Nmap Generator

Scan Types

Flag	Name	Root?	Description
-sS	SYN Stealth	Yes	Sends SYN, never completes handshake. Fast and stealthy — default when run as root.
-sT	TCP Connect	No	Full TCP handshake via OS. Slower, leaves logs, but works without root.
-sU	UDP Scan	Yes	Probes UDP ports. Slow — no response = open\|filtered. ICMP unreachable = closed.
-sA	ACK Scan	Yes	Maps firewall rules. RST = unfiltered. No response or ICMP = filtered.
-sW	Window Scan	Yes	Like ACK, but inspects TCP window size. OS-dependent results.
-sN	Null Scan	Yes	No flags set. No response = open\|filtered. RFC-compliant RST = closed.
-sF	FIN Scan	Yes	FIN flag only. Bypasses some packet filters. Same interpretation as Null.
-sX	Xmas Scan	Yes	FIN, PSH, and URG flags. "Lit up like a Christmas tree."
-sI	Idle/Zombie	Yes	Uses a third-party zombie host's IP ID sequence to scan target anonymously.
-sn	Ping Scan	No	Host discovery only, no port scan. Determines which hosts are up.
-sV	Version Detect	No	Probes open ports to determine service and version running.
-O	OS Detection	Yes	Uses TCP/IP stack fingerprinting to guess the OS and version.
-A	Aggressive	Yes	Enables -O, -sV, -sC, and --traceroute simultaneously.

Timing Templates

Flag	Name	Use Case	Approx. Speed
-T0	Paranoid	IDS evasion, extremely covert	Serialized, 5 min/probe delay
-T1	Sneaky	IDS evasion, slow recon	15 sec delay between probes
-T2	Polite	Reduce bandwidth/resource impact	0.4 sec delay
-T3	Normal	Default, balanced	No delay, adaptive
-T4	Aggressive	Fast, trusted LAN or lab	10ms timeout, fast retransmit
-T5	Insane	Max speed, may drop accuracy	5ms timeout, no retransmit

Host Discovery Flags

Flag	Description
-Pn	Skip ping, treat all hosts as up (useful when ICMP is blocked)
-PE	ICMP echo request (ping) for host discovery
-PS[portlist]	TCP SYN ping on specified ports (default: 80)
-PA[portlist]	TCP ACK ping on specified ports (default: 80)
-PU[portlist]	UDP ping on specified ports
-PO[proto]	IP protocol ping
-PR	ARP ping — fastest for local network segments
-n	No DNS resolution — speeds up scans significantly
-R	Force DNS resolution for all hosts
--dns-servers	Specify custom DNS server(s)

Port Specification

Flag	Example	Description
-p	-p 22,80,443	Scan specific ports
-p	-p 1-1024	Scan port range
-p-	-p-	Scan all 65535 ports
-p U:53,T:80	-p U:53,T:22,80	Specify protocol per port
--top-ports	--top-ports 100	Scan N most common ports
--port-ratio	--port-ratio 0.1	Scan ports with ratio > value (0–1)
-F	-F	Fast mode — top 100 ports only
-r	-r	Scan ports in sequential (not random) order

Output Formats

Flag	Format	Description
-oN <file>	Normal	Human-readable text, same as terminal output
-oX <file>	XML	Machine-parseable XML — compatible with Metasploit, etc.
-oG <file>	Grepable	Single-line per host, easy to grep/awk
-oS <file>	Script Kiddie	Leet-speak output (not useful in production)
-oA <base>	All Formats	Saves -oN, -oX, and -oG simultaneously to <base>.nmap / .xml / .gnmap
-v / -vv	Verbose	Increase output verbosity during scan
-d / -dd	Debug	Debug level output for troubleshooting
--open	Open only	Only show ports with state: open
--reason	Reason	Display reason for each port state (RST, SYN-ACK, etc.)
--stats-every <t>	Progress	Print periodic progress stats (e.g. --stats-every 10s)

NSE Script Categories

Category	Flag	Description
auth	--script=auth	Authentication/bypass tests (default credentials, anonymous logins)
broadcast	--script=broadcast	Discover hosts via LAN broadcast probes
default	-sC or --script=default	Commonly useful, fast, non-intrusive scripts
discovery	--script=discovery	Active and passive network reconnaissance
dos	--script=dos	Denial-of-service vulnerability tests (use with caution)
exploit	--script=exploit	Attempt to exploit identified vulnerabilities
external	--script=external	Send data to external third-party services
fuzzer	--script=fuzzer	Send randomized/unexpected data to test robustness
intrusive	--script=intrusive	May crash or adversely affect target — use only with permission
malware	--script=malware	Check for backdoors, malware, and compromised services
safe	--script=safe	Non-intrusive scripts that will not crash services
version	--script=version	Enhance version detection (used with -sV)
vuln	--script=vuln	Check for known vulnerabilities — combines safe+intrusive checks

Useful NSE scripts for broadcast environments: snmp-info, http-title, ssl-cert, banner, dns-brute, ssh-hostkey

Common Nmap Examples

Always obtain written authorization before scanning any network you do not own. Unauthorized scanning may be illegal.

Quick host discovery — who's on the network?

nmap -sn 192.168.1.0/24

Fast SYN scan — top 1000 ports, version detect

sudo nmap -sS -sV -T4 --open -oA scan_results 192.168.1.0/24

Aggressive scan — OS, version, scripts, traceroute

sudo nmap -A -T4 -v 192.168.1.100

Full port scan — all 65535 ports

sudo nmap -sS -p- -T4 --open -n 10.0.0.1

UDP scan — DNS, SNMP, NTP

sudo nmap -sU -p 53,123,161,162,500 --open -T4 192.168.1.0/24

Vulnerability scan — check for known CVEs

sudo nmap -sV --script=vuln -T4 -oN vuln_scan.txt 192.168.1.100

SMB vulnerability check (EternalBlue, etc.)

sudo nmap -p 445 --script=smb-vuln* -T4 192.168.1.0/24

Firewall/ACL mapping — ACK scan

sudo nmap -sA -T4 -p 80,443,22,3389 --reason 192.168.1.1

SNMP device discovery (broadcast network gear)

sudo nmap -sU -p 161 --script=snmp-info -T4 10.0.0.0/24

Web server enumeration

nmap -p 80,443,8080,8443 --script=http-title,http-headers,ssl-cert -T4 192.168.1.0/24

Slow, stealthy IDS-evasion scan

sudo nmap -sS -T1 -Pn -n -p 80,443,22 --data-length 24 10.0.0.1

Legal Reminder: Always obtain written authorization before scanning. Unauthorized port scanning may violate the Computer Fraud and Abuse Act (CFAA) and equivalent laws worldwide.

Nmap Generator

Target

Scan Type

Timing & Aggression

Port Selection

Output

Detection & Script Options

Scan Types

Timing Templates

Host Discovery Flags

Port Specification

Output Formats

NSE Script Categories

Common Nmap Examples