From 58e4f8d587d50c023538cac31b4cd44dbb1800d3 Mon Sep 17 00:00:00 2001 From: codings9 Date: Mon, 10 Feb 2014 00:06:24 -0800 Subject: [PATCH 01/14] Update nmap.md Added "Help Text." --- tools/nmap.md | 1 + 1 file changed, 1 insertion(+) diff --git a/tools/nmap.md b/tools/nmap.md index b0bf38e..9fbf461 100644 --- a/tools/nmap.md +++ b/tools/nmap.md @@ -7,6 +7,7 @@ Nmap(“Network Mapper”) is a security scanner originally written by Gordon Ly Help Text ------- +nmap -h, nmap --h Example Usage ------- From 0e94f1af1f310f889177010a9e160d34285178f4 Mon Sep 17 00:00:00 2001 From: codings9 Date: Wed, 12 Feb 2014 22:50:20 +0000 Subject: [PATCH 02/14] Update nmap.md --- tools/nmap.md | 117 +++++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 116 insertions(+), 1 deletion(-) diff --git a/tools/nmap.md b/tools/nmap.md index 9fbf461..6b63f93 100644 --- a/tools/nmap.md +++ b/tools/nmap.md @@ -7,7 +7,122 @@ Nmap(“Network Mapper”) is a security scanner originally written by Gordon Ly Help Text ------- -nmap -h, nmap --h +nmap -h, nmap --h, nmap -help + +nmap -help + +Nmap 6.25 ( http://nmap.org ) +Usage: nmap [Scan Type(s)] [Options] {target specification} +TARGET SPECIFICATION: + Can pass hostnames, IP addresses, networks, etc. + Ex: scanme.nmap.org, microsoft.com/24, 192.168.0.1; 10.0.0-255.1-254 + -iL : Input from list of hosts/networks + -iR : Choose random targets + --exclude : Exclude hosts/networks + --excludefile : Exclude list from file +HOST DISCOVERY: + -sL: List Scan - simply list targets to scan + -sn: Ping Scan - disable port scan + -Pn: Treat all hosts as online -- skip host discovery + -PS/PA/PU/PY[portlist]: TCP SYN/ACK, UDP or SCTP discovery to given ports + -PE/PP/PM: ICMP echo, timestamp, and netmask request discovery probes + -PO[protocol list]: IP Protocol Ping + -n/-R: Never do DNS resolution/Always resolve [default: sometimes] + --dns-servers : Specify custom DNS servers + --system-dns: Use OS's DNS resolver + --traceroute: Trace hop path to each host +SCAN TECHNIQUES: + -sS/sT/sA/sW/sM: TCP SYN/Connect()/ACK/Window/Maimon scans + -sU: UDP Scan + -sN/sF/sX: TCP Null, FIN, and Xmas scans + --scanflags : Customize TCP scan flags + -sI : Idle scan + -sY/sZ: SCTP INIT/COOKIE-ECHO scans + -sO: IP protocol scan + -b : FTP bounce scan +PORT SPECIFICATION AND SCAN ORDER: + -p : Only scan specified ports + Ex: -p22; -p1-65535; -p U:53,111,137,T:21-25,80,139,8080,S:9 + -F: Fast mode - Scan fewer ports than the default scan + -r: Scan ports consecutively - don't randomize + --top-ports : Scan most common ports + --port-ratio : Scan ports more common than +SERVICE/VERSION DETECTION: + -sV: Probe open ports to determine service/version info + --version-intensity : Set from 0 (light) to 9 (try all probes) + --version-light: Limit to most likely probes (intensity 2) + --version-all: Try every single probe (intensity 9) + --version-trace: Show detailed version scan activity (for debugging) +SCRIPT SCAN: + -sC: equivalent to --script=default + --script=: is a comma separated list of + directories, script-files or script-categories + --script-args=: provide arguments to scripts + --script-args-file=filename: provide NSE script args in a file + --script-trace: Show all data sent and received + --script-updatedb: Update the script database. + --script-help=: Show help about scripts. + is a comma separted list of script-files or + script-categories. +OS DETECTION: + -O: Enable OS detection + --osscan-limit: Limit OS detection to promising targets + --osscan-guess: Guess OS more aggressively +TIMING AND PERFORMANCE: + Options which take