# nmap

### Base Syntax

```bash
nmap {Targets} [ScanType] [Options]
```

### Target

<table id="bkmrk-purpose-example-1-ta"><thead><tr><th>Purpose</th><th>Example</th></tr></thead><tbody><tr><td>1 target</td><td>`nmap IP`</td></tr><tr><td>scan multiple targets</td><td>`nmap IP1, IP2, IP3`</td></tr><tr><td>scan a list</td><td>`nmap -iL list.txt`</td></tr><tr><td>scan CIDR range</td><td>`nmap 192.168.1.0/24`</td></tr></tbody></table>

### Ports

<table id="bkmrk-purpose-example-scan"><thead><tr><th>Purpose</th><th>Example</th></tr></thead><tbody><tr><td>Scan top 1k popular ports</td><td>`nmap IP`</td></tr><tr><td>Port range</td><td>`nmap -p x-y`</td></tr><tr><td>Port list</td><td>`nmap -p x,y,z`</td></tr><tr><td>linear portrange</td><td>`nmap -r x-y`</td></tr></tbody></table>

### Probing

<table id="bkmrk-purpose-example-don%27"><thead><tr><th>Purpose</th><th>Example</th></tr></thead><tbody><tr><td>Don't probe</td><td>`nmap IP -Pn`</td></tr><tr><td>Default probe</td><td>`nmap IP -PB`</td></tr><tr><td>ICMP Echo Request</td><td>`nmap IP -PE`</td></tr><tr><td>ICMP Timestamp Request</td><td>`nmap IP -PP`</td></tr><tr><td>ICMP Network Request</td><td>`nmap IP -PM`</td></tr></tbody></table>

### Scan Type

<table id="bkmrk-purpose-example-prob"><thead><tr><th>Purpose</th><th>Example</th></tr></thead><tbody><tr><td>Probe only</td><td>`nmap IP -sn`</td></tr><tr><td>SYN Scan</td><td>`nmap IP -sS`</td></tr><tr><td>TCP Connect Scan</td><td>`nmap IP -sT`</td></tr><tr><td>UDP Scan</td><td>`nmap IP -su`</td></tr><tr><td>Version scan</td><td>`nmap IP -sV`</td></tr><tr><td>OS Detection</td><td>`nmap IP -PM`</td></tr><tr><td>Set TCP flags</td><td>`nmap IP --scanflags: x,y,z`</td></tr></tbody></table>

### Timing Options

<table id="bkmrk-purpose-example-para"><thead><tr><th>Purpose</th><th>Example</th></tr></thead><tbody><tr><td>Paranoid</td><td>`nmap IP -T0`</td></tr><tr><td>Sneaky</td><td>`nmap IP -T1`</td></tr><tr><td>Polite</td><td>`nmap IP -T2`</td></tr><tr><td>Normal</td><td>`nmap IP -T3`</td></tr><tr><td>Aggressive</td><td>`nmap IP -T4`</td></tr><tr><td>Insane</td><td>`nmap IP -T5`</td></tr></tbody></table>

### Output Format

<table id="bkmrk-purpose-example-stan"><thead><tr><th>Purpose</th><th>Example</th></tr></thead><tbody><tr><td>Standard</td><td>`nmap IP -oN file.txt`</td></tr><tr><td>Greppable</td><td>`nmap IP -oG file.txt`</td></tr><tr><td>XML</td><td>`nmap IP -oX file.txt`</td></tr><tr><td>all formats</td><td>`nmap IP -oA file`</td></tr></tbody></table>

### Misc Options

<table id="bkmrk-purpose-example-aggr"><thead><tr><th>Purpose</th><th>Example</th></tr></thead><tbody><tr><td>Aggresive scan</td><td>`nmap IP -A`</td></tr><tr><td>nmap reason why a port is in a state</td><td>`nmap IP --reason`</td></tr></tbody></table>