache httpd 2.4.41).

  • -p80,445,3389: (Targeted Ports) This is what makes the scan focused. You are only checking these three specific ports, which are strong indicators of a Windows machine:

    • 80: Standard port for HTTP (Web Server).

    • 445: The modern port for SMB (Windows File Sharing).

    • 3389: The standard port for RDP (Remote Desktop Protocol).

  • -f: (Firewall Evasion) This tells nmap to fragment its packets. It splits the scan probes into smaller pieces, which can sometimes confuse or bypass simple firewalls and Intrusion Detection Systems (IDS).

hashtag
mtu (Maximum transmitted Unit)

  • nmap: The tool.

  • -Pn: Assumes the host is online (skips the ping test).

  • -sS: Uses a stealthy TCP SYN scan.

  • -sV: Performs a service and version scan.

  • -p80,445,3389: Scans only these three common Windows ports.

  • --mtu 24: This is the new flag.

    • It sets the Maximum Transmission Unit (MTU) for the packets to 24 bytes.

    • This forces nmap to break its scan probes (which are larger than 24 bytes) into multiple, tiny fragments.

    • Important: The value (like 24) must be a multiple of 8. So, 8, 16, 24, 32, etc., are all valid.

  • 10.4.27.83: Your target IP address.

hashtag
example evasion

  • -Pn -sS -sV -p445,3389 -f: This is the base of your previous scan: a fragmented stealth scan for Windows services (SMB and RDP) that bypasses ping-blocking firewalls.

The New Evasion Techniques:

  • --data-length 200: (Evade Packet Inspection)

    • This is a clever technique. It tells nmap to add 200 bytes of random data to the end of its scan packets.

    • Why? Simple firewalls and IDS often have "signatures" to detect scans. They might be looking for a default nmap SYN packet, which has a specific, small size. By adding 200 bytes of junk data, you make your packet a non-standard length, which can cause it to "slip by" simple filters that are not advanced enough to look deeper.

  • -D 10.10.23.1,10.10.23.2: (Evade Source IP-Blocking)

    • This is a Decoy Scan, one of nmap's most powerful evasion features.

    • It makes the target think it is being scanned by multiple IP addresses at once.

    • nmap will send scan packets where the "source" IP is spoofed to be 10.10.23.1 or 10.10.23.2. It also sends packets from your real IP (which is hidden in this "crowd" of decoys).

    • Why? If the target's security admin sees alerts, they will see scan traffic from 3 different IPs (the 2 decoys + you). This makes it much harder for them to determine which IP is the real attacker and which ones are just noise.

  • 10.4.27.83: This is your actual target.

PreviousHost DiscoveryNextNmap Alternatives

Last updated