> For the complete documentation index, see [llms.txt](https://f1shh.gitbook.io/pentest-tips/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://f1shh.gitbook.io/pentest-tips/recon/nmap.md).

# Nmap

## Nmap

Nmap is a very useful and effective port-scanner / network enumeration tool. Here are some fun things you can do with it:

## Good opsec

Do not forget to use the following flag when stealth is important.

```bash
--script-args http.useragent="CUSTOM_AGENT"
```

## Port Scans

### Host Discovery (ping sweep)

```bash
nmap -sn <ip>/<cidr>
```

### Aggressive Scan a single port

```bash
nmap -p<port> -A <ip>
```

### Syn Scan for all open ports

```bash
nmap -p- -sS <ip>
```

### Fuck you tell me scans (can be loud)

```bash
nmap -p- -v -T4 <ip>
nmap -p<ports> -sV -sC -T4 -Pn -oA <ip> <ip>
```

## Threader3000

Threader3000 has quickly became my go to port scanning tool. It can be used to quickly scan all ports on a host, then perform a verbose Nmap scan on only the discovered ports. The speed and thoroughness of this tool just cant be beat<br>

* <https://github.com/dievus/threader3000>

```bash
pip install threader3000
threader3000
```

## Enumeration

### SMB Enumeration

```bash
nmap -p445 --script=smb-enum-shares.nse,smb-enum-users.nse <ip>
```

### RPC Enumeration

```bash
nmap -p 111 --script=nds-la,nfs-statfs,nfs-showmount <ip>
```