NMAP

Misc Target Specification

-6: Enable IPY6 scanning - I'- -il <inputfilename>: Input from list of hosts/networks

-A: Enable OS detection. version detection. script scanning, and traceroute - r-- -iR <num hosts>: Choose random targets

--datadir <dirname>: Specify custom Nmap data file location - r-- --exclude <hostl(,host2JLhost3J,...>: Exclude hosts/networks

--send-eth/--send-ip: Send using raw ethernet frames or IP packets - - --excludefile <exclude_file>: Exclude list from file

--privileged: Assume that the user is fully privileged -

--unprivileged: Assume the user lacks raw socket privileges - Host Discovery
-V: Print version number -
- -sl: List Scan - simply list targets to scan
-h: Print this help summary page. -
,._ -sn: Ping Scan - disable port scan

,._ -Pn: Treat all hosts as online -- skip host discovery

Output t-- -PS/PA/PU/PY: TCP SYN/ACK, UDP or SCTP discovery to given ports

-oN/-oX/-oS/-oG <file>: Output scan in normal, XML, sl<rlpt klddi3, and Grepable _ - -PE/PP/PM: ICMP echo, timestamp, and netmask request discovery probes
format, respectively, to the given filename.
,._ -PO(protocol listJ: IP Protocol Ping
-oA <basename>: Output in the three major formats at once -
,._ -n/-R: Never do DNS resolution/Always resolve (default sometimes}
-v: Increase verbosity level (use -w or more for greater effect) -
t-- --dns-servers <serv1Lserv2J,...>: Specify custom DNS servers
-d: Increase debugging level (use -dd or more for greater effect) -
- --system-dns: Use os·s DNS resolver
--reason: Display the reason a port is in a particular state -
'-- --traceroute: Trace hop path to each host
--op.n: Only show open (or possibly open) ports -

--packet-trace: Show all packets sent and received -

Scan Techniques
--iflist: Print host interfaces and routes (for debugging) -

--append-output: Append to rather than clobber specified output files - r-- -sS/sT/sA/sW/sM: TCP SYN/ConnectQ/ACK/Window/Maimon scans

resume <filename>: Resume an aborted scan - - -el.I: UDP Scan

--noninteradive: Disable runtime interactions via keyboard - ,._ -sN/sF/sX: TCP Null AN, and Xmas scans

--stylesheet <path/URL>: XSL stylesheet to transform XML output to HTML - r-- --scanflags <flags>: Customize TCP scan flags

--webxml: Reference stylesheet from [Link] for more portable XML - r-- -sJ <zombie host[:probeportJ>: Idle scan

--no-stylesheet: Prevent associating of XSL stylesheet w/XML output - - -sY/sZ: SCTP !NIT/COOKIE-ECHO scans

,._ ..0: F protocol scan

- -b < FTP relay host>: FTP bounce scan
Firewall/IDS Evasion & Spoofing

-f: --mtu <val>: fragment packets (optionally w/given MTU) -

Port Specification & Scan Order
-0 <decoyl,decoy2(,MEJ, ...>: Cloak a scan with decoys -

-5 <IP_Address>: Spoof source address - ,._ -p <port ranges>: Only scan specified ports

-e <iface>: Use specified interface - t-- --exclude-ports <port ranges>: Exclude the specified ports from scanning

-g/--source-port <portnum>: Use given port number - - -F: Fast mode - Scan fewer ports than the default scan

--proxies <urll,[url2J,... >: Relay connections through HTTP/SOCKS4 proxies - ,._ -r: Scan ports sequentially - don't randomize

--data <hex string>: Append a custom payload to sent packets - I'- --top-ports <number>: Scan <number> most common ports

--data-string <string>: Append a custom ASCD string to sent packets - - --port-ratio <ratio>: Scan ports more common than <ratio>

--data-length <num>: Append random data to sent packets -

--Ip-options <options>: Send packets with specified ip options - ServiceNersion Detection

--ttl <val>: Set IP time-to-live field -
,._ -sV: Probe open ports to determine service/version info
--spoof-mac <mac address/prefix/vendor name>: Spoof your MAC address -
r-- --version-intensity <level>: Set from O (light) to 9 (try all probes)
--badsum: Send packets with a bogus TCP/UDP/SCTP checksum -
- --version-light Limit to most likely probes (intensity 2)

,._ --version-all: Try every single probe (intensity 9)

Timing & Performance - --version-trace: Show detailed version scan activity (for debugging)

-T<0-5>: Set timing template (higher is faster) -

--mln-hostgroup/max-hostgroup <size>: Parallel host scan group sizes - Script Scan

--min-parallelism/max-parallelism <numprobes>: Probe parallelization -
,._ -sC: equivalent to --script=default
--min-rtt-timeout/max-rtt-timeout/initial-rtt-timeout <time>: Specifies probe _
round trip time. --script= <Lua scripts>: <Lua scripts> is a comma separated list of directories,
script-files or script-categories.
--max-retries <tries>: Caps number of port scan probe retransmissions. -
t-- --script-args=<nl=vl,[n2=v2, ...J>: provide arguments to scripts
--host-timeout <time>: Give up on target after this tong -
- --script-args-file=filename: provide NSE script args in a file
--scan-delay/--max-scan-delay <time>: Adjust delay between probes -
,._ --script-trace: Show all data sent and received
--min-rate <number>: Send packets no slower than <number> per second -
I'- --script-updatedb: Update the script database.
--max-rate <number>: Send packets no faster than <number> per second -
- --script-help= <Lua scripts>: Show help about scripts. <Lua scripts> is a comma-
separated list of script-files or script-categories.

OS Detection

-0: Enable OS detection -

--osscan-limit: Limit OS detection to promising targets -

--osscan-guess. Guess OS more aggressively -