Nmap Manual - https://linux.die.net/man/1/nmap

Nmap Scripts Document (NSE) - https://nmap.org/book/nse-usage.html

Full list of Scripts - https://nmap.org/nsedoc/

nmap --help shows most options.

The most common attack scenario is when an attacker is given the IP address(es) of a machine(s). An attacker would have to enumerate the machine to understand what services are running, and exploit these running services. They do this by scanning ports on the machine they are enumerating. The most common tool used to carry out scans is nmap. Here are the stages you would usually follow when starting out scanning:

1. Start out with a ping scan to see if the host is alive
   1. To check if the machine is actually alive. Uses ICMP protocol.
   2. ping IP-ADDRESS and nmap -sn IP-ADDRESS
   3. The ICMP echo request is sent and if the machine is alive, an ICMP echo reply is received.
   4. Some routers or firewalls block ICMP requests. So it may be alive but won't respond.
2. Carry out a TCP Scan @
3. Carry out a UDP Scan

TCP Scan

Now that you’ve determined a machine is actually up, you can start scanning for services. We’ll start doing this with TCP. You can use nmap to scan for TCP services:

nmap -sT -p port-number -O -sC -sV -T[1-5] -oA output-file-name ip-address

nmap -p- -v --min-parallelism 100 <machine IP> ⇒ Nmap fast scan ( stealth)

• -sT is a TCP connect scan(which is the same as the 3 way handshake). It uses this to check if the port is open
  • -sS is a TCP stealth scan which only sends one packet to see if the TCP port is open
• -p port-number is used to specify what port to scan:
  • -p- can also be used to scan all the ports
  • -F is a common flag used to specify the top 250 common ports