🔰 Basic Nmap Scans
nmap target.com
👉 Default scan (top 1000 TCP ports)
nmap 192.168.1.1
👉 Scan an IP address
nmap 192.168.1.1-50
👉 Scan IP range
nmap 192.168.1.0/24
👉 Scan entire subnet
🚀 Fast & Stealthy Scans
nmap -T4 target.com
👉 Faster scan (good balance)
nmap -T5 target.com
👉 Very fast (noisy, can be detected)
nmap -sS target.com
👉 SYN scan (stealth scan – requires root)
sudo nmap -sS target.com
🔍 Port-Specific Scans
nmap -p 80 target.com
👉 Scan specific port
nmap -p 1-65535 target.com
👉 Scan all ports
nmap -p 21,22,80,443 target.com
👉 Multiple specific ports
🧠 Service & Version Detection
nmap -sV target.com
👉 Detect service versions
nmap -sV -p 80,443 target.com
👉 Version detection on specific ports
🖥️ OS Detection
sudo nmap -O target.com
👉 Detect operating system
sudo nmap -A target.com
👉 Aggressive scan (OS + services + scripts + traceroute)
📜 NSE Script Scans (Very Important 🔥)
nmap --script default target.com
nmap --script vuln target.com
👉 Check for known vulnerabilities
nmap --script http-enum target.com
👉 Enumerate web directories
nmap --script ssh-auth-methods target.com
👉 SSH auth methods
nmap --script smb-enum-shares target.com
👉 SMB share enumeration
🕵️ Firewall / IDS Evasion
nmap -f target.com
👉 Fragment packets
nmap --data-length 50 target.com
👉 Add random data
nmap -D RND:10 target.com
👉 Decoy scan (hide your IP)
📤 Output Saving (For Reports)
nmap -oN output.txt target.com
nmap -oX output.xml target.com
nmap -oA scan_result target.com
👉 Saves in all formats
🧪 UDP Scan (Slow but useful)
sudo nmap -sU target.com
sudo nmap -sU -p 53,67,123 target.com