Cool Nmap Tricks and Techniques

Published 6 June 2021Updated 26 October 20265 min read

Update, October 2026: The commands below have been corrected so they run when pasted, and the rogue access point scan now uses explicit time units and a private /16 range. The Google Safe Browsing check has been removed: the http-google-malware script uses an API version Google shut down in October 2018. Scan only networks you are authorized to test; see the Nmap Reference Guide for current options.

Nmap is a FREE popular tool that has many powerful features and we are probably not utilizing its capabilities to the fullest.

Nmap Tricks and Techniques

Here is my list of “not so” commonly used Nmap commands which you may find useful.

Use ranges and wildcards on your scanning

nmap -sA 192.168.*.1-10,250-254

This way you will scan everything starting with 192.168 and ending either with 1-10 or 250-254

Disable DNS name resolution

nmap -p 80 -n 192.168.1.1

You may want to disable reverse DNS resolution to speed up your scans.

Scan for top ports

nmap --top-ports 100 192.168.1.1

the “—top-ports” parameter will let you scan the target(s) on the top most common ports, in this example the top 100 common ports.

Get a list of servers with a specific port open

nmap -sT -p 8080 192.168.1.* | grep open

Change the -p argument with the port you want to scan for.

Scan your network for rogue Access Points

nmap -A -p1-85,113,443,8080-8100 -T4 --min-hostgroup 50 --max-rtt-timeout 1000ms --initial-rtt-timeout 300ms --max-retries 3 --host-timeout 20m --max-scan-delay 1000ms -oA RogueAPScan 192.168.0.0/16

Replace the range with your own internal network, and scan only networks you are authorized to test. Nmap reads time values without a unit as seconds, so keep the ms suffixes.

Scan using a decoy to mask your scanner

nmap -sS 192.168.1.1 -D 192.168.1.2

With this command, you are scanning the ports on host 192.168.1.1, and the target’s logs will show scans from both your real address and the “decoy” address 192.168.1.2, which makes it harder to tell which one is the real scanner. Note that you can use multiple addresses for decoy, and the decoys should be live hosts, or you may SYN-flood the target.

Find the number of Linux and Windows devices on your network

sudo nmap -F -O 192.168.1.1-255 | grep "Running: " > /tmp/os; echo "$(cat /tmp/os | grep Linux | wc -l) Linux device(s)"; echo "$(cat /tmp/os | grep Windows | wc -l) Window(s) devices"

Spoof source port

nmap -sS -p80 192.168.1.1 -g53 -Pn -n

You can spoof the originating port of the scanner to trick firewalls that only allow traffic coming from specific ports. Port 53 (DNS) is usually allowed on most networks.

Test if the target is vulnerable to DoS attacks

nmap --script dos -Pn 192.168.1.1

Scripts in Nmap’s dos category may cause a denial of service, and some crash vulnerable services as a side effect of testing them. Run them only against systems you own or are explicitly authorized to disrupt, in an agreed test window.

Check for known vulnerabilities

nmap -Pn --script vuln 192.168.1.1

This way you can check your target for a set of specific known vulnerabilities using the vuln script category of Nmap’s scripting engine (NSE). These scripts generally report only the vulnerabilities they find, so this is not a substitute for a vulnerability scanner.

Launch brute force attacks

nmap -p 1433 --script ms-sql-brute --script-args userdb=usersFile.txt,passdb=passwordsFile.txt 192.168.1.1

You can use Nmap to perform brute force attacks for several applications like FTP, WordPress, and MS-SQL like the example above. You must specify a user file and a password file for the scanner to use and test them against the application.

Detect malware-infected hosts

nmap -sV --script "malware and not external" 192.168.1.1

This runs Nmap’s small set of malware scripts that check for specific known backdoors and signs of compromise (for example the ProFTPD, vsftpd and UnrealIRCd backdoors, identd spoofing and SMTP on unusual ports), leaving out the ones that query outside services. The backdoor checks are intrusive: they try the backdoor with a harmless command, so run them only on hosts you are authorized to test. A clean result does not mean a host is free of malware.

List reverse DNS records on a subnet

nmap -R -sL 192.168.1.0/24 | awk '{if($3=="not")print"("$2") no PTR";else print$3" is "$2}' | grep '('

FAQ

What is the main use for Nmap?

Nmap is a network scanning tool that uses IP packets to identify all the devices connected to a network and to provide information on the services and operating systems they are running.

How many types of Nmap scans are there?

Ping sweep SYN Scan TCP connect scan TCP ACK scan TCP Maimon scan UDP scan Idle scan TCP Window scan Bounce scan FIN scan Null scan XMAS scan SCTP INIT scan SCTP COOKIE ECHO scan IP protocol scan

Is Nmap scanning legal?

Network probing or port scanning is only permitted when explicitly authorized by the owner of the destination host and/or network. Unauthorized port scanning, for any reason, is strictly prohibited.

Can you detect a Nmap scan?

It is hard to detect scans with high accuracy. Special tools to detect port scans like PortSentry and Scanlogd can be used to detect Nmap scans.

Can Nmap detect vulnerabilities?

Yes. Nmap can also show you a list of active live hosts, available ports, and the operating systems running on every device connected. Nmap can also be used to identify vulnerabilities in your network. Once Nmap identifies the version and applications running on a specific host it can then further determine their open vulnerabilities.

How accurate is Nmap?

Nmap is fairly accurate. There are several cases where Nmap cannot detect a machine’s OS. Nmap needs at least one open and one closed port to perform OSD accurately. In the case where a machine on the network does not accept incoming connections, Nmap will not be able to determine the machine’s OS.

Can Nmap bypass firewalls?

Nmap offers several scan methods that are good at sneaking past firewalls while still providing the desired port state information. FIN scan is one such technique.

How long does a full Nmap scan take to complete?

It depends on the options and the network. Port range, timing template, host responsiveness, version detection and scripts all change scan time considerably: a scan of the default 1,000 TCP ports on a responsive local host finishes quickly, while a full UDP scan of a host that rate-limits its responses can take many hours. Use the timing options and --top-ports to control this.

Correction, 26 October 2026: this article said Nmap’s dos scripts do not attack the target, but some can crash vulnerable services; it gave the rogue access point scan a /8 range (16.7 million mostly public addresses) and timeouts without the ms unit, which Nmap reads as seconds; it said a decoy scan shows only the decoy address in the target’s logs, but the real address appears among the decoys; it described the vuln scripts as a full vulnerability test, but they check for specific known vulnerabilities; and it said a scan takes about 21 minutes per host, but scan time depends on the options.