Nmap Cheatsheet
Network Mapper — Panduan Lengkap dari Basic sampai Advanced
Di Generate oleh Claude Sonnet 4.6 Extended
Daftar Isi
- Host Discovery
- Port Scan
- Tipe Scan
- Service & Version Detection
- OS Detection
- NSE — Nmap Scripting Engine
- NSE — Script Kategori Populer
- Timing & Performa
- Format Output
- Firewall/IDS Evasion
- Teknik Lanjutan
Host Discovery
Level: Basic
| Perintah | Deskripsi |
|---|---|
nmap 192.168.1.1 | Scan satu host/IP |
nmap 192.168.1.1-254 | Scan range IP |
nmap 192.168.1.0/24 | Scan seluruh subnet /24 |
nmap -sn 192.168.1.0/24 | Ping scan — hanya cek host aktif, tanpa port scan |
nmap -Pn 192.168.1.1 | Skip host discovery, anggap semua host hidup |
nmap -PS 192.168.1.1 | TCP SYN ping discovery |
nmap -PA 192.168.1.1 | TCP ACK ping discovery |
nmap -PU 192.168.1.1 | UDP ping discovery |
nmap -PE 192.168.1.1 | ICMP echo request ping |
nmap --traceroute 192.168.1.1 | Trace rute ke host target |
nmap -iL targets.txt | Baca daftar target dari file |
nmap --exclude 192.168.1.5 192.168.1.0/24 | Kecualikan IP tertentu dari scan |
Port Scan
Level: Basic
| Perintah | Deskripsi |
|---|---|
nmap -p 22 192.168.1.1 | Scan port spesifik |
nmap -p 22,80,443 192.168.1.1 | Scan beberapa port sekaligus |
nmap -p 1-1000 192.168.1.1 | Scan range port |
nmap -p- 192.168.1.1 | Scan semua 65535 port |
nmap --top-ports 100 192.168.1.1 | Scan 100 port paling umum |
nmap -F 192.168.1.1 | Fast scan — 100 port top (lebih cepat) |
nmap -p U:53,T:80 192.168.1.1 | Scan UDP port 53 dan TCP port 80 |
Tipe Scan
Level: Intermediate
| Perintah | Deskripsi |
|---|---|
nmap -sS 192.168.1.1 | TCP SYN scan (stealth) — default jika root |
nmap -sT 192.168.1.1 | TCP connect scan — untuk non-root user |
nmap -sU 192.168.1.1 | UDP scan — lebih lambat, perlu root |
nmap -sA 192.168.1.1 | TCP ACK scan — deteksi firewall rules |
nmap -sW 192.168.1.1 | TCP Window scan |
nmap -sN 192.168.1.1 | TCP Null scan — tidak ada flag TCP |
nmap -sF 192.168.1.1 | TCP FIN scan — hanya flag FIN |
nmap -sX 192.168.1.1 | Xmas scan — FIN, URG, PSH flags aktif |
nmap -sM 192.168.1.1 | TCP Maimon scan |
nmap -sI zombie 192.168.1.1 | Idle/Zombie scan — IP spoofing via zombie host |
Service & Version Detection
Level: Intermediate
| Perintah | Deskripsi |
|---|---|
nmap -sV 192.168.1.1 | Deteksi versi service yang berjalan |
nmap -sV --version-intensity 9 192.168.1.1 | Version detection intensitas maksimal (0-9) |
nmap -sV --version-light 192.168.1.1 | Version detection ringan (intensitas 2) |
nmap -sV --version-all 192.168.1.1 | Coba semua probe untuk version detection |
nmap -A 192.168.1.1 | Aggressive: OS, version, script, traceroute sekaligus |
OS Detection
Level: Intermediate
| Perintah | Deskripsi |
|---|---|
nmap -O 192.168.1.1 | OS detection (perlu root/admin) |
nmap -O --osscan-guess 192.168.1.1 | Tebak OS walau tidak pasti |
nmap -O --osscan-limit 192.168.1.1 | Hanya OS scan jika ada port terbuka & tertutup |
nmap -O --max-os-tries 3 192.168.1.1 | Batasi percobaan OS detection |
NSE — Nmap Scripting Engine
Level: Intermediate
| Perintah | Deskripsi |
|---|---|
nmap -sC 192.168.1.1 | Jalankan default scripts (sama dengan --script=default) |
nmap --script=http-title 192.168.1.1 | Jalankan script spesifik |
nmap --script=http-* 192.168.1.1 | Jalankan semua script HTTP |
nmap --script=vuln 192.168.1.1 | Cek kerentanan umum |
nmap --script=auth 192.168.1.1 | Script autentikasi (brute force, bypass) |
nmap --script=safe 192.168.1.1 | Hanya jalankan script yang aman |
nmap --script=banner 192.168.1.1 | Ambil banner dari service |
nmap --script=smb-vuln-* 192.168.1.1 | Cek kerentanan SMB (EternalBlue dll) |
nmap --script=ssl-enum-ciphers -p 443 192.168.1.1 | Enum cipher suite SSL/TLS |
nmap --script-args='user=admin,pass=1234' --script=http-auth 192.168.1.1 | Kirim argumen ke script |
nmap --script-help http-title | Lihat dokumentasi script tertentu |
nmap --script-updatedb | Update database script NSE |
NSE — Script Kategori Populer
Level: Advanced
| Perintah | Deskripsi |
|---|---|
nmap --script=discovery 192.168.1.1 | Kumpulkan informasi tambahan tentang host |
nmap --script=exploit 192.168.1.1 | Script eksploitasi (gunakan dengan izin!) |
nmap --script=brute 192.168.1.1 | Brute force login berbagai protokol |
nmap --script=dos 192.168.1.1 | Script DoS — sangat hati-hati! |
nmap --script=intrusive 192.168.1.1 | Script invasif — bisa crash service target |
nmap --script=ftp-anon -p 21 192.168.1.1 | Cek akses FTP anonim |
nmap --script=dns-brute --script-args dns-brute.domain=target.com | DNS subdomain brute force |
Timing & Performa
Level: Intermediate
| Perintah | Deskripsi |
|---|---|
nmap -T0 192.168.1.1 | Paranoid — sangat lambat, IDS evasion |
nmap -T1 192.168.1.1 | Sneaky — lambat untuk evasion |
nmap -T2 192.168.1.1 | Polite — hemat bandwidth |
nmap -T3 192.168.1.1 | Normal — default |
nmap -T4 192.168.1.1 | Aggressive — lebih cepat, jaringan cepat |
nmap -T5 192.168.1.1 | Insane — sangat cepat, mungkin miss port |
nmap --min-rate 1000 192.168.1.1 | Kirim minimal 1000 paket per detik |
nmap --max-retries 1 192.168.1.1 | Batasi retry per port |
nmap --host-timeout 30s 192.168.1.1 | Timeout per host 30 detik |
Format Output
Level: Basic
| Perintah | Deskripsi |
|---|---|
nmap -oN output.txt 192.168.1.1 | Simpan output normal ke file |
nmap -oX output.xml 192.168.1.1 | Simpan output format XML |
nmap -oG output.gnmap 192.168.1.1 | Simpan output grepable |
nmap -oA output 192.168.1.1 | Simpan semua format sekaligus (.nmap, .xml, .gnmap) |
nmap -v 192.168.1.1 | Verbose — tampilkan lebih banyak info |
nmap -vv 192.168.1.1 | Very verbose |
nmap -d 192.168.1.1 | Debug mode |
nmap --open 192.168.1.1 | Tampilkan hanya port yang terbuka |
nmap --reason 192.168.1.1 | Tampilkan alasan status port |
nmap --packet-trace 192.168.1.1 | Tampilkan semua paket yang dikirim/diterima |
Firewall/IDS Evasion
Level: Advanced
| Perintah | Deskripsi |
|---|---|
nmap -f 192.168.1.1 | Fragment paket — bypass beberapa firewall |
nmap --mtu 24 192.168.1.1 | Set ukuran MTU custom untuk fragmentasi |
nmap -D RND:10 192.168.1.1 | Decoy: 10 IP palsu acak + IP asli |
nmap -D 10.0.0.1,10.0.0.2 192.168.1.1 | Decoy: IP palsu spesifik |
nmap -S 10.0.0.99 192.168.1.1 | Spoof source IP address |
nmap -e eth0 192.168.1.1 | Gunakan interface jaringan tertentu |
nmap --source-port 53 192.168.1.1 | Spoof source port (misal port DNS 53) |
nmap --data-length 25 192.168.1.1 | Tambah data acak di paket |
nmap --badsum 192.168.1.1 | Kirim paket dengan checksum rusak |
nmap --proxies http://proxy:8080 192.168.1.1 | Gunakan proxy/rantai proxy |
nmap --spoof-mac 0 192.168.1.1 | Spoof MAC address acak |
nmap --spoof-mac Dell 192.168.1.1 | Spoof MAC sesuai vendor |
Teknik Lanjutan
Level: Advanced
| Perintah | Deskripsi |
|---|---|
nmap --script=http-enum -p 80,443 192.168.1.1 | Enum direktori & file web umum |
nmap -sV -sC -p- --min-rate 5000 192.168.1.1 | Full scan cepat untuk pentest (semua port) |
nmap -sn --script=nbstat 192.168.1.0/24 | Ambil nama NetBIOS seluruh jaringan |
nmap -6 fe80::1 | Scan target IPv6 |
nmap --script=broadcast-dhcp-discover | Discover DHCP server di jaringan lokal |
nmap --script=targets-ipv6-multicast-echo | Discover host IPv6 via multicast |
nmap --script=firewalk --traceroute 192.168.1.1 | Identifikasi port yang di-filter firewall |
nmap --scanflags URGACKPSHRSTSYNFIN 192.168.1.1 | Custom TCP flags untuk scan |
nmap --ip-options 'L 192.168.1.1 192.168.1.2' 192.168.1.1 | Gunakan IP options untuk loose source routing |