The.mikkel: /* Essential Options */

2025-08-04T09:14:13Z

Essential Options

← Older revision		Revision as of 09:14, 4 August 2025
Line 9:		Line 9:
	* <code>-v</code> / <code>-vv</code> : Verbosity (show progress/details).		* <code>-v</code> / <code>-vv</code> : Verbosity (show progress/details).
	* <code>-oA <basename></code> : Save output in All formats (<code>.nmap</code>, <code>.gnmap</code>, <code>.xml</code>). '''Recommended!'''		* <code>-oA <basename></code> : Save output in All formats (<code>.nmap</code>, <code>.gnmap</code>, <code>.xml</code>). '''Recommended!'''
			* <code>-O</code>: OS detection
	* <code>sudo</code> : Often required for SYN scans (<code>-sS</code> - default) and OS detection (<code>-O</code>).		* <code>sudo</code> : Often required for SYN scans (<code>-sS</code> - default) and OS detection (<code>-O</code>).

The.mikkel: Created page with "== Nmap CTF Quick Reference == Common Nmap commands optimized for speed and typical CTF scenarios. === Essential Options === * `-p-` : Scan all 65535 TCP ports. * `-p <ports>` : Scan specific ports (e.g., `-p 21,22,80,443`, `-p U:53,T:80`). * `-T4` : Aggressive timing (faster, good for CTFs). Use `-T3` (default) if `-T4` causes issues. * `-Pn` : Skip host discovery (Assume host..."

2025-05-02T16:10:51Z

Created page with "== Nmap CTF Quick Reference == Common Nmap commands optimized for speed and typical CTF scenarios. === Essential Options === * <code>-p-</code> : Scan all 65535 TCP ports. * <code>-p <ports></code> : Scan specific ports (e.g., <code>-p 21,22,80,443</code>, <code>-p U:53,T:80</code>). * <code>-T4</code> : Aggressive timing (faster, good for CTFs). Use <code>-T3</code> (default) if <code>-T4</code> causes issues. * <code>-Pn</code> : Skip host discovery (Assume host..."

New page

== Nmap CTF Quick Reference ==
Common Nmap commands optimized for speed and typical CTF scenarios.

=== Essential Options ===
* <code>-p-</code> : Scan all 65535 TCP ports.
* <code>-p <ports></code> : Scan specific ports (e.g., <code>-p 21,22,80,443</code>, <code>-p U:53,T:80</code>).
* <code>-T4</code> : Aggressive timing (faster, good for CTFs). Use <code>-T3</code> (default) if <code>-T4</code> causes issues.
* <code>-Pn</code> : Skip host discovery (Assume host is online). '''Crucial''' if ping is blocked.
* <code>-v</code> / <code>-vv</code> : Verbosity (show progress/details).
* <code>-oA <basename></code> : Save output in All formats (<code>.nmap</code>, <code>.gnmap</code>, <code>.xml</code>). '''Recommended!'''
* <code>sudo</code> : Often required for SYN scans (<code>-sS</code> - default) and OS detection (<code>-O</code>).

=== 1. Initial Fast TCP Scan ===
'''Goal:''' Quickly find ALL open TCP ports.
<syntaxhighlight lang="bash">
sudo nmap -p- -T4 -Pn --min-rate=1000 -v -oA initial_scan <target_IP>
</syntaxhighlight>
* <code>--min-rate=1000</code> : Tries to send packets quickly; adjust if needed.

=== 2. Service Scan + Default Scripts (TCP) ===
'''Goal:''' Identify service versions & run safe scripts on specific/all ports. '''Most common CTF scan.'''
<syntaxhighlight lang="bash">
# Scan specific TCP ports (e.g., found from initial scan)
sudo nmap -p 22,80,445 -sV -sC -T4 -Pn -v -oA service_scan <target_IP>

# Scan ALL TCP ports (combines step 1 & 2)
sudo nmap -p- -sV -sC -T4 -Pn -v -oA full_tcp_scan <target_IP>
</syntaxhighlight>
* <code>-sV</code> : Detect Service/Version info.
* <code>-sC</code> : Run Default Scripts (safe & very useful).

=== 3. Aggressive Scan ===
'''Goal:''' Shortcut for OS detection, Version detection, Default scripts, Traceroute.
<syntaxhighlight lang="bash">
# Aggressive scan on default top 1000 TCP ports
sudo nmap -A -T4 -Pn -v -oA aggressive_default <target_IP>

# Aggressive scan on ALL TCP ports
sudo nmap -A -p- -T4 -Pn -v -oA aggressive_all_tcp <target_IP>
</syntaxhighlight>
* <code>-A</code> : Enables OS detection (<code>-O</code>), Version detection (<code>-sV</code>), Script scanning (<code>-sC</code>), and Traceroute (<code>--traceroute</code>).

=== 4. UDP Scan ===
'''Goal:''' Find open UDP services (SNMP, NFS, TFTP, etc.). '''Warning: Slow!'''
<syntaxhighlight lang="bash">
# Scan Top 100 UDP ports (faster) + Service Detection
sudo nmap -sU -sV --top-ports 100 -T4 -Pn -v -oA udp_top100 <target_IP>

# Scan specific common UDP ports
sudo nmap -sU -sV -p U:53,69,123,161 -T4 -Pn -v -oA udp_specific <target_IP>
</syntaxhighlight>
* <code>-sU</code> : UDP scan.
* <code>--top-ports <number></code> : Limits scan to the most common ports (much faster than <code>-p-</code> for UDP).

=== 5. NSE Script Scans ===
'''Goal:''' Run specific Nmap Scripting Engine scripts.
<syntaxhighlight lang="bash">
# Run vulnerability detection scripts on specific ports
sudo nmap --script vuln -p 80,443 -Pn -v -oA vuln_scan <target_IP>

# Run specific script(s) (e.g., HTTP enumeration)
sudo nmap -p 80 --script http-enum,http-title -Pn -v -oA http_enum <target_IP>

# Run SMB enumeration scripts
sudo nmap -p 139,445 --script smb-enum-shares,smb-os-discovery -Pn -v -oA smb_enum <target_IP>
</syntaxhighlight>
* <code>--script <category|scriptname></code> : Specify scripts to run (e.g., <code>vuln</code>, <code>discovery</code>, <code>http-enum</code>). Check rules before using <code>exploit</code> scripts.

=== Common CTF Workflow ===
# Fast full TCP scan: <code>sudo nmap -p- -T4 -Pn --min-rate=1000 -v -oA initial <target_IP></code>
# Identify open TCP ports from output (e.g., <code>grep open initial.gnmap</code>).
# Detailed TCP scan on open ports: <code>sudo nmap -p <open_ports> -sV -sC -T4 -Pn -v -oA details <target_IP></code>
# Quick UDP scan: <code>sudo nmap -sU -sV --top-ports 100 -T4 -Pn -v -oA udp_top <target_IP></code>
# Targeted NSE scans based on findings (e.g., <code>--script http-enum</code> on port 80).

=== Quick Tips ===
* '''Always''' use <code>-oA</code> to save results.
* Use <code>-Pn</code> if hosts don't respond to ping.
* Don't forget UDP, but scan specific/top ports first due to speed.
* Review <code>/usr/share/nmap/scripts/</code> or use <code>nmap --script=help</code> to find scripts.
* Check CTF rules regarding scan intensity (<code>-T5</code>) or intrusive scripts (<code>vuln</code>, <code>exploit</code>).

Nmap - Revision history

The.mikkel: /* Essential Options */