49.4 Nmap Cheat Sheet
Scanning = map open doors on OWN ranges. Mass SYN on stranger networks = illegal + noisy. -T2 gentle for lab. Blue: how this looks in logs / SG. Ghabru naka – ethics line pehle.
Host discovery and core scans
| Command | Meaning | Blue note |
|---|---|---|
nmap -sn 192.168.56.0/24 | Ping / host discovery (no port scan) | Inventory OWN lab only |
sudo nmap -sS 192.168.56.20 | TCP SYN (half-open) scan | Mass SYN → IDS / SG / Flow Logs noise |
nmap -sT 192.168.56.20 | TCP connect scan | No root needed; louder on target logs |
sudo nmap -sU --top-ports 20 192.168.56.20 | UDP top ports (slow) | Close unused UDP; expect false open|filtered |
nmap -sV 192.168.56.20 | Service / version detection | Banner leak = patch priority input |
nmap -sC 192.168.56.20 | Default script set | Still OWN IPs only |
sudo nmap -O 192.168.56.20 | OS guess (may need root) | Reduce fingerprint by minimal services |
nmap -p 22,80,443,3306 192.168.56.20 | Specific ports | Prefer needing only 80/443 public |
nmap -p- 192.168.56.20 | All TCP ports (long) | Lab patience; do not spray internet |
nmap -T2 … | Polite timing | Lab default in this book; quieter than -T4 |
nmap -oN out.txt / -oX out.xml | Normal / XML output | Before/after harden evidence |
nmap -oA basename | All main output formats | Save under ~/labs/… |
Common ports to remember (lab checklist)
| Port | Typical service | Blue habit |
|---|---|---|
| 22 | SSH | Keys-only; restrict source SG |
| 80 / 443 | HTTP / HTTPS | Prefer HTTPS; patch web stack |
| 21 / 23 | FTP / Telnet | Disable – cleartext era |
| 25 / 587 | SMTP / submission | Auth + TLS; not open relay |
| 53 | DNS | Harden recursion; monitor anomalies |
| 139 / 445 | NetBIOS / SMB | No SMB to internet; patch |
| 3306 | MySQL | Localhost / private only |
| 3389 | RDP | MFA / allow-list; not open world |
| 8080 / 8443 | Alt HTTP(S) | Often forgotten admin UIs – lock down |
| Red team (attacker) does | Blue team (defender) detects / stops |
|---|---|
nmap -sS -T4 across cafe / client ranges |
Written IP allow-list; host-only adapter; legal refusal |
Full -p- + -sV on production without change window |
Change ticket; canary; rate limits; SOC alert on scan storms |
| Leaves FTP/Telnet/MySQL open “for lab forever” on EIP | Close ports; sudo service stop unused; SG deny; re-scan proof |
Ravindra Bagale's Tip
Students rattle off -T5 -p- and feel like a “pro”. In the lab, start with -T2 + a short port list. In interviews, “I scanned a random /24” = a red flag. Caption always: OWN Metasploitable 192.168.56.20. Got it?
Ravindra Bagale's Tip – मराठी
Students -T5 -p- पटापट वापरून “pro” feel करतात. Lab मध्ये आधी -T2 + छोटी port list. Interview मध्ये “I scanned random /24” = red flag. Caption नेहमी: OWN Metasploitable 192.168.56.20. समजले का?
Ravindra Bagale's Tip – हिंदी
Students -T5 -p- चलाकर “pro” feel करते हैं. Lab में पहले -T2 + छोटी port list. Interview में “I scanned random /24” = red flag. Caption हमेशा: OWN Metasploitable 192.168.56.20. समझ आया?
Lab
From Kali 192.168.56.10 against only Metasploitable 192.168.56.20: sudo nmap -sS -T2 -p 21,22,23,25,80,139,445,3306 192.168.56.20 -oN ~/labs/nmap-cheatsheet-before.txt. Write one Blue line per open port. No exploit. Optional: after hardening your OWN .50 Amazon Linux, re-scan and diff.